rcf-lite 0.28.2 → 0.29.0

package/rcf/requirements/req-111.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T23:53:24.971Z",
-  "updatedAt": "2026-09-07T23:53:41.419Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "The applying project holds its server declarations as JSON documents under hetzner/servers/<name>.json, one file per server, matching a shipped JSON Schema that names type, location, image, ssh-key ids, firewall id, network id, cloud-init user-data path and labels. Applying the provisioner reads each manifest and creates a matching live server; the hetznerServerProvisioned event carries id, primary IPv4, location and server-type. Chain: HQ round-7 T-1 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-1 track of hetzner-round-7-spec-2026-09-07 section 5.1.",
   "reqId": "REQ-111",
   "prdId": "PRD-001",
@@ -28,5 +28,8 @@
         "match": "Schema"
       }
     ]
-  }
+  },
+  "tags": [
+    "capability:deploy"
+  ]
 }

package/rcf/requirements/req-112.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T23:53:25.205Z",
-  "updatedAt": "2026-09-07T23:53:41.612Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "The cloud-init template shipped with the blueprint renders YAML that lands SSH key-only, root disabled, UFW default-deny incoming, DOCKER-USER iptables chain, fail2ban SSH jail and unattended-upgrades on every provisioned Hetzner server. A local render lint asserts the six baseline blocks are present in the rendered YAML before any provision runs. Chain: HQ round-7 T-1 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-1 track of hetzner-round-7-spec-2026-09-07 section 5.1.",
   "reqId": "REQ-112",
   "prdId": "PRD-001",
@@ -38,5 +38,8 @@
         "match": "rendered"
       }
     ]
-  }
+  },
+  "tags": [
+    "capability:deploy"
+  ]
 }

package/rcf/requirements/req-113.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T23:53:25.436Z",
-  "updatedAt": "2026-09-07T23:53:41.809Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "The firewall rule set lives inside the server manifest and is applied to the server at provision time. Rules: 22 permitted only from an operator-nominated set of source-prefix ranges; 80/443 permitted from anywhere for the reverse proxy; all other inbound traffic denied. Manifest schema validation refuses on a rule set that opens 22 to 0.0.0.0/0 or drops the 80/443 rules. Chain: HQ round-7 T-1 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-1 track of hetzner-round-7-spec-2026-09-07 section 5.1.",
   "reqId": "REQ-113",
   "prdId": "PRD-001",
@@ -29,5 +29,8 @@
         "match": "schema"
       }
     ]
-  }
+  },
+  "tags": [
+    "capability:deploy"
+  ]
 }

package/rcf/requirements/req-114.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T23:53:25.669Z",
-  "updatedAt": "2026-09-07T23:53:41.996Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "The applying project elicits a snapshot cadence per ADR-3802 (default weekly, alternatives daily and off). When non-off, the scheduled snapshot runner fires the hcloud snapshot verb and tags the snapshot with server name and wall-clock time; a snapshot-on-demand verb fires the same shape. The hetznerSnapshotTaken event carries snapshot id and wall-clock time. Chain: HQ round-7 T-1 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-1 track of hetzner-round-7-spec-2026-09-07 section 5.1.",
   "reqId": "REQ-114",
   "prdId": "PRD-001",
@@ -16,5 +16,8 @@
     ],
     "reason": "keyword-scan",
     "classifiedAt": "2026-09-07T23:53:25.710Z"
-  }
+  },
+  "tags": [
+    "capability:deploy"
+  ]
 }

package/rcf/requirements/req-115.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T23:53:25.903Z",
-  "updatedAt": "2026-09-07T23:53:42.183Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "The provisioner facade emits four lifecycle events: provisionerReady, hetznerServerProvisioned, hetznerSnapshotTaken and hetznerServerDestroyed. Payloads are metadata-only: id, primary IPv4, location, server-type, snapshot id, wall-clock time. An event-secrecy probe asserts no event body carries the API token, an ssh private key, or a plaintext secret; a mutation that leaks a token into an event body FAILS the probe with a defensive-fake finding. Chain: HQ round-7 T-1 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-1 track of hetzner-round-7-spec-2026-09-07 section 5.1.",
   "reqId": "REQ-115",
   "prdId": "PRD-001",
@@ -34,5 +34,8 @@
         "match": "token"
       }
     ]
-  }
+  },
+  "tags": [
+    "capability:deploy"
+  ]
 }

package/rcf/requirements/req-120.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-08T01:39:09.362Z",
-  "updatedAt": "2026-09-08T01:39:28.241Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "The applying project runs its containerised services from a single compose.yaml at the repo root. Each service is one container. Networks and volumes are declared with explicit names. Non-secret config lives in a .env file loaded by compose. The compose file is the single source of truth for the runtime topology; the container host reads it to bring the stack up and refuses on unclassified or malformed shape. Chain: HQ round-7 T-2 reserved-block per HQ chain-block ruling 2026-09-07 (REQ-120..129 / TS-150..159 / FBS-140..149 / CN-440..469). Round-7 T-2 track of hetzner-round-7-spec-2026-09-07 section 5.2.",
   "reqId": "REQ-120",
   "prdId": "PRD-001",
@@ -16,5 +16,8 @@
     ],
     "reason": "keyword-scan",
     "classifiedAt": "2026-09-08T01:39:09.405Z"
-  }
+  },
+  "tags": [
+    "capability:deploy"
+  ]
 }

package/rcf/requirements/req-121.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-08T01:40:03.788Z",
-  "updatedAt": "2026-09-08T01:40:04.018Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "Every secret used by any compose service is injected as a file mount under the compose secrets top-level key. The compose file contains no plaintext secret literal on any service argument, environment variable, or command clause (grep-refuse). When security-secrets-management is applied, the secret is sourced through that facade; when it is not, the guide names a documented file-based fallback path. The mounted secret file lands at mode 0o400 inside the container. Chain: HQ round-7 T-2 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-2 track of hetzner-round-7-spec-2026-09-07 section 5.2.",
   "reqId": "REQ-121",
   "prdId": "PRD-001",
@@ -16,5 +16,8 @@
     ],
     "reason": "keyword-scan",
     "classifiedAt": "2026-09-08T01:40:03.831Z"
-  }
+  },
+  "tags": [
+    "capability:deploy"
+  ]
 }

package/rcf/requirements/req-122.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-08T01:40:04.204Z",
-  "updatedAt": "2026-09-08T01:40:04.433Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "Every service that terminates HTTP declares a healthcheck block. The compose file refuses at docker compose config time when any HTTP-terminating service is missing the block. The healthcheck defaults per service kind are elicited (http default, tcp and command alternatives). The stack is not considered up until every declared service reaches healthy inside the elicited timeout. Chain: HQ round-7 T-2 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-2 track of hetzner-round-7-spec-2026-09-07 section 5.2.",
   "reqId": "REQ-122",
   "prdId": "PRD-001",
@@ -16,5 +16,8 @@
     ],
     "reason": "keyword-scan",
     "classifiedAt": "2026-09-08T01:40:04.247Z"
-  }
+  },
+  "tags": [
+    "capability:deploy"
+  ]
 }

package/rcf/requirements/req-123.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-08T01:40:04.619Z",
-  "updatedAt": "2026-09-08T01:40:04.848Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "Every service declares a restart policy. Long-running services declare restart: unless-stopped. Jobs (short-lived services that exit after completion) declare restart: on-failure. Any service that declares neither, or declares an unclassified value outside the two allowed policies, refuses at the compose-config-lint gate before docker compose up runs. Chain: HQ round-7 T-2 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-2 track of hetzner-round-7-spec-2026-09-07 section 5.2.",
   "reqId": "REQ-123",
   "prdId": "PRD-001",
@@ -38,5 +38,8 @@
         "match": "rest"
       }
     ]
-  }
+  },
+  "tags": [
+    "capability:deploy"
+  ]
 }

package/rcf/requirements/req-124.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-08T01:40:05.035Z",
-  "updatedAt": "2026-09-08T01:40:05.264Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "The reverse-proxy config file (caddy/Caddyfile when reverseProxy=caddy; traefik/traefik.yaml when reverseProxy=traefik) is a first-class versioned artefact under the applying repo. The compose runtime bind-mounts the file into the proxy service so an operator change to the file is picked up by the reload verb. The reload verb is docker compose exec caddy caddy reload when Caddy, or the documented Traefik equivalent. The reload window is elicited (10 s default). During the window a client burst against the proxy sees no non-2xx and no dropped connection. Chain: HQ round-7 T-2 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-2 track of hetzner-round-7-spec-2026-09-07 section 5.2.",
   "reqId": "REQ-124",
   "prdId": "PRD-001",
@@ -23,5 +23,8 @@
         "match": "sees"
       }
     ]
-  }
+  },
+  "tags": [
+    "capability:deploy"
+  ]
 }

package/rcf/requirements/req-125.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-08T01:40:05.460Z",
-  "updatedAt": "2026-09-08T01:40:05.690Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "Every container writes stdout and stderr through the elicited log driver. Journald is the shipped default matching the Debian 12 and Ubuntu 24.04 baselines the T-1 cloud-init sets up. Loki is the opt-in alternative when the applying project runs Grafana. The choice is elicited via the log-driver ADR. When observability-logging is applied, the compose file wires the elicited driver to that companion. Chain: HQ round-7 T-2 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-2 track of hetzner-round-7-spec-2026-09-07 section 5.2.",
   "reqId": "REQ-125",
   "prdId": "PRD-001",
@@ -16,5 +16,8 @@
     ],
     "reason": "keyword-scan",
     "classifiedAt": "2026-09-08T01:40:05.504Z"
-  }
+  },
+  "tags": [
+    "capability:deploy"
+  ]
 }

package/rcf/requirements/req-130.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-08T03:20:33.239Z",
-  "updatedAt": "2026-09-08T03:20:33.285Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "The edge-cloudflare-tunnel v1.0.0 blueprint contributes a cloudflared connector whose runtime shape switches on the applied capability set: when the containerHost capability is applied (T-2 platform-docker-compose-host on top of T-1 deploy-hetzner-server), the connector ships as a compose service alongside the applying project's other services on the same web-net network; when the host runs bare (only T-1 applied), the connector ships as a systemd unit per the cloudflared as-a-service local-configuration-file docs. Either shape emits cloudflaredReady on boot with connector id, region and version metadata (metadata only; no token or tunnel credentials in the payload). Chain: HQ round-7 T-3 reserved-block per HQ chain-block ruling 2026-09-07 (REQ-130..139 / TS-160..169 / FBS-150..159 / CN-470..499). Round-7 T-3 track of hetzner-round-7-spec-2026-09-07 section 5.3.",
   "reqId": "REQ-130",
   "prdId": "PRD-001",
@@ -28,5 +28,9 @@
         "match": "credential"
       }
     ]
-  }
+  },
+  "tags": [
+    "capability:edge-security",
+    "capability:platform-integrations"
+  ]
 }

package/rcf/requirements/req-131.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-08T03:20:33.475Z",
-  "updatedAt": "2026-09-08T03:20:33.520Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "The applying project ships one tunnel manifest per named tunnel at cloudflare/tunnels/<name>.yaml. The schema requires: a tunnel id (uuid-shaped string), a credentials-file reference into security-secrets-management (secretRef, never a literal path or JSON body inline), and an ingress rules array mapping public hostname to internal service URL with a mandatory catch-all rule returning http_status 404. The manifest is the single source of truth for what the connector serves; cloudflared refuses to boot if it fails the shipped JSON-schema validation. Chain: HQ round-7 T-3 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-3 track of hetzner-round-7-spec-2026-09-07 section 5.3.",
   "reqId": "REQ-131",
   "prdId": "PRD-001",
@@ -50,5 +50,9 @@
         "match": "schema"
       }
     ]
-  }
+  },
+  "tags": [
+    "capability:edge-security",
+    "capability:platform-integrations"
+  ]
 }

package/rcf/requirements/req-132.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-08T03:20:33.710Z",
-  "updatedAt": "2026-09-08T03:20:33.755Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "The applying project MUST NOT open a public port on the host firewall for the origin path when only edge-cloudflare-tunnel provides ingress. T-1 deploy-hetzner-server's firewall shape allows port 22 unconditionally and ports 80/443 only when a reverse proxy is applied on the host. A project that applies only T-1 plus T-3 (no reverse proxy) declares zero 80/443 firewall rules; the tunnel manifest schema check refuses the apply if an ingress rule tries to bind a port on the host directly (the ingress URL must reference an internal address, never the public interface). Chain: HQ round-7 T-3 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-3 track of hetzner-round-7-spec-2026-09-07 section 5.3.",
   "reqId": "REQ-132",
   "prdId": "PRD-001",
@@ -23,5 +23,9 @@
         "match": "schema"
       }
     ]
-  }
+  },
+  "tags": [
+    "capability:edge-security",
+    "capability:platform-integrations"
+  ]
 }

package/rcf/requirements/req-133.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-08T03:20:33.944Z",
-  "updatedAt": "2026-09-08T03:20:33.990Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "The blueprint reads the applying project's sidecar rcf/blueprints/edge-cloudflare-tunnel.applied.json at apply time and inspects appliedCapabilities. When zeroTrustGate is present (i.e. edge-cloudflare-access v1.0.0 has been applied on the same project), every ingress rule under the tunnel manifest attaches an originRequest.access block naming the Access AUD; cloudflared then refuses at the edge any request that arrives without a valid Access JWT for that AUD. When zeroTrustGate is absent, the block is omitted and the tunnel serves in public-hostname mode (open ingress on the public hostname). The aud-presence-check probe asserts the shape flips correctly on both fixture variants; the shape MUST NOT silently degrade to open ingress on a project that intended the gated shape. Chain: HQ round-7 T-3 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-3 track of hetzner-round-7-spec-2026-09-07 section 5.3.",
   "reqId": "REQ-133",
   "prdId": "PRD-001",
@@ -16,5 +16,9 @@
     ],
     "reason": "keyword-scan",
     "classifiedAt": "2026-09-08T03:20:33.989Z"
-  }
+  },
+  "tags": [
+    "capability:edge-security",
+    "capability:platform-integrations"
+  ]
 }

package/rcf/requirements/req-134.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-08T03:20:34.180Z",
-  "updatedAt": "2026-09-08T03:20:34.226Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "The tunnel credentials file the cloudflared connector reads at boot MUST land on the host at mode 0o400 (owner read only), MUST be referenced from the tunnel manifest as a secretRef (never as a literal path to a committed file), MUST NOT be committed to the applying project's git tree (a grep across the working tree for the credentials-file body's uuid-shaped tunnel id and its account-tag literal refuses if either appears in a tracked file), and MUST NOT appear in any cloudflaredReady, tunnelConnectorUp or ingressRuleReloaded event body. A leaked credentials file gives an attacker lateral movement across every hostname the tunnel serves; the discipline is defensive against silent loss. Chain: HQ round-7 T-3 reserved-block per HQ chain-block ruling 2026-09-07. Round-7 T-3 track of hetzner-round-7-spec-2026-09-07 section 5.3.",
   "reqId": "REQ-134",
   "prdId": "PRD-001",
@@ -38,5 +38,9 @@
         "match": "credential"
       }
     ]
-  }
+  },
+  "tags": [
+    "capability:edge-security",
+    "capability:platform-integrations"
+  ]
 }

package/rcf/requirements/req-140.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-08T09:02:25.166Z",
-  "updatedAt": "2026-09-08T09:02:37.052Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "The object-storage-s3 blueprint gains a Hetzner Object Storage provider value under its shipped v1.0.0 S3-API facade contract. The delta adds an endpoint-shape helper hetzner-endpoint.mjs composing the vendor-documented pattern <bucket>.<location>.your-objectstorage.com from an elicited bucket and location (fsn1 fal, hel1 hel, nbg1 nur per the Hetzner storage overview); a new probe hetzner-object-storage-round-trip.mjs drives put/get/delete against the composed endpoint with accountBound true gated on CI_HAS_HETZNER_OBJECT_STORAGE (records accountBoundSkipped when unset per spec section 3.5); one blueprint-owned REQ (object-storage-s3-REQ-101) and one blueprint-owned US (object-storage-s3-US-28110) anchor the AC AC-28110-1; one blueprint TAC (TAC-2904-object-storage-s3-hetzner-endpoint-helper) formalises the helper contract; one blueprint ADR (ADR-2905-object-storage-s3-hetzner-object-storage-provider, scope local) documents the Hetzner provider value alongside R2, AWS, MinIO with standardsTraceClause Hetzner Object Storage S3 compatibility documented endpoint shape. The existing MinIO local emulator round-trip and R2 real-account smoke stay byte-identical; blueprint bumps 1.0.0 to 1.1.0; rcf-lite package version does NOT bump (spec 8). Chain: HQ round-7 follow-up per HQ chain-block ruling 2026-09-08 (adapter block REQ-140..144, TS-170..174, FBS-160..164, CN-500..509). Section 5.4 of hetzner-round-7-spec-2026-09-07.",
   "reqId": "REQ-140",
   "prdId": "PRD-001",
@@ -145,5 +145,8 @@
         "match": "endpoint"
       }
     ]
-  }
+  },
+  "tags": [
+    "capability:applications-shelf"
+  ]
 }

package/rcf/requirements/req-145.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-08T10:50:11.871Z",
-  "updatedAt": "2026-09-08T10:50:27.769Z",
+  "updatedAt": "2026-09-22T13:47:34.538Z",
   "description": "H-1 patch train against deploy-hetzner-server 1.0.0 shipped in rcf-lite 0.25.0 (real-account gate d-2026-09-08-010 report). Nine defects; every real-account probe throws before writing the scratch id file so destroy cannot tear the server down. This REQ adds the standing requirement that mocked probes for deploy-hetzner-server consume the same rendered cloud-init user-data the real path consumes (renderer writes the file; mock and real path both read it) and that the rendered user-data carries a real ssh public-key line for the deploy user plus NOPASSWD sudo for that user; that provision.mjs projects snake_case hcloud fields; that destroy.mjs and sweep-orphans.mjs never pass --output json to a delete verb (accepts arrays or objects); that snapshot-verb.mjs shells hcloud server create-image --type snapshot; that ssh baseline checks poll ssh readiness before firing and shell NOPASSWD sudo; and that the manifest ssh-key name is overridable via RCF_LITE_CI_SSH_KEY_NAME. Domain functional. Chain: HQ hardening block H-1 per HQ chain-block ruling 2026-09-08 (REQ-145..149 / TS-175..179 / FBS-165..169 / CN-510..519). Blueprint version 1.0.0 to 1.0.1; every existing contribution id byte-identical.",
   "reqId": "REQ-145",
   "prdId": "PRD-001",
@@ -49,5 +49,8 @@
         "match": "delete"
       }
     ]
-  }
+  },
+  "tags": [
+    "capability:deploy"
+  ]
 }

package/rcf/requirements/req-150.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-08T12:16:28.007Z",
-  "updatedAt": "2026-09-08T12:16:28.158Z",
+  "updatedAt": "2026-09-21T17:00:00.000Z",
   "description": "The rcf-lite platform-cloudflare-kv blueprint ships eight approved user stories (US-31101..US-31108) with nine ACs (AC-31101-1, AC-31102-1, AC-31103-1, AC-31103-2, AC-31104-1, AC-31105-1, AC-31106-1, AC-31107-1, AC-31108-1). Its five contributed probes and the README still anchor the defunct AC-5001..AC-5401 id band that never became chain rows on this repo. This train re-anchors every probe result and the README chain-slice pointers to the shipped AC-31xxx band per Dave ruling 4 (2026-09-08 relay 582c2bca): do NOT resurrect the AC-5xxx stories, move the probes to the shipped band. Every one of the nine shipped kv ACs must appear as an anchor (primary or additional result) on at least one probe with a runtime observable; the two ACs no shipped probe currently covers (AC-31102-1 sole-reader grep, AC-31107-1 whitelist-only lifecycle event scan) are added as additional results on facade-round-trip and event-secrecy per the dispatch addendum. Anatomy-test assertions move with the re-anchor per dispatch addendum ruling 1. No capability change; 0.25.x patch scope; runtime surface unchanged.",
   "category": "functional",
   "domain": "functional",
@@ -16,5 +16,9 @@
     ],
     "reason": "keyword-scan",
     "classifiedAt": "2026-09-08T12:16:28.156Z"
-  }
+  },
+  "tags": [
+    "capability:verify",
+    "capability:platform-integrations"
+  ]
 }

package/rcf/requirements/req-151.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-08T12:16:28.590Z",
-  "updatedAt": "2026-09-08T12:16:28.726Z",
+  "updatedAt": "2026-09-21T17:00:00.000Z",
   "description": "The rcf-lite platform-cloudflare-durable-objects blueprint ships thirteen ACs (AC-33101-1..AC-33113-1); eight probes anchor AC-33101, 33102, 33103, 33104, 33105, 33107, 33112, 33113, leaving AC-33106-1, AC-33108-1, AC-33109-1, AC-33110-1, AC-33111-1 unbound. real-account-storage-smoke.mjs currently returns pass on credential readiness alone. This train replaces the credential-readiness pass-stub with a real storage round-trip driver: when CI_HAS_CLOUDFLARE_ACCOUNT is set with CF_ACCOUNT_ID, CF_DO_NAMESPACE_ID (or the binding config the driver needs) and CF_API_TOKEN, the probe drives an HTTP round trip against a deployed Worker route that opens the DO facade, writes a fixture key, reads it back, asserts the returned bytes equal the written value. Local proof against miniflare or wrangler dev via the existing wrangler-seam. Env-absent branch keeps the section 3.5 pass-with-skip shape; a pass must never again be reachable from credential presence alone. The five unbound ACs are bound as additional-result anchors on the existing wrangler-seam, storage-round-trip and concurrent-increment probes (or a new probe body inside existing capability if none carries the observable honestly).",
   "category": "functional",
   "domain": "functional",
@@ -81,5 +81,9 @@
         "match": "storage"
       }
     ]
-  }
+  },
+  "tags": [
+    "capability:verify",
+    "capability:platform-integrations"
+  ]
 }

package/rcf/requirements/req-152.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-08T12:16:29.086Z",
-  "updatedAt": "2026-09-08T12:16:29.220Z",
+  "updatedAt": "2026-09-21T17:00:00.000Z",
   "description": "The rcf-lite messaging-queue-cloudflare blueprint's real-account-concurrency-smoke.mjs returns verdict pass with accountBoundSkipped true on the account-set branch (the wrangler dev --remote path is unsupported for Queues, so a real-account run must ride a deployed Worker that binds the queue). This train replaces that pass-stub with a real concurrency driver: the account-set branch publishes 500 messages through the producer facade wired to a live Queues binding on a deployed Worker (queue name and binding parameterised via env; HQ supplies values at gate time, canonical queue rcf-lite-ci-queue-smoke) and asserts concurrent processing up to the documented push-invocation cap. Local proof against miniflare or wrangler dev (local queue simulation). The env-absent branch keeps pass-with-skip. The documented Cloudflare Queues limits URL is re-verified 200 at merge time and logged in the PR provenance.",
   "category": "functional",
   "domain": "functional",
@@ -16,5 +16,9 @@
     ],
     "reason": "keyword-scan",
     "classifiedAt": "2026-09-08T12:16:29.218Z"
-  }
+  },
+  "tags": [
+    "capability:verify",
+    "capability:platform-integrations"
+  ]
 }

package/rcf/requirements/req-153.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-08T12:16:29.584Z",
-  "updatedAt": "2026-09-08T12:16:29.719Z",
+  "updatedAt": "2026-09-21T17:00:00.000Z",
   "description": "The rcf-lite edge-cloudflare-tunnel blueprint's two real-account probes return warn when the env vars ARE set (account-bound path present but not exercised) and manifest-schema-validate warns on a missing credentials placeholder. This train replaces both warn-on-env stubs with real drivers and converts the placeholder to a fail. real-account-connector-healthy: with both CI_HAS_CLOUDFLARE_ACCOUNT and CI_HAS_HETZNER_ACCOUNT set, provision the throwaway server through the T-1 hetzner fixture surface, run cloudflared tunnel info <name> through a cloudflared control shim, assert healthy connector count, capture the tunnelConnectorUp event. Consume the hetzner fixture as-is; its defects are H-1 scope at HQ; if the fixture path fails locally the driver fails with a pointer naming the fixture step, never warn. real-account-tunnel-hostname-routes: undici fetch driver for the public-hostname sub-case activated on CI_HAS_CLOUDFLARE_ACCOUNT; two-identity JWT driver for the access-gated sub-case activated only when CI_HAS_CLOUDFLARE_ACCESS is ALSO set (HQ note: Access is not enabled on the HQ account, so the AUD sub-case stays pass-with-skip until HQ enables Access). Env-absent branch keeps pass-with-skip; a pass must never again be reachable from account-flag presence alone. manifest-schema-validate.mjs missing-credentials-placeholder becomes FAIL with a fixture-setup pointer.",
   "category": "functional",
   "domain": "functional",
@@ -55,5 +55,9 @@
         "match": "credential"
       }
     ]
-  }
+  },
+  "tags": [
+    "capability:verify",
+    "capability:platform-integrations"
+  ]
 }

package/rcf/requirements/req-154.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-08T12:16:30.083Z",
-  "updatedAt": "2026-09-08T12:16:30.218Z",
+  "updatedAt": "2026-09-21T17:00:00.000Z",
   "description": "The four Cloudflare-platform blueprints (platform-cloudflare-kv, platform-cloudflare-durable-objects, messaging-queue-cloudflare, edge-cloudflare-tunnel) carry mutation-purity, envelope-hygiene and marker-wording defects surfaced by stage-2 semantic and stage-1 mechanical passes: SIMULATE_ env reads in probe bodies (cache-aside-hit-then-miss, event-secrecy, sole-reader-scan, storage-round-trip, websocket-hub-broadcast); a committed fail envelope at .rcf/reports/blueprints/platform-cloudflare-kv/event-secrecy.json; comments labelling local doubles as fake state / fake WebSocket pair / fake clock in ways the stage-1 marker sweep flagged. This train moves every probe-body SIMULATE_ branch into a fixture-side shim under packages/rcf-lite/test/fixtures/cf-platform/ or .../cf-edge/ (new shim files carry the h2-cf-platform-probe-integrity slug prefix, short form h2-cf acceptable), deletes the committed fail envelope and commits a shipped-code pass envelope in its place, regenerates the other kv envelopes so committed envelopes reflect the re-anchored shipped-code runs, and reworks probe comments to name the local test doubles honestly (or records adjudicated-acceptable with reason in the PR body). No capability change; 0.25.x patch scope.",
   "category": "functional",
   "domain": "functional",
@@ -40,5 +40,8 @@
         "match": "delete"
       }
     ]
-  }
+  },
+  "tags": [
+    "capability:verify"
+  ]
 }

package/rcf/requirements/req-155.json

@@ -9,5 +9,8 @@
   "version": "0.1.0",
   "status": "draft",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T13:45:23.000Z"
+  "updatedAt": "2026-09-21T17:00:00.000Z",
+  "tags": [
+    "capability:feedback-loop"
+  ]
 }

package/rcf/requirements/req-156.json

@@ -9,5 +9,8 @@
   "version": "0.1.0",
   "status": "draft",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T13:45:23.000Z"
+  "updatedAt": "2026-09-21T17:00:00.000Z",
+  "tags": [
+    "capability:feedback-loop"
+  ]
 }

package/rcf/requirements/req-157.json

@@ -9,5 +9,8 @@
   "version": "0.1.0",
   "status": "draft",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T13:45:23.000Z"
+  "updatedAt": "2026-09-21T17:00:00.000Z",
+  "tags": [
+    "capability:feedback-loop"
+  ]
 }

package/rcf/requirements/req-158.json

@@ -9,5 +9,8 @@
   "version": "0.1.0",
   "status": "draft",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T13:45:23.000Z"
+  "updatedAt": "2026-09-21T17:00:00.000Z",
+  "tags": [
+    "capability:feedback-loop"
+  ]
 }

package/rcf/requirements/req-159.json

@@ -9,5 +9,8 @@
   "version": "0.1.0",
   "status": "draft",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T13:45:23.000Z"
+  "updatedAt": "2026-09-21T17:00:00.000Z",
+  "tags": [
+    "capability:feedback-loop"
+  ]
 }

package/rcf/requirements/req-160.json

@@ -9,5 +9,8 @@
   "version": "0.1.0",
   "status": "draft",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T13:45:23.000Z"
+  "updatedAt": "2026-09-21T17:00:00.000Z",
+  "tags": [
+    "capability:feedback-loop"
+  ]
 }

package/rcf/requirements/req-161.json

@@ -9,5 +9,8 @@
   "version": "0.1.0",
   "status": "draft",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T13:45:23.000Z"
+  "updatedAt": "2026-09-21T17:00:00.000Z",
+  "tags": [
+    "capability:feedback-loop"
+  ]
 }

package/rcf/requirements/req-162.json

@@ -9,5 +9,8 @@
   "version": "0.1.0",
   "status": "draft",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T13:45:23.000Z"
+  "updatedAt": "2026-09-21T17:00:00.000Z",
+  "tags": [
+    "capability:feedback-loop"
+  ]
 }

package/rcf/requirements/req-163.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-16T22:20:45Z",
-  "updatedAt": "2026-09-16T22:20:45Z",
+  "updatedAt": "2026-09-21T17:00:00.000Z",
   "description": "Referee-guarantees docs page (how-it-works/what-the-referee-guarantees) promises that `rcf define validate` proves every reference in every document resolves, so a walked tree that passes has nothing pointing at nothing. The 0.27.0 walker checks the parent-id fields and the FBS / TS / EVAL / CN cross-links, but two ADR-schema-declared reference fields, supersededBy and relatedAdrs, are declared in the ADR schema without being walked: a bad target passes validate. This train closes the gap by walking both fields inside collectBrokenReferences, keeping the existing brokenReference error kind, and reporting the exact ADR file + field on failure. Chain: referee-guarantees docs claims C-7 and C-38 (audit at reviews/2026-09-15-docs-claims-audit/how-it-works__what-the-referee-guarantees.json). No schema change (the schema already declares both fields); rcf-lite behaviour widens, and any project whose ADRs have stale supersession pointers surfaces the defect the next time validate runs.",
   "category": "functional",
   "domain": "functional",
@@ -9,5 +9,8 @@
   "prdId": "PRD-001",
   "title": "Referee guarantee: `rcf define validate` walks every schema-declared reference field on ADR (supersededBy, relatedAdrs) so the docs-page 'nothing points at nothing' claim holds",
   "version": "0.1.0",
-  "status": "draft"
+  "status": "draft",
+  "tags": [
+    "capability:verify"
+  ]
 }

package/rcf/requirements/req-164.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-16T22:28:54Z",
-  "updatedAt": "2026-09-16T22:28:54Z",
+  "updatedAt": "2026-09-21T17:00:00.000Z",
   "description": "Referee-guarantees docs page states without qualification that a requirement counts as covered only when every acceptance criterion beneath it has a resolving Test Case, and that a stub or stale pointer fails the coverage gate exactly as a missing test does when the displayed command (`rcf audit coverage`) is run. The 0.27.0 shipped default is shallow-any, so the plain command does not enforce that; strict is per-AC-strict but is opt-in via `--strict`. This train flips the shipped default: strict is the default, `--mode shallow-any` is the explicit opt-out for author-time exploration (prints gaps, exits 0), and the legacy `--strict` flag stays as a no-op alias so existing CI, blueprints and dogfood scripts stay green. `--mode shallow-any --strict` is a usage refusal (exit 2) so a scripted invocation cannot silently disagree with itself. CHANGELOG carries a migration note under [Unreleased]. Repo's own CI dogfood invocation is updated to the shipped default. Closes referee-guarantees docs claims C-11 and C-14 (audit at reviews/2026-09-15-docs-claims-audit/how-it-works__what-the-referee-guarantees.json).",
   "category": "functional",
   "domain": "functional",
@@ -9,5 +9,8 @@
   "prdId": "PRD-001",
   "title": "Referee guarantee: `rcf audit coverage` is strict-by-default; `--mode shallow-any` is the explicit opt-out; `--strict` remains a no-op alias",
   "version": "0.1.0",
-  "status": "draft"
+  "status": "draft",
+  "tags": [
+    "capability:verify"
+  ]
 }

package/rcf/requirements/req-165.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-16T22:38:04Z",
-  "updatedAt": "2026-09-16T22:38:04Z",
+  "updatedAt": "2026-09-21T17:00:00.000Z",
   "description": "Referee-guarantees docs page promises that `rcf build finalise` is the only path that writes verified, that a chain that says verified traces to an actual post-merge runtime check, and that the finalise gate refuses on the three per-AC verdicts the aggregator already emits: UI-BASELINE-UNMET (docs claim C-28; also covers a block-severity probe-pack failure, C-36), BROWSER-VERIFICATION-MISSING (C-29) and SCOPE-MISMATCH (C-30). The 0.27.0 finalise CLI only branched on MOCK-ONLY-DECLARED / BLOCKED-BY-DECLARATION and EVAL-MISSING / EVAL-BELOW-THRESHOLD; the three new verdicts were derived on the report but did not gate finalise. The manual override path (`rcf define update FBS.executionStatus=verified`) was accepted by the writer, defeating the C-22 promise. This train wires the three per-AC refusals in finalise (no ack path: the refusals are honest; fix the AC or its scope), gates the manual override behind `--acknowledge-verified-override` on `rcf define update` (per the escalation clause: existing WSD projects may still need the escape valve; the writer's default is now the documented behaviour), and adds a git default-branch precondition to finalise with `--allow-pre-merge` as the deliberate pre-merge dry-run opt-out. Closes referee-guarantees docs claims C-22 / C-26 / C-28 / C-29 / C-30 / C-36 (audit at reviews/2026-09-15-docs-claims-audit/how-it-works__what-the-referee-guarantees.json). C-33 (shipWithoutEval manifest field) remains open: the write path already exists (skips schema validation), but the rcf-schemas 0.6.2 manifest schema does not yet declare the field; the exact delta needed lands in the ship-without-eval.js comment and in the report for this dispatch. C-38 (per-check applicable:false in browserVerificationProbePackCheck) is also blocked on the rcf-schemas bump; source comments already flag it.",
   "category": "functional",
   "domain": "functional",
@@ -9,5 +9,8 @@
   "prdId": "PRD-001",
   "title": "Referee guarantee: `rcf build finalise` refuses UI-BASELINE-UNMET / BROWSER-VERIFICATION-MISSING / SCOPE-MISMATCH; verified traces to a post-merge run; manual override is gated",
   "version": "0.1.0",
-  "status": "draft"
+  "status": "draft",
+  "tags": [
+    "capability:verify"
+  ]
 }