rcf-lite 0.26.0 → 0.28.0

package/blueprints/edge-cloudflare-turnstile/contributions/tacs/tac-3601-edge-cloudflare-turnstile-widget-mount.json

@@ -5,11 +5,11 @@
   "version": "1.0.0",
   "status": "approved",
   "name": "Turnstile client widget mount with elicited sitekey and third-party script pin",
-  "purpose": "The client-side widget mount module for Cloudflare Turnstile. Mounts the Turnstile widget on elicited surfaces with the elicited TURNSTILE_SITEKEY. Injects only Cloudflare Turnstile JS from the Cloudflare Turnstile host (https://challenges.cloudflare.com/turnstile/v0/api.js per https://developers.cloudflare.com/turnstile/) and no other third-party script. Populates the hidden Cf-Turnstile-Response token field on submit. Widget mode is per ADR-3602 (managed, non-interactive, invisible).",
+  "purpose": "The client-side widget mount module for Cloudflare Turnstile. Mounts the Turnstile widget on elicited surfaces with the elicited TURNSTILE_SITEKEY. Injects only Cloudflare Turnstile JS from the Cloudflare Turnstile host (https://challenges.cloudflare.com/turnstile/v0/api.js per https://developers.cloudflare.com/turnstile/) and no other third-party script. Populates the hidden cf-turnstile-response token field on submit. Widget mode is per ADR-3602 (managed, non-interactive, invisible).",
   "responsibilities": [
     "Render the Turnstile widget on every elicited surface with the elicited TURNSTILE_SITEKEY (AC-35101-1).",
     "Inject only Cloudflare Turnstile JS from the Cloudflare Turnstile host; refuse any other third-party script.",
-    "Populate the hidden Cf-Turnstile-Response token field on the form payload before submit fires.",
+    "Populate the hidden cf-turnstile-response token field on the form payload before submit fires.",
     "Honour the elicited widget mode enum: managed, non-interactive, invisible (AC-35106-1)."
   ],
   "internalStructure": "One client module realising the Turnstile mount. In the pack fixture the mount is inline in the served HTML for auditability; in an applied Workers project the mount ships as a small module the operator drops into the elicited surface.",

package/blueprints/edge-cloudflare-turnstile/contributions/tacs/tac-3602-edge-cloudflare-turnstile-server-verifier.json

@@ -5,7 +5,7 @@
   "version": "1.0.0",
   "status": "approved",
   "name": "Turnstile server-side siteverify verifier and refuse-if-token-missing guard",
-  "purpose": "The server-side verifier module. POSTs {secret, response} to https://challenges.cloudflare.com/turnstile/v0/siteverify per Cloudflare Turnstile documented endpoint. On success:true proceeds; on success:false rejects 400 with error-codes body per ADR-3603. The refuse-if-token-missing guard is the sole reader of the Cf-Turnstile-Response payload field and rejects missing-token submits with 400 before any downstream handler runs.",
+  "purpose": "The server-side verifier module. POSTs {secret, response} to https://challenges.cloudflare.com/turnstile/v0/siteverify per Cloudflare Turnstile documented endpoint. On success:true proceeds; on success:false rejects 400 with error-codes body per ADR-3603. The refuse-if-token-missing guard is the sole reader of the cf-turnstile-response payload field and rejects missing-token submits with 400 before any downstream handler runs.",
   "responsibilities": [
     "Own the ONLY reference to https://challenges.cloudflare.com/turnstile/v0/siteverify in the applied source tree (AC-35102-1, AC-35103-1).",
     "Read TURNSTILE_SECRET only via env-shaped facade; refuse any inline literal (AC-35107-1).",
@@ -27,7 +27,7 @@
     {
       "name": "verifier.guard",
       "kind": "method",
-      "summary": "Middleware that reads Cf-Turnstile-Response and rejects missing-token submits with 400."
+      "summary": "Middleware that reads cf-turnstile-response and rejects missing-token submits with 400."
     }
   ],
   "dependencies": [],

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35101.json

@@ -6,22 +6,63 @@
   "status": "approved",
   "title": "Turnstile client widget mounts with the elicited sitekey and injects no third-party script beyond the Cloudflare Turnstile host",
   "asA": "shelf consumer applying the edge-cloudflare-turnstile v1.0.0 blueprint on a Workers project using the probe-pack-edge-cloudflare-turnstile fixture",
-  "iWant": "the Turnstile widget to mount on my public form with the elicited TURNSTILE_SITEKEY, to inject only Cloudflare Turnstile JS and no other third-party script, and to populate the hidden Cf-Turnstile-Response token field on submit",
+  "iWant": "the Turnstile widget to mount on my public form with the elicited TURNSTILE_SITEKEY, to inject only Cloudflare Turnstile JS and no other third-party script, and to populate the hidden cf-turnstile-response token field on submit",
   "soThat": "every submit that reaches my server carries a Turnstile response my server-side verifier can check and the browser has loaded no scripts I did not authorise",
   "acceptanceCriteria": [
     {
       "id": "AC-35101-1",
-      "description": "When the fixture page loads with the pinned always-pass test sitekey (1x00000000000000000000AA per https://developers.cloudflare.com/turnstile/troubleshooting/testing/), the Turnstile widget mounts and an iframe whose src origin is https://challenges.cloudflare.com is present; the page loads no third-party script from any other origin; the form payload on submit carries a non-empty Cf-Turnstile-Response value.",
+      "description": "When the fixture page loads with the pinned always-pass test sitekey (1x00000000000000000000AA per https://developers.cloudflare.com/turnstile/troubleshooting/testing/), the Turnstile widget mounts and an iframe whose src origin is https://challenges.cloudflare.com is present; the page loads no third-party script from any other origin; the form payload on submit carries a non-empty cf-turnstile-response value.",
       "given": "the pack fixture form loaded with default sitekey=pass and the pinned always-pass test sitekey applied",
       "when": "the widget renders and the operator submits",
-      "then": "the Turnstile widget is mounted, its iframe origin is Cloudflare Turnstile only, and the submit payload contains the Cf-Turnstile-Response token",
+      "then": "the Turnstile widget is mounted, its iframe origin is Cloudflare Turnstile only, and the submit payload contains the cf-turnstile-response token",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3601-edge-cloudflare-turnstile-widget-mount",
+        "field": "responsibilities.tokenFieldPopulate"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/turnstile/get-started/client-side-rendering/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-35101-2",
+      "description": "When the fixture page loads with the pinned always-fail test sitekey (2x00000000000000000000AB per https://developers.cloudflare.com/turnstile/troubleshooting/testing/), the Turnstile widget mounts and an iframe whose src origin is https://challenges.cloudflare.com is present; the widget's always-fail branch is observable client-side and the form payload on submit carries a cf-turnstile-response value the server-side verifier will reject as invalid-input-response.",
+      "given": "the pack fixture form loaded with the pinned always-fail test sitekey (2x00000000000000000000AB)",
+      "when": "the widget renders and the operator submits",
+      "then": "the Turnstile widget is mounted from the Cloudflare Turnstile origin only, no third-party script from any other origin loads, and the submit payload carries a cf-turnstile-response value that the server-side verifier will reject per US-35103 AC-35103-1",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3601-edge-cloudflare-turnstile-widget-mount",
+        "field": "responsibilities.tokenFieldPopulate"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/turnstile/troubleshooting/testing/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-35101-3",
+      "description": "The applied blueprint's manifest declares the `humanCheck` capability token and the elicited surface renders the Cloudflare Turnstile widget with the pinned test sitekey per AC-35101-1; therefore the `humanCheck` promise the manifest carries is backed by a live widget the applying project can submit through.",
+      "given": "the applied blueprint manifest at `blueprints/edge-cloudflare-turnstile/blueprint.json` and the pack fixture serving the elicited surface at `packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile/`",
+      "when": "the widget-rendered check reads the blueprint manifest and mounts the fixture surface",
+      "then": "the manifest carries `humanCheck` on its `capabilities[]` list and the fixture surface renders the Turnstile widget from the Cloudflare Turnstile origin only, so `humanCheck` is a live promise the applying project can act on",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3601-edge-cloudflare-turnstile-widget-mount",
+        "field": "interfaces.mountTurnstile"
+      }
     }
   ],
   "tacIds": [
     "TAC-3601-edge-cloudflare-turnstile-widget-mount"
   ],
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z"
 }

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35102.json

@@ -16,12 +16,63 @@
       "when": "a submit hits /api/submit with any response token",
       "then": "the server-side POST to siteverify returns success:true and the handler responds 200",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+        "field": "interfaces.verifier.verify"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/turnstile/troubleshooting/testing/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-35102-2",
+      "description": "Given the pack fixture with an empty TURNSTILE_SITEKEY in the environment, when the applying project boots, the widget mount refuses to render with a stable turnstile.sitekey-missing error and no submit surface is reachable until the sitekey is set.",
+      "given": "the pack fixture running with TURNSTILE_SITEKEY unset or empty",
+      "when": "the applying project boots and a client loads a guarded surface",
+      "then": "the widget mount refuses to render, the guarded surface returns 503 with body {\"errorCode\":\"turnstile.sitekey-missing\"} and no downstream handler runs",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3601-edge-cloudflare-turnstile-widget-mount",
+        "field": "interfaces.mountTurnstile"
+      }
+    },
+    {
+      "id": "AC-35102-3",
+      "description": "Given the pack fixture with an empty TURNSTILE_SECRET in the environment, when the verifier is constructed at boot, createTurnstileVerifier refuses with a stable turnstile.secret-missing error before any siteverify traffic can fire.",
+      "given": "the pack fixture running with TURNSTILE_SECRET unset or empty",
+      "when": "the verifier factory runs at boot and no downstream handler is registered",
+      "then": "createTurnstileVerifier throws {code:\"turnstile.secret-missing\"} and no siteverify network call is issued",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+        "field": "interfaces.createTurnstileVerifier"
+      }
+    },
+    {
+      "id": "AC-35102-4",
+      "description": "Given the pack fixture with only one of the pair present (TURNSTILE_SITEKEY set and TURNSTILE_SECRET unset, or vice versa), when boot runs, the config refuses with a stable turnstile.pair-incomplete error naming which half is missing.",
+      "given": "the pack fixture running with exactly one of the sitekey/secret pair set",
+      "when": "boot runs and the elicited pair is inspected",
+      "then": "boot refuses with {code:\"turnstile.pair-incomplete\", missing:\"sitekey\"|\"secret\"} and no verifier or widget mount initialises",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+        "field": "interfaces.createTurnstileVerifier"
+      }
     }
   ],
   "tacIds": [
     "TAC-3602-edge-cloudflare-turnstile-server-verifier"
   ],
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-09T12:00:00.000Z"
 }

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35103.json

@@ -16,12 +16,91 @@
       "when": "a submit hits /api/submit with any response token and the verifier calls siteverify",
       "then": "siteverify returns success:false and the handler responds 400 with an error-codes body and no sitekey leak",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+        "field": "interfaces.verifier.verify"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/turnstile/troubleshooting/testing/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-35103-2",
+      "description": "Given the pack fixture with the injected fetch simulating a siteverify request timeout (fetch rejects with AbortError after the bounded timeout), when a submit hits /api/submit and the verifier calls siteverify, the handler refuses 502 with body {\"errorCode\":\"turnstile.verifier-timeout\"}, no downstream handler runs, and exactly one metadata-only audit event fires carrying no response-token or secret substring.",
+      "given": "the pack fixture running with an injected fetch that rejects with AbortError after the bounded timeout window",
+      "when": "a submit hits /api/submit carrying a response token and the verifier calls siteverify",
+      "then": "the handler responds 502 with {\"errorCode\":\"turnstile.verifier-timeout\"} and one audit event with metadata only",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+        "field": "interfaces.verifier.verify"
+      }
+    },
+    {
+      "id": "AC-35103-3",
+      "description": "Given an injected fetch that rejects with a network error (ECONNRESET or DNS failure), when the verifier calls siteverify, the handler refuses 502 with body {\"errorCode\":\"turnstile.verifier-network\"}, no downstream handler runs, and the audit event carries no response-token or secret substring.",
+      "given": "the pack fixture with an injected fetch that rejects synchronously with a network error",
+      "when": "the verifier calls siteverify",
+      "then": "the handler responds 502 with {\"errorCode\":\"turnstile.verifier-network\"} and one metadata-only audit event",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+        "field": "interfaces.verifier.verify"
+      }
+    },
+    {
+      "id": "AC-35103-4",
+      "description": "Given an injected fetch returning a 500 status body, when the verifier calls siteverify, the handler refuses 502 with body {\"errorCode\":\"turnstile.verifier-upstream\", \"upstreamStatus\":500}, no downstream handler runs.",
+      "given": "the pack fixture with an injected fetch returning status 500 and any body",
+      "when": "the verifier calls siteverify",
+      "then": "the handler responds 502 with {\"errorCode\":\"turnstile.verifier-upstream\",\"upstreamStatus\":500}",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+        "field": "interfaces.verifier.verify"
+      }
+    },
+    {
+      "id": "AC-35103-5",
+      "description": "Given an injected fetch returning status 200 with a body that is not valid JSON, when the verifier parses the response, the handler refuses 502 with body {\"errorCode\":\"turnstile.verifier-malformed\"} and no downstream handler runs.",
+      "given": "the pack fixture with an injected fetch returning a 200 with a non-JSON body",
+      "when": "the verifier parses the response",
+      "then": "the handler responds 502 with {\"errorCode\":\"turnstile.verifier-malformed\"}",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+        "field": "interfaces.verifier.verify"
+      }
+    },
+    {
+      "id": "AC-35103-6",
+      "description": "Given an injected fetch returning valid JSON with no boolean success field (or success set to a non-boolean), when the verifier interprets the response, the handler refuses 502 with body {\"errorCode\":\"turnstile.verifier-malformed\"} (fail-closed) and no downstream handler runs.",
+      "given": "the pack fixture with an injected fetch returning JSON that omits success or supplies a non-boolean value",
+      "when": "the verifier interprets the response",
+      "then": "the handler responds 502 with {\"errorCode\":\"turnstile.verifier-malformed\"} and treats the outcome as failure",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+        "field": "interfaces.verifier.verify"
+      }
     }
   ],
   "tacIds": [
     "TAC-3602-edge-cloudflare-turnstile-server-verifier"
   ],
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-09T12:00:00.000Z"
 }

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35104.json

@@ -11,17 +11,40 @@
   "acceptanceCriteria": [
     {
       "id": "AC-35104-1",
-      "description": "The Node probe guard-shape-scan enumerates every elicited surface in the pack fixture source and asserts each is registered under the token-required guard. A live POST to /api/submit without a Cf-Turnstile-Response field is rejected with 400 and refusal body carries error-code turnstile.token-missing; no downstream handler side-effect is observable.",
-      "given": "the pack fixture running with every elicited surface registered under the token-required guard",
-      "when": "a submit reaches /api/submit without a Cf-Turnstile-Response value",
-      "then": "the guard rejects with 400 with an error-code body and no downstream handler runs",
+      "description": "The Node probe guard-shape-scan enumerates every elicited surface in the pack fixture source and asserts each is registered under the token-required guard; the probe returns aggregateVerdict:pass when every elicited surface has the guard wired.",
+      "given": "the pack fixture source tree with the elicited surfaces registered",
+      "when": "guard-shape-scan enumerates every elicited surface",
+      "then": "every surface is registered under the token-required guard and the probe returns aggregateVerdict:pass",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+        "field": "interfaces.verifier.guard"
+      }
+    },
+    {
+      "id": "AC-35104-2",
+      "description": "Given the pack fixture running on 127.0.0.1 with a real /api/submit route, when a live POST reaches /api/submit without a cf-turnstile-response field, the Turnstile guard rejects the submit with HTTP 400 whose body carries `{\"errorCode\":\"turnstile.token-missing\"}` and no downstream handler side-effect is observable.",
+      "given": "the pack fixture running with /api/submit registered under the token-required guard",
+      "when": "a live POST reaches /api/submit without a cf-turnstile-response form field",
+      "then": "the guard rejects with HTTP 400 and body {\"errorCode\":\"turnstile.token-missing\"} and no downstream handler side-effect is observable",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3602-edge-cloudflare-turnstile-server-verifier",
+        "field": "interfaces.verifier.guard"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/turnstile/get-started/client-side-rendering/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-3602-edge-cloudflare-turnstile-server-verifier"
   ],
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-09T13:00:00.000Z"
 }

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35105.json

@@ -16,21 +16,31 @@
       "when": "the composition wire is walked in the source tree",
       "then": "the magic-link mint surface reads the Turnstile guard before invoking the mint",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-35105-2",
-      "description": "A live POST to /api/magic-link without a Cf-Turnstile-Response field, and a POST carrying the always-fail response token that fails siteverify, are both refused with 400 by the Turnstile guard and no magic-link mint side-effect is observable. The Playwright pack check magicLinkGuard drives this against the fixture with a real browser.",
+      "description": "A live POST to /api/magic-link without a cf-turnstile-response field, and a POST carrying the always-fail response token that fails siteverify, are both refused with 400 by the Turnstile guard and no magic-link mint side-effect is observable. The Playwright pack check magicLinkGuard drives this against the fixture with a real browser.",
       "given": "the pack fixture running with both blueprints applied and a real Playwright browser driving the fixture",
       "when": "a magic-link mint submit is issued without a Turnstile response, or with the always-fail response token",
       "then": "the Turnstile guard refuses with 400 and no magic-link mint side-effect is observable",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3603-edge-cloudflare-turnstile-magic-link-hook",
+        "field": "responsibilities.guardMint"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/turnstile/get-started/server-side-validation/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-3603-edge-cloudflare-turnstile-magic-link-hook"
   ],
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-09T12:00:00.000Z"
 }

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35106.json

@@ -11,17 +11,23 @@
   "acceptanceCriteria": [
     {
       "id": "AC-35106-1",
-      "description": "The blueprint elicit widget-mode is enum with values managed, non-interactive, invisible; recommendedDefault managed per ADR-3602. The pack fixture accepts ?mode=<managed|non-interactive|invisible> and mounts the widget with the pinned invisible-widget test sitekeys (1x00000000000000000000BB, 2x00000000000000000000BB per https://developers.cloudflare.com/turnstile/troubleshooting/testing/). Each mode renders the Turnstile iframe from https://challenges.cloudflare.com and no other origin.",
+      "description": "The blueprint elicit widget-mode is enum with values managed, non-interactive, invisible; recommendedDefault managed per ADR-3602. The pack fixture accepts ?mode=<managed|non-interactive|invisible> and mounts the widget with the pinned invisible-widget test sitekeys (1x00000000000000000000BB, 2x00000000000000000000BB per https://developers.cloudflare.com/turnstile/troubleshooting/testing/). Each mode renders the Turnstile iframe from https://challenges.cloudflare.com and no other origin. Per section 7a, this AC is legal as the single AC on the story because the guide and the anchored TAC name no additional documented failure path for this mechanism (adjacent failure paths are owned by sibling stories on the same blueprint, not by this one).",
       "given": "the pack fixture loaded with mode=managed, mode=non-interactive and mode=invisible respectively",
       "when": "each variant renders",
       "then": "each renders the Turnstile widget from Cloudflare Turnstile origin only and no third-party script is loaded",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/turnstile/troubleshooting/testing/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-3601-edge-cloudflare-turnstile-widget-mount"
   ],
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "description": "Story owns the widget-mode enum shape and its three-value coverage against the pinned Cloudflare test sitekeys. Per section 7a, this story carries a single AC because the enum-coverage mechanism has no additional documented failure path in the guide (a missing sitekey surfaces via US-35102 AC-35102-2, not via widget-mode)."
 }

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35107.json

@@ -11,17 +11,19 @@
   "acceptanceCriteria": [
     {
       "id": "AC-35107-1",
-      "description": "A source-tree AST scan of the pack fixture (packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile) asserts that TURNSTILE_SECRET is read only via env-shaped identifiers (process.env.TURNSTILE_SECRET or an env facade) and that no plain-string secret literal appears in the fixture source; the Node probe secret-shape-scan implements the assertion and exits 0.",
+      "description": "A source-tree AST scan of the pack fixture (packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile) asserts that TURNSTILE_SECRET is read only via env-shaped identifiers (process.env.TURNSTILE_SECRET or an env facade) and that no plain-string secret literal appears in the fixture source; the Node probe secret-shape-scan implements the assertion and exits 0. Per section 7a, this AC is legal as the single AC on the story because the guide and the anchored TAC name no additional documented failure path for this mechanism (adjacent failure paths are owned by sibling stories on the same blueprint, not by this one).",
       "given": "the shipped pack fixture with the pinned test secrets sourced from environment",
       "when": "the source-tree AST scan runs over the fixture",
       "then": "the scan finds only env-shaped reads for TURNSTILE_SECRET and reports no plain-string secret literal",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-3602-edge-cloudflare-turnstile-server-verifier"
   ],
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "description": "Story owns the secret-shape-scan probe (env-shaped reads only, no plain-string secret literal in the pack fixture source). Per section 7a, this story carries a single AC because the source-scan mechanism has no additional documented failure path in the guide or the anchored TAC."
 }

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35108.json

@@ -11,17 +11,19 @@
   "acceptanceCriteria": [
     {
       "id": "AC-35108-1",
-      "description": "The Node probe event-secrecy drives siteverify against Cloudflare with the pinned test keys and asserts every event record carries {sitekeyHash, outcome, timestamp} keys only; no record carries the token, no record carries the secret, and no forbidden substring is present in the serialised record.",
+      "description": "The Node probe event-secrecy drives siteverify against Cloudflare with the pinned test keys and asserts every event record carries {sitekeyHash, outcome, timestamp} keys only; no record carries the token, no record carries the secret, and no forbidden substring is present in the serialised record. Per section 7a, this AC is legal as the single AC on the story because the guide and the anchored TAC name no additional documented failure path for this mechanism (adjacent failure paths are owned by sibling stories on the same blueprint, not by this one).",
       "given": "the pack fixture running with the event-secrecy probe attached and the pinned test keys in the environment",
       "when": "the probe drives one pass and one fail through the verifier",
       "then": "every emitted event carries only sitekeyHash, outcome and timestamp",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-3602-edge-cloudflare-turnstile-server-verifier"
   ],
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "description": "Story owns the event-secrecy probe against Cloudflare siteverify with the pinned test keys (record carries {sitekeyHash, outcome, timestamp} only; no token or secret substring). Verifier-error record shapes are covered by US-35103; per section 7a, this story carries a single AC because the event-shape mechanism has no additional documented failure path in the guide or the anchored TAC."
 }

package/blueprints/edge-cloudflare-turnstile/docs/topics.md

@@ -59,7 +59,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 35101-35108 sit at the LOW end of the 35101-35899 band on purpose (watchpost run-4 lesson). ADR/TAC suffixes for this blueprint use the 3601-3699 block, continuing the shelf pattern.
+US 35101-35108 sit at the LOW end of the 35101-35899 band on purpose. ADR/TAC suffixes for this blueprint use the 3601-3699 block, continuing the shelf pattern.
 
 ## Shared expectations for future composing blueprints
 

package/blueprints/edge-cloudflare-turnstile/probe-packs/edge-cloudflare-turnstile.pack.mjs

@@ -27,7 +27,7 @@ export default {
     {
       id: 'AC-turnstile-widgetRendered',
       severity: 'block',
-      description: 'Turnstile client widget mounts with the pinned always-pass sitekey; the mount injects Cloudflare Turnstile JS from the Cloudflare Turnstile origin only, populates the Cf-Turnstile-Response token input, and no third-party script from any other origin is loaded on the page.',
+      description: 'Turnstile client widget mounts with the pinned always-pass sitekey; the mount injects Cloudflare Turnstile JS from the Cloudflare Turnstile origin only, populates the cf-turnstile-response token input, and no third-party script from any other origin is loaded on the page.',
       run: async ({ browser, runtimeUrl }) => {
         if (!browser) return { verdict: 'fail', detail: 'no packBrowser wired' };
         await browser.goto(withUrl(runtimeUrl, '/?sitekey=pass'));
@@ -114,9 +114,23 @@ export default {
     {
       id: 'AC-turnstile-magicLinkGuard',
       severity: 'block',
-      description: 'Magic-link mint route composed with the Turnstile guard refuses a mint submit without a Turnstile response with 400 and refusal errorCode=turnstile.token-missing; no magic-link mint side-effect.',
+      description: 'Magic-link mint route composed with the Turnstile guard refuses a mint submit without a Turnstile response with 400 and refusal errorCode=turnstile.token-missing; the fixture event sink at /api/events records a mint-outcome count of zero after both refusals so the positive evidence proves no magic-link mint side-effect landed.',
       run: async ({ browser, runtimeUrl }) => {
-        // Two probes: (a) missing token refuse (400), (b) fail-secret refuse (400).
+        // Positive-evidence: capture a pre-mint outcome count from the fixture event
+        // sink, then two probes: (a) missing token refuse (400), (b) fail-secret refuse
+        // (400). The pass branch requires both refusals observed AND the mint-outcome
+        // delta (pre vs post) to be exactly zero on /api/events; the observed delta is
+        // included in the positive-evidence detail.
+        async function mintOutcomeCount() {
+          const eventsResp = await fetch(withUrl(runtimeUrl, '/api/events'));
+          if (!eventsResp.ok) return null;
+          try {
+            const list = await eventsResp.json();
+            if (!Array.isArray(list)) return null;
+            return list.filter((e) => e && e.outcome === 'minted').length;
+          } catch { return null; }
+        }
+        const mintedPre = await mintOutcomeCount();
         const missingBody = new URLSearchParams();
         missingBody.set('email', 'reviewer@example.com');
         missingBody.set('turnstile-sitekey', '1x00000000000000000000AA');
@@ -138,8 +152,16 @@ export default {
         let failJson = null; try { failJson = JSON.parse(failText); } catch {}
         const failOk = failResp.status === 400 && failJson && failJson.errorCode === 'turnstile.siteverify-failed';
 
-        if (missingOk && failOk) return { verdict: 'pass', detail: `magic-link guard: missing-token refused 400 turnstile.token-missing; fail-secret refused 400 turnstile.siteverify-failed errorCodes=${JSON.stringify(failJson.errorCodes)}` };
-        return { verdict: 'fail', detail: `magic-link guard unexpected: missing status=${missingResp.status} body=${missingText}; fail status=${failResp.status} body=${failText}` };
+        const mintedPost = await mintOutcomeCount();
+        const delta = (mintedPre == null || mintedPost == null) ? null : mintedPost - mintedPre;
+        const deltaZero = delta === 0;
+        if (missingOk && failOk && deltaZero) {
+          return { verdict: 'pass', detail: `magic-link guard: missing-token refused 400 turnstile.token-missing; fail-secret refused 400 turnstile.siteverify-failed errorCodes=${JSON.stringify(failJson.errorCodes)}; mint-outcome delta on /api/events pre=${mintedPre} post=${mintedPost} delta=0 (no mint side-effect landed)` };
+        }
+        if (missingOk && failOk && !deltaZero) {
+          return { verdict: 'fail', detail: `magic-link guard: both refusals observed but mint-outcome delta is not zero on /api/events (pre=${mintedPre} post=${mintedPost} delta=${delta}); a mint side-effect landed while the guard should have refused, or the fixture sink could not be read` };
+        }
+        return { verdict: 'fail', detail: `magic-link guard unexpected: missing status=${missingResp.status} body=${missingText}; fail status=${failResp.status} body=${failText}; mint-outcome pre=${mintedPre} post=${mintedPost} delta=${delta}` };
       },
     },
   ],

package/blueprints/email-smtp-resend/CHANGELOG.md

@@ -0,0 +1,40 @@
+# Changelog
+
+## 1.1.7 - 2026-09-11
+
+unverified-sender-refusal AC-4102-1 and AC-4102-2 rows are de-claimed to conformanceOnly. The refusal is driven by the local catch-all SMTP fixture (fixture-as-engine) and carries no Resend-returned message id, so the identifier half of the strict-evidence contract is not satisfied here. The live real-account-resend-send row (AC-4101-2) is unchanged.
+
+## 1.1.6 - 2026-09-11
+
+unverified-sender-refusal AC-4102-1 verdict now requires the complete refusal outcome shape owned on TAC-401.interfaces.send: providerStatus a valid positive integer AND providerMessageId===null AND thrownMessage===null, alongside the RESEND_SENDER_UNVERIFIED class prefix.
+
+# email-smtp-resend CHANGELOG
+
+## 1.1.5 - 2026-09-11
+
+Adds a contributions/probes/ pack (smtp-round-trip, unverified-sender-refusal, real-account-resend-send) with a fixture-side send adapter (realises TAC-401.interfaces.send), a catch-all SMTP provider seam and a Resend REST provider seam under packages/rcf-lite/test/fixtures/probe-pack-email-smtp-resend/. Probes run against the fixture on Node 24 and against real Resend on the account-bound branch (CI_HAS_RESEND_ACCOUNT gate + RESEND_API_KEY, one variable per skip row).
+
+Anchoring: unverified-sender-refusal anchors AC-4102-1 (adapter classifies the fixture's 550 5.7.1 refusal to a RESEND_SENDER_UNVERIFIED-prefixed error string) and AC-4102-2 (recipient, subject, body do not appear on the returned error string, on any emitted log line, or on any thrown exception; server accepted zero messages on the unverified path). real-account-resend-send anchors AC-4101-2; the row verdict requires ok=true, error=null, a non-empty providerMessageId AND providerStatus to be an integer in the accepted 200-299 range. smtp-round-trip de-claims (conformanceOnly, anchorAcId=null) with the limitation naming AC-4101-3: the row observes a local catch-all SMTP dispatch via a helper, not a call through the adapter and not the Resend endpoint. probe-utils normalisation and thrown-error rows carry an evidence object; the fallback anchorAcId is null.
+
+## 1.1.3 - 2026-09-10
+
+Removed the send-signature and outcome-field restatements from `AC-4101-2` (description and then-clause), `AC-4102-1` (description and then-clause), and the guide's "What a good outcome looks like" bullets; each surface now references the outcome record owned on `TAC-401-email-smtp-resend-send-adapter.interfaces.send` and, where relevant, the classification owned on `responsibilities[3]`. The AC-4101-2 and AC-4102-1 when-clauses now reference the send interface owned on `TAC-401-email-smtp-resend-send-adapter.interfaces.send` instead of restating the `adapter.send(...)` signature. US-4101 and US-4102 patch-bumped.
+
+## 1.1.2 - 2026-09-10
+
+Dimension-d single-definition-ownership cleanup on REQ-001: REQ description now references the send-adapter interface signature and outcome shape owned on TAC-401.interfaces.send rather than restating the send arguments and outcome fields. Chain-consistency lint zero on pass 1 and pass 2.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 (2026-09-09)
+
+- Adds `elicits[]` with six apply-time answers: `smtp-host-ref`, `smtp-username-ref`, `smtp-password-ref`, `verified-sender-ref` (string placeholder references the send adapter resolves at boot per REQ-002), `webhook-signing-secret-ref` (string placeholder reference the WEBHOOK VERIFIER resolves per REQ-005 - owned by TAC-402, not TAC-401), `replay-tolerance-ms` (string milliseconds, default 300000; REQ-006).
+- Adds `deliveredBy` to every REQ (REQ-001/003/004 -> TAC-401 interfaces; REQ-002 -> TAC-401.interfaces.secretResolver; REQ-005 -> TAC-402.interfaces.verify; REQ-006 -> TAC-402.interfaces.eventIdStore).
+- Webhook secret ownership: AC-4106-2 rewritten to name only the three SMTP references plus the verified-sender-address (owned by TAC-401.responsibilities[8]); AC-4106-3 added asserting the webhook signing secret is resolved by TAC-402 and does not appear in the send adapter's source.
+- The transport class retry not asserted gap is fixed: adds AC-4103-4 (transient transport failure ECONNRESET succeeds on retry with the returned envelope id) and AC-4103-5 (exhausted retry -> RESEND_TRANSPORT_ERROR naming the class and attempt count).
+- The backoff delay range not asserted gap is fixed: adds AC-4103-6 with a deterministic jitter source and clock, asserting scheduled delay under exponential full-jitter caps within [0, 250] for the first retry at the ADR-402 baseline; no delay negative, no delay above the 8000ms cap.
+- The TTL expiry not asserted gap is fixed: adds AC-4105-3 asserting the eventIdStore `putIfAbsentWithExpiry` receives expiryMs equal to the configured replay tolerance window; a re-post inside the window is refused as duplicate, a re-post after the window expires is accepted.
+- Re-sweeps every existing AC's `disposition` per section 7b: ACs referencing placeholder references and the tolerance window flipped to `template` with `templateFillIns`; the remaining ACs stay `fixed`.
+- adds `secretResolver` interface entry to TAC-402 (mirrors the TAC-401 shape) naming the boot-time secret-reference resolver the webhook verifier consumes; corrects TAC-402.responsibilities[5] cross-reference from AC-4106-2 to AC-4106-3 (the earlier split of webhook-secret ownership off from the SMTP-secrets AC left the responsibility trailer citing the older AC); updates AC-4106-3.ownerRef from `TAC-402.interfaces.verify` to `TAC-402.interfaces.secretResolver` so the ownership pointer names the actual secret-resolution interface.

package/blueprints/email-smtp-resend/README.md

@@ -1,4 +1,4 @@
-# Email SMTP Resend blueprint (v1.0.0)
+# Email SMTP Resend blueprint (v1.1.0)
 
 The ninth content blueprint on the rcf-build-lite blueprint mechanism. Scope: a Resend-backed mail-adapter that fills the magic-link blueprint's `TAC-504-security-auth-magic-link-email-delivery-adapter` slot as a shipped default. Transport is Resend's SMTP submission endpoint (keeps the adapter close to a generic SMTP shape a follow-up `email-smtp-<othervendor>` blueprint can sibling cleanly). Vendor default is Resend; the mail-adapter contract itself lives on the magic-link blueprint and remains vendor-neutral. Ships two TACs (send adapter, delivery-webhook verifier), no scope:global ADRs.
 
@@ -26,9 +26,9 @@ The doc set is contributions (copied into the project tree by `rcf define bluepr
 
 ## What it contributes, and what it deliberately does not
 
-Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision 5) and no code.
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (shipped policy 5) and no code.
 
-No FBS contributions, as a matter of principle (ratified policy 2026-08-19): FBSes are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the send-contract shape, the SMTP transport choice, the four-class error taxonomy, the retry-and-backoff posture, the webhook signature verification, the replay defence, the boundary discipline on the SMTP client library and the secret references); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
+No FBS contributions, as a matter of principle (policy): FBSes are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the send-contract shape, the SMTP transport choice, the four-class error taxonomy, the retry-and-backoff posture, the webhook signature verification, the replay defence, the boundary discipline on the SMTP client library and the secret references); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
 
 Deliberately not contributed: the magic-link blueprint's auth routes themselves (they live on the magic-link blueprint; this blueprint is an ADAPTER only); the mail-adapter interface as a global topic (the interface belongs to the magic-link blueprint's `TAC-504`, not to this blueprint); an SMTP client library or an HTTP client library (project picks from what it already carries; the adapter injects the client at boot); a specific YAML or JSON schema library; a Secrets Manager client (composable with the shipped `security-secrets-management` blueprint or with a project-authored secret-reference resolver of the same shape); a shared event bus for delivery events (the verifier hands parsed events to a downstream handler the project realises; where those events go beyond the handler is a project concern); regulatory or compliance workflow (double-opt-in surfaces, unsubscribe UI, retention of consent records live outside this blueprint's scope); the Resend HTTP API path (project supersedes ADR-401 and swaps the adapter's internal client if the API path is preferred, without changing the interface the auth routes call).
 
@@ -38,7 +38,7 @@ This blueprint contributes no `scope: "global"` ADR topics on purpose. The mail-
 
 ## Quality bar
 
-One `send({ to, subject, textBody, htmlBody })` method as the sole auth-facing surface; the fixed outcome shape `{ ok, providerStatus, providerMessageId, error }` on every call; exactly one SMTP submission per adapter call on the successful path; four-class error taxonomy (`RESEND_RATE_LIMITED`, `RESEND_SENDER_UNVERIFIED`, `RESEND_RECIPIENT_REJECTED`, `RESEND_TRANSPORT_ERROR`) surfaced on the `error` field with no recipient identity leaked; bounded jittered retry on transient classes and immediate return on terminal classes; webhook signature verification against the configured signing secret with constant-time comparison; HTTP 401 empty-body refusal on mismatch with a `webhookVerificationFailed` audit; stale-timestamp refusal against the configured tolerance window with a `webhookReplayStale` audit; duplicate-event-id refusal against a bounded event-id store with a `webhookReplayDuplicate` audit and HTTP 200 acknowledgement; the SMTP client library imported from exactly one module (the adapter); no literal SMTP credential, sender address, or signing secret in adapter source. Every bar is carried by ACs in the doc set, not by this README.
+One send method owned on TAC-401-email-smtp-resend-send-adapter.interfaces.send as the sole auth-facing surface; that interface's outcome fields on every call; exactly one SMTP submission per adapter call on the successful path; four-class error taxonomy (`RESEND_RATE_LIMITED`, `RESEND_SENDER_UNVERIFIED`, `RESEND_RECIPIENT_REJECTED`, `RESEND_TRANSPORT_ERROR`) surfaced on the `error` field with no recipient identity leaked; bounded jittered retry on transient classes and immediate return on terminal classes; webhook signature verification against the configured signing secret with constant-time comparison; HTTP 401 empty-body refusal on mismatch with a `webhookVerificationFailed` audit; stale-timestamp refusal against the configured tolerance window with a `webhookReplayStale` audit; duplicate-event-id refusal against a bounded event-id store with a `webhookReplayDuplicate` audit and HTTP 200 acknowledgement; the SMTP client library imported from exactly one module (the adapter); no literal SMTP credential, sender address, or signing secret in adapter source. Every bar is carried by ACs in the doc set, not by this README.
 
 ## Known mechanism-reach gaps
 

package/blueprints/email-smtp-resend/assets/stub-adapter.md

@@ -4,6 +4,8 @@ TAC-401 names a stub-adapter implementation the project wires into its test harn
 
 ## Interface satisfied
 
+Owner: `TAC-401-email-smtp-resend-send-adapter.interfaces.send` names the shape below; this sample demonstrates the call surface.
+
 ```
 send({ to, subject, textBody, htmlBody })
   -> Promise<{ ok, providerStatus, providerMessageId, error }>