rcf-lite 0.28.2 → 0.29.0

package/rcf/requirements/req-051.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T10:18:25.373Z",
-  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "reqId": "REQ-051",
   "prdId": "PRD-001",
   "title": "T-1 typed put get delete list verbs with metadata field pattern realise the Workers KV binding shape behind the facade",
@@ -14,5 +14,8 @@
     "shapes": [],
     "reason": "content-pending",
     "classifiedAt": "2026-09-07T10:18:25.402Z"
-  }
+  },
+  "tags": [
+    "capability:platform-integrations"
+  ]
 }

package/rcf/requirements/req-052.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T10:18:25.579Z",
-  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "reqId": "REQ-052",
   "prdId": "PRD-001",
   "title": "T-1 cache-aside helper reads local first falls back to origin and writes back with elicited TTL floor 1 second",
@@ -14,5 +14,8 @@
     "shapes": [],
     "reason": "content-pending",
     "classifiedAt": "2026-09-07T10:18:25.608Z"
-  }
+  },
+  "tags": [
+    "capability:platform-integrations"
+  ]
 }

package/rcf/requirements/req-053.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T10:18:25.784Z",
-  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "reqId": "REQ-053",
   "prdId": "PRD-001",
   "title": "T-1 lifecycle events facadeReady kvHit kvMiss kvWrite carry metadata-only fields key size ttl timestamp",
@@ -14,5 +14,8 @@
     "shapes": [],
     "reason": "content-pending",
     "classifiedAt": "2026-09-07T10:18:25.813Z"
-  }
+  },
+  "tags": [
+    "capability:platform-integrations"
+  ]
 }

package/rcf/requirements/req-054.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T10:18:25.999Z",
-  "updatedAt": "2026-09-07T10:20:10.276Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "reqId": "REQ-054",
   "prdId": "PRD-001",
   "title": "T-1 eventual-consistency note in the guide: a write may not appear on a global read within the same request and the elicited TTL sets the staleness ceiling",
@@ -14,5 +14,8 @@
     "shapes": [],
     "reason": "content-pending",
     "classifiedAt": "2026-09-07T10:18:26.039Z"
-  }
+  },
+  "tags": [
+    "capability:platform-integrations"
+  ]
 }

package/rcf/requirements/req-060.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T12:26:47.779Z",
-  "updatedAt": "2026-09-07T12:26:47.813Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "T-2 platform-cloudflare-cron-triggers v1.0.0: one scheduled() handler in the applied project source tree is the SOLE reader of the Cloudflare Workers Cron Trigger event (the event handler shape documented at https://developers.cloudflare.com/workers/configuration/cron-triggers/). The handler binds on boot, wires the dispatcher (REQ-061) and the event sink (per TAC-3303), and emits a cronReady lifecycle event on the injected sink with a metadata-only payload. Chain: HQ round-6 T-2 reserved-block per HQ chain-block ruling 2026-09-07T12:25Z.",
   "category": "functional",
   "domain": "platform",
@@ -16,5 +16,8 @@
     ],
     "reason": "keyword-scan",
     "classifiedAt": "2026-09-07T12:26:47.812Z"
-  }
+  },
+  "tags": [
+    "capability:platform-integrations"
+  ]
 }

package/rcf/requirements/req-061.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T12:26:47.991Z",
-  "updatedAt": "2026-09-07T12:28:41.280Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "T-2 platform-cloudflare-cron-triggers v1.0.0: the dispatcher module accepts an ordered map of cron-expression to handler pairs and, on every scheduled() invocation, matches the incoming Cron Trigger event's cron expression against the map and routes exactly to the matched handler. An unmatched expression records an unmatchedExpression event on the sink and the scheduled invocation returns without side effect. The routed handler receives a bounded context {expression, scheduledTime, sink} so its own emissions can be attributed. Chain: HQ round-6 T-2 reserved-block per HQ chain-block ruling 2026-09-07T12:25Z.",
   "category": "functional",
   "domain": "platform",
@@ -14,5 +14,8 @@
     "shapes": [],
     "reason": "content-pending",
     "classifiedAt": "2026-09-07T12:29:00.000Z"
-  }
+  },
+  "tags": [
+    "capability:platform-integrations"
+  ]
 }

package/rcf/requirements/req-062.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T12:26:48.199Z",
-  "updatedAt": "2026-09-07T12:26:48.232Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "T-2 platform-cloudflare-cron-triggers v1.0.0: an elicited skew-tolerance window (default 30 seconds per ADR-3303; floor 5s, ceiling 5 minutes) governs how the dispatcher classifies a fire. If the observed handler start time is within the window of the event's scheduledTime, the fire's outcome is onTime and a cronFired event carries {expression, scheduledTime, outcome: onTime, duration}. If the observed start is outside the window, a cronSkewed event fires with the delta (observed minus scheduled, in milliseconds) and the outcome is skewed; the handler still runs. Chain: HQ round-6 T-2 reserved-block per HQ chain-block ruling 2026-09-07T12:25Z.",
   "category": "functional",
   "domain": "platform",
@@ -16,5 +16,8 @@
     ],
     "reason": "keyword-scan",
     "classifiedAt": "2026-09-07T12:26:48.230Z"
-  }
+  },
+  "tags": [
+    "capability:platform-integrations"
+  ]
 }

package/rcf/requirements/req-063.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T12:26:48.409Z",
-  "updatedAt": "2026-09-07T12:26:48.442Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "T-2 platform-cloudflare-cron-triggers v1.0.0: an elicited soft-budget duration (default 30 seconds per elicited answer, no floor) governs when a running handler is flagged as stalled. The dispatcher never terminates a handler on soft-budget breach (Cloudflare's platform concern is the sole terminator); it fires a cronStalled event with metadata-only payload {expression, scheduledTime, outcome: stalled, duration, softBudgetMs} at the moment the observed duration crosses the budget and lets the handler continue. Every scheduled-side event record on the sink carries only {expression, scheduledTime, outcome, duration} plus the event tag; handler input closures, PII fields and body bytes never cross the sink boundary. Chain: HQ round-6 T-2 reserved-block per HQ chain-block ruling 2026-09-07T12:25Z.",
   "category": "functional",
   "domain": "platform",
@@ -16,5 +16,8 @@
     ],
     "reason": "keyword-scan",
     "classifiedAt": "2026-09-07T12:26:48.441Z"
-  }
+  },
+  "tags": [
+    "capability:platform-integrations"
+  ]
 }

package/rcf/requirements/req-070.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T14:11:36.742Z",
-  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "reqId": "REQ-070",
   "prdId": "PRD-001",
   "title": "T-3 platform-cloudflare-durable-objects v1.0.0 blueprint: the DO facade is the sole reader of env.CELL and env.HUB and opens on boot with namespaceReady",
@@ -14,5 +14,8 @@
     "shapes": [],
     "reason": "content-pending",
     "classifiedAt": "2026-09-07T14:11:36.775Z"
-  }
+  },
+  "tags": [
+    "capability:platform-integrations"
+  ]
 }

package/rcf/requirements/req-071.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T14:11:36.953Z",
-  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "reqId": "REQ-071",
   "prdId": "PRD-001",
   "title": "T-3 single-cell shape exposes typed domain verbs and serialises concurrent invocations per instance",
@@ -14,5 +14,8 @@
     "shapes": [],
     "reason": "content-pending",
     "classifiedAt": "2026-09-07T14:11:36.986Z"
-  }
+  },
+  "tags": [
+    "capability:platform-integrations"
+  ]
 }

package/rcf/requirements/req-072.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T14:11:37.164Z",
-  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "reqId": "REQ-072",
   "prdId": "PRD-001",
   "title": "T-3 storage API provides typed put/get/delete on the object with an elicited backend (SQL or KV)",
@@ -14,5 +14,8 @@
     "shapes": [],
     "reason": "content-pending",
     "classifiedAt": "2026-09-07T14:11:37.197Z"
-  }
+  },
+  "tags": [
+    "capability:platform-integrations"
+  ]
 }

package/rcf/requirements/req-073.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T14:11:37.377Z",
-  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "reqId": "REQ-073",
   "prdId": "PRD-001",
   "title": "T-3 alarm surface fires alarm() exactly once per scheduled time and doAlarmFired carries objectName and scheduledTime",
@@ -14,5 +14,8 @@
     "shapes": [],
     "reason": "content-pending",
     "classifiedAt": "2026-09-07T14:11:37.412Z"
-  }
+  },
+  "tags": [
+    "capability:platform-integrations"
+  ]
 }

package/rcf/requirements/req-074.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T14:11:37.592Z",
-  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "reqId": "REQ-074",
   "prdId": "PRD-001",
   "title": "T-3 hibernatable WebSocket hub accepts clients via state.acceptWebSocket and the wake handler runs from cold reading the same storage",
@@ -14,5 +14,8 @@
     "shapes": [],
     "reason": "content-pending",
     "classifiedAt": "2026-09-07T14:11:37.625Z"
-  }
+  },
+  "tags": [
+    "capability:platform-integrations"
+  ]
 }

package/rcf/requirements/req-075.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T14:11:37.805Z",
-  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "reqId": "REQ-075",
   "prdId": "PRD-001",
   "title": "T-3 lifecycle events fire at namespace and object level with metadata-only payloads",
@@ -14,5 +14,8 @@
     "shapes": [],
     "reason": "content-pending",
     "classifiedAt": "2026-09-07T14:11:37.838Z"
-  }
+  },
+  "tags": [
+    "capability:platform-integrations"
+  ]
 }

package/rcf/requirements/req-076.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T14:11:38.018Z",
-  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "reqId": "REQ-076",
   "prdId": "PRD-001",
   "title": "T-3 sole-reader guarantee enforced by AST scan: no non-facade module imports env.CELL or env.HUB",
@@ -14,5 +14,8 @@
     "shapes": [],
     "reason": "content-pending",
     "classifiedAt": "2026-09-07T14:11:38.051Z"
-  }
+  },
+  "tags": [
+    "capability:platform-integrations"
+  ]
 }

package/rcf/requirements/req-077.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T14:11:38.243Z",
-  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "reqId": "REQ-077",
   "prdId": "PRD-001",
   "title": "T-3 migration-safe class exports: stable class names committed to wrangler with a paired [[migrations]] block",
@@ -14,5 +14,8 @@
     "shapes": [],
     "reason": "content-pending",
     "classifiedAt": "2026-09-07T14:11:38.275Z"
-  }
+  },
+  "tags": [
+    "capability:platform-integrations"
+  ]
 }

package/rcf/requirements/req-080.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T16:49:01.509Z",
-  "updatedAt": "2026-09-07T17:14:19.059Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "reqId": "REQ-080",
   "prdId": "PRD-001",
   "title": "T-4 edge-cloudflare-access v1.0.0 blueprint: the Access JWT validator is the sole reader of the Cf-Access-Jwt-Assertion header and reduces principal onto request.auth",
@@ -14,5 +14,8 @@
     "shapes": [],
     "reason": "content-pending",
     "classifiedAt": "2026-09-07T16:49:01.543Z"
-  }
+  },
+  "tags": [
+    "capability:edge-security"
+  ]
 }

package/rcf/requirements/req-081.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T16:49:11.871Z",
-  "updatedAt": "2026-09-07T17:14:19.252Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "reqId": "REQ-081",
   "prdId": "PRD-001",
   "title": "T-4 edge-cloudflare-access v1.0.0: an Access application is declared with an elicited hostname or self-hosted-app id and an elicited policy shape from the enum",
@@ -14,5 +14,8 @@
     "shapes": [],
     "reason": "content-pending",
     "classifiedAt": "2026-09-07T16:49:11.906Z"
-  }
+  },
+  "tags": [
+    "capability:edge-security"
+  ]
 }

package/rcf/requirements/req-082.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T16:49:12.089Z",
-  "updatedAt": "2026-09-07T17:14:19.438Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "reqId": "REQ-082",
   "prdId": "PRD-001",
   "title": "T-4 edge-cloudflare-access v1.0.0: the operator issues a Zero Trust policy via the dashboard or the API path documented in the guide",
@@ -14,5 +14,8 @@
     "shapes": [],
     "reason": "content-pending",
     "classifiedAt": "2026-09-07T16:49:12.123Z"
-  }
+  },
+  "tags": [
+    "capability:edge-security"
+  ]
 }

package/rcf/requirements/req-083.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T16:49:12.304Z",
-  "updatedAt": "2026-09-07T17:14:19.647Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "reqId": "REQ-083",
   "prdId": "PRD-001",
   "title": "T-4 edge-cloudflare-access v1.0.0: the audit event carries metadata-only fields email, outcome, timestamp and path with no token value or headers",
@@ -14,5 +14,8 @@
     "shapes": [],
     "reason": "content-pending",
     "classifiedAt": "2026-09-07T16:49:12.339Z"
-  }
+  },
+  "tags": [
+    "capability:edge-security"
+  ]
 }

package/rcf/requirements/req-084.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T16:49:12.520Z",
-  "updatedAt": "2026-09-07T17:14:19.838Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "reqId": "REQ-084",
   "prdId": "PRD-001",
   "title": "T-4 edge-cloudflare-access v1.0.0: break-glass posture with an elicited bypass-service-auth token pair for CI-signed automation",
@@ -14,5 +14,8 @@
     "shapes": [],
     "reason": "content-pending",
     "classifiedAt": "2026-09-07T16:49:12.555Z"
-  }
+  },
+  "tags": [
+    "capability:edge-security"
+  ]
 }

package/rcf/requirements/req-085.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T16:49:12.737Z",
-  "updatedAt": "2026-09-07T17:14:20.026Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "reqId": "REQ-085",
   "prdId": "PRD-001",
   "title": "T-4 edge-cloudflare-access v1.0.0: the composition with application-admin-console flips the sign-in surface when the applied capability set contains zeroTrustGate",
@@ -14,5 +14,8 @@
     "shapes": [],
     "reason": "content-pending",
     "classifiedAt": "2026-09-07T16:49:12.772Z"
-  }
+  },
+  "tags": [
+    "capability:edge-security"
+  ]
 }

package/rcf/requirements/req-086.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T16:49:12.954Z",
-  "updatedAt": "2026-09-07T17:14:20.211Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "reqId": "REQ-086",
   "prdId": "PRD-001",
   "title": "T-4 application-admin-console v1.1.0 minor: consume zeroTrustGate optionally, replacing the local sign-in form with an Access-gated surface when the capability is applied",
@@ -14,5 +14,8 @@
     "shapes": [],
     "reason": "content-pending",
     "classifiedAt": "2026-09-07T16:49:12.990Z"
-  }
+  },
+  "tags": [
+    "capability:edge-security"
+  ]
 }

package/rcf/requirements/req-090.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T19:54:00.724Z",
-  "updatedAt": "2026-09-07T20:18:17.227Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "The applying project reaches Cloudflare Turnstile through a client widget mount that renders on elicited surfaces using the elicited TURNSTILE_SITEKEY. The mount injects only Cloudflare Turnstile JS (challenges.cloudflare.com/turnstile/v0/api.js) and no other third-party script. On submit the widget populates a hidden Cf-Turnstile-Response token field in the form payload. Chain: HQ round-6 T-5 reserved-block per HQ chain-block ruling 2026-09-07 (REQ-090..099 / US-90xx..94xx / TS-120..129 / FBS-110..119 / CN-350..379).",
   "reqId": "REQ-090",
   "prdId": "PRD-001",
@@ -40,5 +40,8 @@
         "match": "form"
       }
     ]
-  }
+  },
+  "tags": [
+    "capability:edge-security"
+  ]
 }

package/rcf/requirements/req-091.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T19:54:00.947Z",
-  "updatedAt": "2026-09-07T20:18:17.412Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "The applying project verifies every Turnstile response token server-side by POSTing {secret: TURNSTILE_SECRET, response: <token>} to https://challenges.cloudflare.com/turnstile/v0/siteverify per Cloudflare Turnstile documented endpoint. On success:true the handler proceeds; on success:false the handler rejects with 400 and the refusal body carries the error-codes[] value, not the sitekey or secret.",
   "reqId": "REQ-091",
   "prdId": "PRD-001",
@@ -49,5 +49,8 @@
         "match": "endpoint"
       }
     ]
-  }
+  },
+  "tags": [
+    "capability:edge-security"
+  ]
 }

package/rcf/requirements/req-092.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T19:54:01.170Z",
-  "updatedAt": "2026-09-07T20:18:17.597Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "The applying project registers a token-required guard at every elicited surface. A submit whose payload lacks the Cf-Turnstile-Response field is rejected with 400 before any downstream handler runs. The refusal body carries a stable error-code, not the sitekey.",
   "reqId": "REQ-092",
   "prdId": "PRD-001",
@@ -28,5 +28,8 @@
         "match": "token"
       }
     ]
-  }
+  },
+  "tags": [
+    "capability:edge-security"
+  ]
 }

package/rcf/requirements/req-093.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T19:54:01.402Z",
-  "updatedAt": "2026-09-07T20:18:17.783Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "When both security-auth-magic-link and edge-cloudflare-turnstile are applied, the magic-link mint surface reads through the Turnstile guard: a mint submit without a valid Turnstile response is refused with 400 before the mint fires. Composition uses the TAC-3603 hook on the shipped magic-link mint surface.",
   "reqId": "REQ-093",
   "prdId": "PRD-001",
@@ -48,5 +48,8 @@
         "match": "magic-link"
       }
     ]
-  }
+  },
+  "tags": [
+    "capability:edge-security"
+  ]
 }

package/rcf/requirements/req-094.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T19:54:01.626Z",
-  "updatedAt": "2026-09-07T20:18:17.970Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "The applying operator elicits one of Cloudflare Turnstile documented widget modes: managed (default; renders challenge only when Cloudflare deems it necessary), non-interactive (always renders a non-interactive challenge) or invisible (mounts an invisible widget). The default mode is managed per the shipped ADR.",
   "reqId": "REQ-094",
   "prdId": "PRD-001",
@@ -28,5 +28,8 @@
         "match": "renders"
       }
     ]
-  }
+  },
+  "tags": [
+    "capability:edge-security"
+  ]
 }

package/rcf/requirements/req-100.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T21:38:51.465Z",
-  "updatedAt": "2026-09-07T23:05:23.440Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "The applying project holds its rate-limit rule set as a set of JSON documents under the elicited rate-limit-rules-dir (default cloudflare/rate-limits/), one file per rule per ADR-3703. Every manifest file declares the seven documented fields the Cloudflare WAF rate-limiting rules contract names per https://developers.cloudflare.com/waf/rate-limiting-rules/: id, expression, threshold, period, characteristics, action, duration. The zone id is elicited and stored via secretsManagement; no rule references a secret in plaintext. Chain: HQ round-6 T-6 reserved-block per HQ chain-block ruling 2026-09-07 (REQ-100..109 / TS-130..139 / FBS-120..129 / CN-380..409). Round-6 T-6 track of Cloudflare-round-6-spec-2026-09-06 section 5.6.",
   "reqId": "REQ-100",
   "prdId": "PRD-001",
@@ -9,5 +9,8 @@
   "domain": "functional",
   "priority": "must",
   "version": "0.1.0",
-  "status": "draft"
+  "status": "draft",
+  "tags": [
+    "capability:edge-security"
+  ]
 }

package/rcf/requirements/req-101.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T21:38:51.792Z",
-  "updatedAt": "2026-09-07T23:05:23.637Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "The blueprint ships no committed script that writes rules to the live Cloudflare zone. The applying project's operator applies each rule via a documented wrangler command flow or a Cloudflare dashboard flow per TAC-3702 and the guide. The elicited rate-limit-management-surface value records the flow the operator chose; the guide covers both. Chain: HQ round-6 T-6 reserved-block per HQ chain-block ruling 2026-09-07.",
   "reqId": "REQ-101",
   "prdId": "PRD-001",
@@ -9,5 +9,8 @@
   "domain": "functional",
   "priority": "must",
   "version": "0.1.0",
-  "status": "draft"
+  "status": "draft",
+  "tags": [
+    "capability:edge-security"
+  ]
 }

package/rcf/requirements/req-102.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T21:38:52.126Z",
-  "updatedAt": "2026-09-07T23:05:23.824Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "Given a rule that permits N requests per period on a characteristic set, when a client sends the (N+1)th request within that period, Cloudflare refuses the request at the edge for the elicited duration. The refusal response is HTTP 429 with a Retry-After header consistent with the elicited duration and a Cf-Ray header identifying the CF edge per https://developers.cloudflare.com/waf/rate-limiting-rules/. The origin Worker never sees the refused requests. Chain: HQ round-6 T-6 reserved-block per HQ chain-block ruling 2026-09-07.",
   "reqId": "REQ-102",
   "prdId": "PRD-001",
@@ -9,5 +9,8 @@
   "domain": "functional",
   "priority": "must",
   "version": "0.1.0",
-  "status": "draft"
+  "status": "draft",
+  "tags": [
+    "capability:edge-security"
+  ]
 }

package/rcf/requirements/req-103.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T21:38:52.452Z",
-  "updatedAt": "2026-09-07T23:05:24.011Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "The blueprint ships a scheduled drift-audit runner (TAC-3703) the applying project can wire behind the elicited rate-limit-drift-audit-cadence per ADR-3704. When enabled, the runner fetches the live rate-limiting rules on the elicited zone via the Cloudflare API, diffs against the local manifest, and constructs one drift-audit record per mismatched rule. Records write through the applied logger with the metadata-only shape {ruleId, clientIpHash, outcome, timestamp, diff}; no record carries a full IP, a request body or a user agent. Chain: HQ round-6 T-6 reserved-block per HQ chain-block ruling 2026-09-07.",
   "reqId": "REQ-103",
   "prdId": "PRD-001",
@@ -9,5 +9,8 @@
   "domain": "functional",
   "priority": "must",
   "version": "0.1.0",
-  "status": "draft"
+  "status": "draft",
+  "tags": [
+    "capability:edge-security"
+  ]
 }

package/rcf/requirements/req-104.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T21:38:52.795Z",
-  "updatedAt": "2026-09-07T23:05:24.201Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "When both edge-cloudflare-rate-limiting and security-auth-magic-link are applied on the same project, the zone-level rate rule sits at the CF edge and refuses the (N+1)th request for the elicited duration before it reaches the origin; the security-auth-magic-link per-email application rate limiter continues to run at the mint-surface. The two rules operate on different characteristic sets (IP-per-URL vs per-email per-minute) and are additive. ADR-3702 records the layering. Chain: HQ round-6 T-6 reserved-block per HQ chain-block ruling 2026-09-07.",
   "reqId": "REQ-104",
   "prdId": "PRD-001",
@@ -9,5 +9,8 @@
   "domain": "functional",
   "priority": "must",
   "version": "0.1.0",
-  "status": "draft"
+  "status": "draft",
+  "tags": [
+    "capability:edge-security"
+  ]
 }

package/rcf/requirements/req-110.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T23:53:24.739Z",
-  "updatedAt": "2026-09-07T23:53:41.232Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "The provisioner module wraps the hcloud CLI verbs (or the raw Hetzner Cloud API when provisioningTool=raw-api) and is the sole reader of the Hetzner API token via security-secrets-management. It opens on the applying project's boot path and emits a provisionerReady lifecycle event with metadata-only fields (tool, apiHost, sha of the shim). Chain: HQ round-7 T-1 reserved-block per HQ chain-block ruling 2026-09-07 (REQ-110..119 / TS-140..149 / FBS-130..139 / CN-410..439). Round-7 T-1 track of hetzner-round-7-spec-2026-09-07 section 5.1.",
   "reqId": "REQ-110",
   "prdId": "PRD-001",
@@ -54,5 +54,8 @@
         "match": "api"
       }
     ]
-  }
+  },
+  "tags": [
+    "capability:deploy"
+  ]
 }