@aotter/mantle 0.0.11-alpha.72 → 0.1.0-alpha.1

package/README.md

@@ -22,7 +22,7 @@ Adopters install this one package and import from subpaths. Sub-packages remain
 | `@aotter/mantle/spec` (or root) | Manifest grammar, validators, JSON-Schema→Zod, diagnostic catalog (no env / no IO) |
 | `@aotter/mantle/runtime` | Hexagonal runtime: domain ports, use cases, infrastructure helpers (no adapter deps) |
 | `@aotter/mantle/runtime/testing` | Node-only crowded SQLite planner and HTTP sampling helpers |
-| `@aotter/mantle/cloudflare` | Cloudflare Workers adapter — D1, KV, R2, Better Auth, MCP via `@cloudflare/workers-oauth-provider` |
+| `@aotter/mantle/cloudflare` | Cloudflare Workers adapter — D1, Workers Cache, R2, Better Auth, MCP via `@cloudflare/workers-oauth-provider` |
 | `@aotter/mantle/admin-ui` | Pre-built React 19 admin SPA bundle |
 
 ```ts
@@ -80,7 +80,7 @@ import { manifest } from "../.mantle/generated/site.js";
 export default createMantleWorker({ manifest });
 ```
 
-`createMantleWorker` owns conventional D1/KV/assets bindings, Auth, Admin,
+`createMantleWorker` owns conventional D1/assets bindings, Auth, Admin,
 manifest REST/HTTP routes, OAuth, MCP, cache safety, and rejection-safe
 per-isolate boot. Use its single `extend` seam for application handlers and
 new Hono routes; use the public low-level exports when the deployment does not
@@ -166,7 +166,7 @@ Core-owned `mantle:plugin` skill and records it in `.mantle/plugins.json` plus
 | Cloudflare Workers | ✅ shipping |
 | Netlify | 📋 README stub — engineering forcing function for v0.2 (`@aotter/mantle-netlify`) |
 
-The `mantle-runtime` package never imports Cloudflare-specific types — adapters bind concrete drivers (D1 / KV / R2) to the runtime's `domain/port/*` interfaces, so adding a new adapter is a port-implementation exercise, not a refactor.
+The `mantle-runtime` package never imports Cloudflare-specific types — adapters bind concrete drivers (D1 / R2) to the runtime's `domain/port/*` interfaces, so adding a new adapter is a port-implementation exercise, not a refactor.
 
 ## Documentation
 
@@ -181,7 +181,7 @@ The `mantle-runtime` package never imports Cloudflare-specific types — adapter
   - `node_modules/@aotter/mantle/docs/schema-indexes.md` (ordered composite
     JSON-field indexes, D1 query plans, and the safe Procedure SQL helper)
   - `node_modules/@aotter/mantle/docs/performance-harness.md` (crowded SQLite,
-    Wrangler-local D1, cache HIT/MISS, and coding-agent guardrails)
+    Wrangler-local D1 origin paths and coding-agent guardrails)
   - `node_modules/@aotter/mantle/docs/adr/`
   - `node_modules/@aotter/mantle/skills/develop/SKILL.md`
   - `node_modules/@aotter/mantle/skills/plugin/SKILL.md`

package/docs/adapter-guide.md

@@ -8,12 +8,11 @@ Adapter packages live under `packages/adapters/<platform>/` using a plural `adap
 
 ## Required runtime ports
 
-A first-run adapter must implement exactly these three runtime ports:
+A first-run adapter must implement exactly these two runtime ports:
 
 | Contract | Source | Cloudflare example |
 |---|---|---|
 | `DatabaseDriver` plus `PreparedStatement` and `MigrationRunner` | `packages/mantle-runtime/src/domain/port/DatabaseDriver.ts` | `packages/adapters/cloudflare/src/bindings/D1DatabaseDriver.ts` |
-| `KvCache` | `packages/mantle-runtime/src/domain/port/KvCache.ts` | `packages/adapters/cloudflare/src/bindings/KvCacheBinding.ts` |
 | `AssetServer` | `packages/mantle-runtime/src/domain/port/AssetServer.ts` | `packages/adapters/cloudflare/src/bindings/AssetsAssetServer.ts` |
 
 The runtime must not import platform types such as `D1Database`, `KVNamespace`, Cloudflare `Fetcher`, Netlify request objects, Postgres pools, or adapter SDK types. Those live in adapter packages.
@@ -49,7 +48,6 @@ const runtime = createCmsRuntime({
   templates,
   siteDefaults,
   db,
-  kv,
   assets,
   publicPathResolver,
   mediaStorage,
@@ -116,7 +114,7 @@ response policy covers admin, auth, API, OAuth, MCP, redirects, and errors.
 Those responses receive `Cache-Control: private, no-store`; Cloudflare-specific
 CDN cache overrides are removed.
 
-`mountPublicRoutes(...)` opts only successful pre-rendered HTML, markdown,
+`mountPublicRoutes(...)` renders canonical D1 state and opts only successful HTML, markdown,
 `llms.txt`, and sitemap responses into the shared cache with
 `Cache-Control: public, max-age=0, s-maxage=300`. The top-level policy preserves
 that opt-in only for anonymous `GET`/`HEAD` responses with status 200, explicit
@@ -149,7 +147,6 @@ Minimum auth/MCP behavior:
 ## Implementation checklist
 
 - [ ] Implement `DatabaseDriver`, including canonical migration tracking.
-- [ ] Implement `KvCache`, including prefix listing and opaque cursors.
 - [ ] Implement `AssetServer` for the admin UI assets.
 - [ ] Compose `createCmsRuntime` with manifests, handlers, templates, site defaults, and required ports.
 - [ ] Call `bootInit()` before serving CMS traffic.

package/docs/adr/0011-adapter-port-spec.md

@@ -1,14 +1,14 @@
 # ADR-0011: Adapter port spec
 
-**Status:** Accepted for v0.1.0. New ADR. Replaces the architectural concerns previously tracked in POC ADR-0015 (`cms-astro` internal seam discipline).
+**Status:** Accepted for v0.1.0. Amended 2026-08-11 to remove the rendered-artifact `KvCache` port.
 
-**Date:** 2026-05-04 (revised 2026-05-09 to absorb ADR-0014; revised 2026-05-10 to remove obsolete pre-ADR-0014 port text).
+**Date:** 2026-05-04 (revised 2026-05-09, 2026-05-10, and 2026-08-11).
 
 ## Context
 
 `@aotter/mantle-runtime` is adapter-agnostic. It owns dispatcher, entry-writer, view executor, content-ops, render pipeline, boot validation, and MCP JSON-RPC dispatch. It depends only on `@aotter/mantle-spec` and a small set of TypeScript interfaces it defines itself.
 
-`@aotter/mantle-cloudflare` is the only adapter shipping in v0.1.0. It binds the runtime's interfaces against Cloudflare Workers' D1, KV, ASSETS, and supplies a Better Auth instance (per ADR-0014) for sign-in + MCP bearer validation.
+`@aotter/mantle-cloudflare` is the only adapter shipping in v0.1.0. It binds the runtime's interfaces against Cloudflare Workers' D1 and ASSETS, and supplies a Better Auth instance (per ADR-0014) for sign-in + MCP bearer validation. OAuth grant KV remains adapter-owned infrastructure and is not a runtime port.
 
 `@aotter/mantle-netlify` is a v0.2 stub — README only. It exists in the package layout as an engineering forcing function: with N=1 adapter, "adapter-agnostic" silently rots in PR review (a `D1Database` import slips into runtime, then a second, then five). With a second adapter visible in the workspace (even if its impl is a TODO), reviewers have somewhere to point when blocking the slip.
 
@@ -21,14 +21,18 @@ The POC accumulated multiple half-decisions about this seam (POC ADR-0015 docume
 
 ## Decision
 
-**Three required adapter ports**, defined as TypeScript interfaces in `@aotter/mantle-runtime/src/domain/port/`. Concrete adapters provide implementations and inject them into `createCmsRuntime`.
+**Two required adapter ports**, defined as TypeScript interfaces in `@aotter/mantle-runtime/src/domain/port/`. Concrete adapters provide implementations and inject them into `createCmsRuntime`.
 
 | Port | Surface |
 |---|---|
 | `DatabaseDriver` | All persistent state — `entries`, `site_config`, `staff`, `users`, `approvals`, plus migrations. |
-| `KvCache` | Publish-pipeline cache — pre-rendered HTML, `.md` mirrors, `llms.txt` per locale. Read-mostly, written by the publish pipeline. |
 | `AssetServer` | Static-asset serving for the admin SPA. The runtime hands the adapter an asset path + `Request`; the adapter returns a `Response` with the right MIME and caching. |
 
+Rendered public artifacts are not a second storage model. D1 stays canonical;
+adapters render on origin misses and may use their native HTTP response cache.
+The Cloudflare adapter uses version-local Workers Cache, which runs before the
+Worker for eligible anonymous responses.
+
 Optional feature ports may also live in `domain/port/`, but they are
 not part of the first-run adapter contract until a feature is enabled.
 For v0.1.x media hosting and deferred lifecycle dispatch:
@@ -121,20 +125,6 @@ The runtime never sees `D1Database`, `Pool` (postgres), or any concrete driver.
 
 The CF adapter's impl is a thin proxy over `env.DB` (D1). A future Postgres-via-Hyperdrive adapter wraps `pg` to the same shape; a Netlify adapter could wrap Neon, Supabase, or PlanetScale.
 
-### `KvCache`
-
-```ts
-export interface KvCache {
-  get(key: string): Promise<string | null>;
-  put(key: string, value: string, opts?: { expirationTtl?: number }): Promise<void>;
-  delete(key: string): Promise<void>;
-  /** List keys with a prefix — used by sitemap / llms.txt aggregation. */
-  list(prefix: string, cursor?: string | null): Promise<{ keys: string[]; cursor: string | null }>;
-}
-```
-
-CF adapter: Workers KV. Future: Redis, FS, S3-compatible store.
-
 ### `AssetServer`
 
 ```ts
@@ -164,7 +154,6 @@ import {
   mountServerEndpoints,
   AssetsAssetServer,
   D1DatabaseDriver,
-  KvCacheBinding,
 } from "@aotter/mantle-cloudflare";
 
 const auth = createAuth({
@@ -188,7 +177,6 @@ const cms = createCmsRef({
   handlers,
   bindings: {
     db: new D1DatabaseDriver(env.DB),
-    kv: new KvCacheBinding(env.KV),
     assets: new AssetsAssetServer(env.ASSETS),
   },
   auth,
@@ -224,10 +212,10 @@ There's no module-global state holding adapter-specific bindings.
 - Removing a port is also possible (if a port is found to overlap or be unnecessary), again by amending this ADR.
 
 **Discoverability for adapter authors**:
-- A future Bun/Deno/Vercel/Netlify port author reads this ADR + [`docs/adapter-guide.md`](../adapter-guide.md), implements the three required ports, then wires boot and HTTP/MCP surfaces. That's the contract. No hidden state, no implicit assumptions about the HTTP framework.
+- A future Bun/Deno/Vercel/Netlify port author reads this ADR + [`docs/adapter-guide.md`](../adapter-guide.md), implements the two required ports, then wires boot and HTTP/MCP surfaces. That's the contract. No hidden state, no implicit assumptions about the HTTP framework.
 
 **Test ergonomics**:
-- Each port is small and isolated. Tests can mock individual ports without spinning up D1 / KV / OAuth provider.
+- Each port is small and isolated. Tests can mock individual ports without spinning up D1 or an OAuth provider.
 - The runtime's test suite exercises against in-memory port impls; the adapter's test suite exercises the binding against real CF resources via `wrangler dev` or live deploy.
 
 **The Netlify stub's job**:
@@ -235,11 +223,11 @@ There's no module-global state holding adapter-specific bindings.
 
 ## Alternatives considered
 
-**(a) Single mega-port** — One `RuntimePorts` interface containing every method (db.prepare, kv.get, assets.fetch, media.createUpload, …). **Rejected**: leaks the entire surface onto every adapter. Adapter authors who only want to swap KV would have to touch the mega-port impl. Discrete ports keep change blast radius per port.
+**(a) Single mega-port** — One `RuntimePorts` interface containing every method (db.prepare, assets.fetch, media.createUpload, …). **Rejected**: leaks the entire surface onto every adapter. Discrete ports keep change blast radius per port.
 
 **(b) Concrete CF types in runtime** — Just `import type { D1Database } from "@cloudflare/workers-types"` directly into `mantle-runtime`. Treat "CF-only" as a v0.1.0 reality, defer the abstraction. **Rejected**: this is what the POC did (via `cms-server` having implicit assumptions about D1 shape) and it's the trap the rebuild exists to escape. Once concrete CF types land in runtime, removing them is a multi-PR uplift later. Cheaper to do it right at v0.1.0.
 
-**(c) Function-injection (no interfaces, just functions)** — Runtime accepts a record of functions: `{ dbPrepare, kvGet, kvPut, sessionRead, … }`. **Rejected**: TypeScript interfaces are more discoverable (an adapter author IDE-jumps from `DatabaseDriver` to its surface; jumping from `dbPrepare` is harder). Interfaces also document grouping; functions don't.
+**(c) Function-injection (no interfaces, just functions)** — Runtime accepts a record of functions such as `{ dbPrepare, assetFetch, sessionRead, … }`. **Rejected**: TypeScript interfaces are more discoverable and document grouping.
 
 **(d) Plugin pattern (each port is a separate package)** — `@aotter/mantle-port-database`, `@aotter/mantle-port-kv`, etc., and runtime depends on one package per port. **Rejected**: the port set is too small to warrant per-port packages. The current 5-package structure (spec / runtime / admin-ui / cloudflare / netlify) is already at the boundary of "too many"; splitting further increases the maintenance tax without useful benefit. Ports are TS interfaces in `mantle-runtime`'s `src/domain/port/` directory — that's enough.
 
@@ -251,12 +239,12 @@ When you're authoring `@aotter/mantle-runtime` code:
 
 1. If you reach for a CF-specific type, **stop**. Define a method on a port instead.
 2. If a port is missing the method you need, **amend this ADR first** in the same PR, then add the method. Adapters in the same PR.
-3. Tests must use port mocks (in-memory implementations) — never reach into a real D1 / KV from runtime tests.
+3. Tests must use port mocks (in-memory implementations) — never reach into a real D1 from runtime tests.
 
 When you're authoring an adapter (`@aotter/mantle-cloudflare` for v0.1.0; future `mantle-netlify`, `mantle-bun`, …):
 
 1. Read `mantle-runtime/src/domain/port/`. Implement each required port against your runtime's primitives.
-2. Compose the runtime via `createCmsRuntime({ db, kv, assets, manifests, handlers, templates, siteDefaults, ... })`.
+2. Compose the runtime via `createCmsRuntime({ db, assets, manifests, handlers, templates, siteDefaults, ... })`.
 3. Call `runtime.bootInit()` once before serving CMS traffic.
 4. Bind to your HTTP framework — Hono on CF, Netlify Functions handler, raw `fetch` Worker, …
 5. Provide adapter-owned auth and map sessions/scopes/roles into runtime handler context.

package/docs/adr/0012-views-as-public-rest.md

@@ -88,7 +88,7 @@ spec:
     eq: { field: locale, value: { $param: locale } }
 ```
 
-The `$param` discriminator key was chosen to match the JSON Schema `$ref` convention. Future sentinels (`$now`, `$ctx.user`) follow the same `$<name>` shape; this ADR adds none of them.
+The `$param` discriminator key was chosen to match the JSON Schema `$ref` convention. The later closed `{ "$ctx.user": "id" }` sentinel follows the same `$<name>` shape; `$now` remains unimplemented.
 
 Boot validator gates:
 - `View.spec.params` MUST be `type: object` with `properties` declared (`VIEW_PARAMS_INVALID_SHAPE`).

package/docs/api-mcp-authorization.md

@@ -78,6 +78,56 @@ Missing/invalid credentials return `401`; a verified caller missing a required
 role or scope returns `403`; a site guard may return
 `ENTITLEMENT_REQUIRED`/`402`. Guards run on every call and are not cached.
 
+### Identity-bound Views
+
+Use the closed `{ "$ctx.user": "id" }` filter sentinel for rows owned by the
+current site-local Better Auth user. The caller never supplies this value, so
+the same View is safe on both REST and public MCP:
+
+```yaml
+apiVersion: cms.mantle.aotter.net/v1
+kind: Schema
+metadata: { name: orders }
+spec:
+  schema:
+    type: object
+    properties:
+      userId: { type: string, x-mantle-bind: ctx.user }
+      orderNumber: { type: string }
+      orderStatus: { type: string }
+      totalMinor: { type: integer }
+      placedAt: { type: integer }
+  indexes: [[userId, placedAt]]
+---
+apiVersion: cms.mantle.aotter.net/v1
+kind: View
+metadata: { name: my-orders }
+spec:
+  surface: public
+  from: orders
+  requires:
+    auth:
+      all: [ctx.user]
+  filter:
+    and:
+      - { eq: { field: status, value: published } }
+      - { eq: { field: userId, value: { "$ctx.user": id } } }
+  fields: [orderNumber, orderStatus, totalMinor, placedAt]
+  orderBy: [{ field: placedAt, direction: desc }]
+  limit: 50
+```
+
+Core rejects this sentinel unless the View requires `ctx.user` and the bound
+field is the leftmost field of a declared Schema index. Missing identity fails
+with `401`; it never drops the filter or falls back to all rows. REST exposes
+`GET /api/views/my-orders`; public MCP exposes `query_view_my_orders`. Both
+call `ExecuteViewUseCase` and bind the same `ctx.user.id`.
+
+The id belongs to the customer site's Better Auth user row. It is not a
+Mantle Platform user id, Hosted Auth upstream subject, email, or provider id.
+Hosted Auth may establish the site session, but Platform is not part of the
+View query path.
+
 ## Cloudflare consumer wiring
 
 Pass one site-owned resolver to `createCmsRef`. Return `not-handled` when the
@@ -173,7 +223,6 @@ import {
   createMcpApiHandler,
   createOAuthProvider,
   D1DatabaseDriver,
-  KvCacheBinding,
   mountServerEndpoints,
 } from "@aotter/mantle/cloudflare";
 
@@ -182,7 +231,6 @@ const runtimeRef = createCmsRef({
   handlers,
   bindings: {
     db: new D1DatabaseDriver(env.DB),
-    kv: new KvCacheBinding(env.KV),
     assets: env.ASSETS
       ? new AssetsAssetServer(env.ASSETS)
       : { fetch: async () => null },

package/docs/cloudflare-low-level-composition.md

@@ -72,7 +72,7 @@ function assemble(env: Env) {
 }
 ```
 
-Keep the conventional `DB`, `KV` and `OAUTH_KV` bindings and
+Keep the conventional `DB` and `OAUTH_KV` bindings and
 `nodejs_compat`; add the Queue producer in `wrangler.jsonc`:
 
 ```jsonc

package/docs/deferred-lifecycle-queues.md

@@ -103,7 +103,6 @@ import type { DeferredHookEnvelope } from "@aotter/mantle/runtime";
 import {
   AssetsAssetServer,
   D1DatabaseDriver,
-  KvCacheBinding,
   WorkersQueueHookDispatcher,
   createCmsRef,
   createQueueHandler,
@@ -112,7 +111,6 @@ import {
 
 interface Env {
   DB: D1Database;
-  KV: KVNamespace;
   ASSETS: Fetcher;
   MANTLE_INTERNAL_QUEUE: Queue<DeferredHookEnvelope>;
 }
@@ -124,7 +122,6 @@ function buildWorker(env: Env) {
     auth: createSiteAuth(env),
     bindings: {
       db: new D1DatabaseDriver(env.DB),
-      kv: new KvCacheBinding(env.KV),
       assets: new AssetsAssetServer(env.ASSETS),
       deferredHookDispatcher: new WorkersQueueHookDispatcher(
         env.MANTLE_INTERNAL_QUEUE,

package/docs/design-atoms.md

@@ -237,7 +237,12 @@ properties:
 Informational FK marker on a string-typed field that holds an ID
 referencing rows in another Schema. Not enforced in v0.1 (the SDK
 passes it through; no foreign-key constraint, no cascade, no orphan
-detection). Future grammar may upgrade it to enforced.
+detection). The admin uses declared refs to show related rows and to nest
+required child collections; it does not infer relationships from field names.
+Declare a single-field `indexes` entry for the ref field (for example,
+`indexes: [[authorId]]`) when reverse lookups must stay bounded. Mantle adds
+the native entry-order columns to that access path. Future grammar may upgrade
+it to enforced.
 
 **Example**:
 ```yaml
@@ -714,16 +719,16 @@ grammar, leftmost-prefix rules, SQL helper, and query-plan examples.
 ### Practical scale envelope on D1
 
 - **Blog-scale (< 10k entries / collection)**: today's design is
-  comfortable. Public render hits KV cache, not D1.
+  comfortable. Anonymous public responses can hit version-local Workers
+  Cache before the Worker; origin misses use indexed D1 reads.
 - **Mid-scale (10k – 100k entries)**: declare measured list/filter
   access paths with ordered `indexes`. Cross-collection JSON-path joins
   may eventually gain `x-mantle-ref` auto-lift; that remains DRAFT.
 - **Hard D1 limits**: 1 MB max row size; 5,000 rows per query result;
   single-writer per database (concurrent writes serialize).
-- **Cross-region read**: D1 is region-pinned; first hit from a
-  far region is ~100–200 ms cold replica. Public reads should hit
-  the SDK's KV render cache, not D1, so this rarely matters at the
-  CMS layer.
+- **Cross-region read**: D1 is region-pinned; first origin hit from a
+  far region may pay replica latency. Eligible anonymous responses are
+  then served by version-local Workers Cache.
 
 ### Scale-up path: D1 → Postgres via Cloudflare Hyperdrive
 

package/docs/performance-harness.md

@@ -13,8 +13,8 @@ make a normal content/API/page change.
 | Manifest View execution | `ExecuteViewUseCase` + `ViewSqlCompiler` | The deliberate compiled-query exception; it still resolves declared Schema indexes. |
 | Editable settings and code-owned locale/media policy | `DatabaseSiteConfigRepository` | Editable values and dynamic media tool policy are read fresh; boot-seeded locale policy may be memoized within the runtime instance. |
 | Pending media uploads | `DatabasePendingUploadRepository` | Canonical, read-after-write D1 state; never publish-cache state. |
-| Rendered HTML, Markdown, and `llms.txt` | `HtmlPublishOrchestrator` plus the Cloudflare public-route cache policy | Reproducible derivatives live in KV. Settings updates invalidate through a runtime use case. |
-| D1/KV transport and optional query metrics | Cloudflare bindings | Bindings stay thin. Query/cache policy does not belong in a generic provider `BaseRepository`. |
+| Rendered HTML, Markdown, and `llms.txt` | Request-time render use cases plus the Cloudflare public-route cache policy | D1 is canonical; version-local Workers Cache stores anonymous HTTP responses. |
+| D1 transport and optional query metrics | Cloudflare bindings | Bindings stay thin. Query/cache policy does not belong in a generic provider `BaseRepository`. |
 
 `CmsRuntime.db` remains deprecated compatibility surface. New site code uses
 Manifests, runtime use cases, `entryReader`, and `siteConfig`. A site may own
@@ -24,16 +24,14 @@ must not query Mantle-owned tables through `runtime.db`.
 ## Cache contract
 
 - D1 is canonical for entries, site settings, media metadata, and pending
-  uploads. KV contains only reproducible public artifacts.
-- A public KV hit checks the cache before loading full editable site settings.
-  Locale policy is the small boot-seeded exception. A warm entry/page artifact
-  therefore performs zero D1 queries.
-- A safe cache miss renders from canonical state and schedules KV write-back
-  with the request execution context. It waits inline only when no execution
-  context exists, such as a direct unit call.
-- Site-setting writes call the runtime settings use case, which completes
-  public-artifact invalidation before reporting success. HTTP routes do not
-  scan/delete KV prefixes themselves.
+  uploads. Core stores no rendered artifact copies.
+- Public routes render canonical state and return
+  `Cache-Control: public, max-age=0, s-maxage=300`.
+- Cloudflare Workers Cache checks eligible anonymous responses before invoking
+  the Worker. Cache keys are version-local, so a deploy starts with no stale
+  response from the previous Worker version.
+- Site-setting and content writes only persist canonical state. They do not
+  wait for render work or scan/delete cache prefixes.
 - Do not cache every repository read. Cross-isolate correctness for editable
   data wins unless a read has a measured hot-path contract and explicit
   invalidation.
@@ -76,11 +74,12 @@ Timing always reports p50/p95/max. A test-only Worker wrapper may also return
 `x-mantle-query-count` and `x-mantle-rows-read`; those become distributions in
 the same report. Do not expose these diagnostic headers in production.
 
-Core CI runs `pnpm bench:wrangler` against real Wrangler-local D1, KV, Worker
-HTTP routing, View execution, and live page rendering. It compares 100 and
-10,000 row fixtures, then samples page MISS and HIT separately. CI gates
-row-read scaling, endpoint query budgets, and zero-D1 warm hits, not absolute
-milliseconds.
+Core CI runs `pnpm bench:wrangler` against real Wrangler-local D1, Worker HTTP
+routing, View execution, and origin page rendering. It compares 100 and 10,000
+row fixtures and gates row-read scaling plus endpoint query budgets, not
+absolute milliseconds. Wrangler-local does not emulate the new entrypoint
+Workers Cache, so cache hits are a deployment-level smoke check rather than a
+fabricated local metric.
 
 ## Seven findings: measured disposition
 
@@ -89,12 +88,12 @@ diagnostic, while query/row counts are the stable assertions.
 
 | Finding | Disposition |
 |---|---|
-| Public KV hits read D1 first | Fixed. A 10,000-row warm page measured 0 queries / 0 rows read. |
+| Public cache hits read D1 first | Removed from Worker code. Cloudflare's entrypoint Workers Cache runs before the Worker; Core has no inner render cache. |
 | Slug/locale reads bypass generated indexes | Fixed by the shared schema-aware entry-read boundary. A 10,000-row page MISS measured 2 queries / 5 rows read. |
 | OFFSET pagination | Accepted for the v0.1 bounded-result surfaces: every response is capped at 500 rows and public hot paths must stay shallow. Deep/export workloads require a purpose-shaped cursor API before they are declared hot. |
 | Admin substring search scans | Accepted only for the authenticated Admin collection browser, with a 500-row response cap. Large/search-heavy sites should add a purpose-shaped indexed View or dedicated search service; do not expose this scan publicly. |
 | Published list/sitemap/llms paths lack system indexes | Fixed with measured partial indexes for published global, locale, collection, and collection+locale ordering. The 100-row and 10,000-row API runs both measured 1 query / 20 rows read. |
-| Page MISS waits for KV write-back | Fixed. Reproducible artifacts write through `waitUntil`; regression coverage proves response completion does not await KV. |
+| Page MISS waits for cache write-back | Removed. Origin rendering returns directly; Workers Cache owns response storage outside the Worker. |
 | Benchmark stops at fake in-process dispatch | Fixed by the Node planner and Wrangler-local Worker/API/page layers. The old dispatch microbenchmark remains a narrow CPU signal only. |
 
 The retained OFFSET and substring-search trade-offs are visible exceptions,

package/docs/release-process.md

@@ -48,14 +48,16 @@ decision instead of starting another local redesign loop.
 ## Branches and channels
 
 - Feature and release PRs target `develop`.
-- Pre-v0.1 alphas release directly from the merged `develop` release commit.
+- Alpha prereleases before stable v0.1.0 release directly from the merged
+  `develop` release commit.
 - Beta, RC, and stable promotion to `main` remains a deliberate human decision;
   it is not part of the alpha controller.
 - Alpha, beta, and RC GitHub releases are prereleases.
 - npm dist-tags follow the suffix: `alpha`, `beta`, `rc`, or `latest` for
   stable versions.
-- During the current `0.0.x-alpha` cadence, `latest` follows the current alpha
-  while the `alpha` tag remains available.
+- During the legacy `0.0.x-alpha` cadence, `latest` follows the current alpha.
+  The final `0.1.0-alpha.N` candidates advance only `alpha`; `latest` moves to
+  `0.1.0` after the stable gate passes.
 
 ## Release PR
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aotter/mantle",
-  "version": "0.0.11-alpha.72",
+  "version": "0.1.0-alpha.1",
   "description": "Umbrella entry for @aotter/mantle. Adopters install this one package and import from subpaths: /spec, /runtime, /cloudflare, /admin-ui. Sub-packages remain individually installable on npm for tooling / alt-adapter authors. The Netlify adapter ships as a private workspace stub in v0.1 — its subpath will be added when the impl lands in v0.2.",
   "license": "Apache-2.0",
   "homepage": "https://mantle.tools/",
@@ -55,24 +55,24 @@
     "README.md"
   ],
   "dependencies": {
-    "@aotter/mantle-admin-ui": "0.0.11-alpha.72",
-    "@aotter/mantle-runtime": "0.0.11-alpha.72",
-    "@aotter/mantle-spec": "0.0.11-alpha.72",
-    "@aotter/mantle-cloudflare": "0.0.11-alpha.72"
+    "@aotter/mantle-admin-ui": "0.1.0-alpha.1",
+    "@aotter/mantle-cloudflare": "0.1.0-alpha.1",
+    "@aotter/mantle-spec": "0.1.0-alpha.1",
+    "@aotter/mantle-runtime": "0.1.0-alpha.1"
   },
   "peerDependencies": {
-    "@cloudflare/workers-oauth-provider": "^0.8.0",
+    "@cloudflare/workers-oauth-provider": "^0.8.2",
     "aws4fetch": "^1.0.20",
-    "better-auth": "^1.6.23",
+    "better-auth": "^1.6.24",
     "hono": "^4.12.0",
     "zod": "^4.0.0"
   },
   "devDependencies": {
-    "@cloudflare/workers-oauth-provider": "^0.8.0",
+    "@cloudflare/workers-oauth-provider": "^0.8.2",
     "@types/node": "^26",
     "aws4fetch": "^1.0.20",
-    "better-auth": "^1.6.23",
-    "hono": "^4.12.30",
+    "better-auth": "^1.6.24",
+    "hono": "^4.12.34",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10",
     "zod": "^4.4.2"

package/skills/develop/SKILL.md

@@ -16,7 +16,7 @@ docs govern runtime/API behavior.
 ## First Read
 
 1. `package.json` for the installed `@aotter/mantle*` versions.
-2. `manifests/` and `src/mantle/config.ts` for the active atoms and adapter wiring. If the project is older, check `src/mantleConfig.ts`.
+2. `manifests/`, the active adapter config, and `src/auth.ts` when present. If the project is older, check `src/mantleConfig.ts`.
 3. The active `.mantle/overlays/<type>/seed.json`, when present; generated
    homepages commonly import visible copy and form structure from it.
 4. Optional local context: `.mantle/launch-state.json`, `.mantle/handoff.md`,
@@ -108,8 +108,8 @@ the atoms cannot express the behavior.
 
 ## Adapter Boundary
 
-The runtime is adapter-neutral. Required runtime ports are `DatabaseDriver`,
-`KvCache`, and `AssetServer`. Optional feature ports, such as `MediaStorage`
+The runtime is adapter-neutral. Required runtime ports are `DatabaseDriver`
+and `AssetServer`. Optional feature ports, such as `MediaStorage`
 or `DeferredHookDispatcher`, are enabled only when the current adapter wires
 them.
 
@@ -125,6 +125,15 @@ composition root. If a normal feature cannot be expressed through a
 purpose-shaped surface, treat that as a Core abstraction gap instead of
 teaching the project Mantle internals.
 
+## Auth Composition
+
+When a generated repo contains `src/auth.ts`, the repo owns its auth
+composition. Preserve the explicit mode recorded in its launch state and
+Worker config; do not infer a mode from whichever credentials happen to be
+present or configure competing paths. Keep provider secrets out of source.
+Follow the repo handoff for provider-specific setup rather than adding product
+policy to Core.
+
 ## Performance Loop
 
 After changing a Schema index, View filter/order, public API, or rendered page,

package/skills/provision/SKILL.md

@@ -107,7 +107,7 @@ Follow the landing handoff and generated client configuration. Hosted
 configuration remains in landing-managed Cloudflare Worker bindings; do not
 write client secrets into `wrangler.toml`.
 
-Verify that admin sign-in redirects to Mantle Platform and Staff MCP
+Verify that admin sign-in redirects to Mantle Hosted Auth and Staff MCP
 authenticates, then skip the self-hosted flow.
 
 ## Smoke Test