@aotter/mantle 0.0.11-alpha.73 → 0.1.0-alpha.2

package/docs/adr/0011-adapter-port-spec.md

@@ -1,16 +1,14 @@
 # ADR-0011: Adapter port spec
 
-**Status:** Accepted for v0.1.0. New ADR. Replaces the architectural concerns previously tracked in POC ADR-0015 (`cms-astro` internal seam discipline).
+**Status:** Accepted for v0.1.0. Amended 2026-08-13 to remove the unimplemented adapter stub.
 
-**Date:** 2026-05-04 (revised 2026-05-09 to absorb ADR-0014; revised 2026-05-10 to remove obsolete pre-ADR-0014 port text).
+**Date:** 2026-05-04 (revised 2026-05-09, 2026-05-10, 2026-08-11, and 2026-08-13).
 
 ## Context
 
 `@aotter/mantle-runtime` is adapter-agnostic. It owns dispatcher, entry-writer, view executor, content-ops, render pipeline, boot validation, and MCP JSON-RPC dispatch. It depends only on `@aotter/mantle-spec` and a small set of TypeScript interfaces it defines itself.
 
-`@aotter/mantle-cloudflare` is the only adapter shipping in v0.1.0. It binds the runtime's interfaces against Cloudflare Workers' D1, KV, ASSETS, and supplies a Better Auth instance (per ADR-0014) for sign-in + MCP bearer validation.
-
-`@aotter/mantle-netlify` is a v0.2 stub — README only. It exists in the package layout as an engineering forcing function: with N=1 adapter, "adapter-agnostic" silently rots in PR review (a `D1Database` import slips into runtime, then a second, then five). With a second adapter visible in the workspace (even if its impl is a TODO), reviewers have somewhere to point when blocking the slip.
+`@aotter/mantle-cloudflare` is the only adapter shipping in v0.1.0. It binds the runtime's interfaces against Cloudflare Workers' D1 and ASSETS, and supplies a Better Auth instance (per ADR-0014) for sign-in + MCP bearer validation. OAuth grant KV remains adapter-owned infrastructure and is not a runtime port.
 
 This ADR fixes the contract so:
 - Future adapter authors have a stable target.
@@ -21,14 +19,18 @@ The POC accumulated multiple half-decisions about this seam (POC ADR-0015 docume
 
 ## Decision
 
-**Three required adapter ports**, defined as TypeScript interfaces in `@aotter/mantle-runtime/src/domain/port/`. Concrete adapters provide implementations and inject them into `createCmsRuntime`.
+**Two required adapter ports**, defined as TypeScript interfaces in `@aotter/mantle-runtime/src/domain/port/`. Concrete adapters provide implementations and inject them into `createCmsRuntime`.
 
 | Port | Surface |
 |---|---|
-| `DatabaseDriver` | All persistent state — `entries`, `site_config`, `staff`, `users`, `approvals`, plus migrations. |
-| `KvCache` | Publish-pipeline cache — pre-rendered HTML, `.md` mirrors, `llms.txt` per locale. Read-mostly, written by the publish pipeline. |
+| `DatabaseDriver` | All persistent state — `entries`, `site_config`, `staff`, `users`, plus migrations. |
 | `AssetServer` | Static-asset serving for the admin SPA. The runtime hands the adapter an asset path + `Request`; the adapter returns a `Response` with the right MIME and caching. |
 
+Rendered public artifacts are not a second storage model. D1 stays canonical;
+adapters render on origin misses and may use their native HTTP response cache.
+The Cloudflare adapter uses version-local Workers Cache, which runs before the
+Worker for eligible anonymous responses.
+
 Optional feature ports may also live in `domain/port/`, but they are
 not part of the first-run adapter contract until a feature is enabled.
 For v0.1.x media hosting and deferred lifecycle dispatch:
@@ -119,21 +121,7 @@ export interface DatabaseDriver {
 
 The runtime never sees `D1Database`, `Pool` (postgres), or any concrete driver. The `prepare` / `batch` shape is intentionally close to D1's surface (which is itself close to the SQLite C API) — that's the smallest common denominator. Adapters wrap their native driver to this shape.
 
-The CF adapter's impl is a thin proxy over `env.DB` (D1). A future Postgres-via-Hyperdrive adapter wraps `pg` to the same shape; a Netlify adapter could wrap Neon, Supabase, or PlanetScale.
-
-### `KvCache`
-
-```ts
-export interface KvCache {
-  get(key: string): Promise<string | null>;
-  put(key: string, value: string, opts?: { expirationTtl?: number }): Promise<void>;
-  delete(key: string): Promise<void>;
-  /** List keys with a prefix — used by sitemap / llms.txt aggregation. */
-  list(prefix: string, cursor?: string | null): Promise<{ keys: string[]; cursor: string | null }>;
-}
-```
-
-CF adapter: Workers KV. Future: Redis, FS, S3-compatible store.
+The CF adapter's impl is a thin proxy over `env.DB` (D1). A future Postgres adapter can wrap its driver to the same shape.
 
 ### `AssetServer`
 
@@ -146,7 +134,7 @@ export interface AssetServer {
 }
 ```
 
-CF adapter: wraps `env.ASSETS.fetch(req)`. Future: filesystem read, S3+CDN, Netlify static-publish dir.
+CF adapter: wraps `env.ASSETS.fetch(req)`. Other adapters can use a filesystem or object storage.
 
 The admin SPA itself lives in `@aotter/mantle-admin-ui` as a pre-built `dist/`. The adapter binds `AssetServer` to whatever serves that `dist/`; the runtime knows nothing about static asset serving except "ask the port and pass through the response."
 
@@ -164,7 +152,6 @@ import {
   mountServerEndpoints,
   AssetsAssetServer,
   D1DatabaseDriver,
-  KvCacheBinding,
 } from "@aotter/mantle-cloudflare";
 
 const auth = createAuth({
@@ -188,7 +175,6 @@ const cms = createCmsRef({
   handlers,
   bindings: {
     db: new D1DatabaseDriver(env.DB),
-    kv: new KvCacheBinding(env.KV),
     assets: new AssetsAssetServer(env.ASSETS),
   },
   auth,
@@ -210,7 +196,7 @@ export default createOAuthProvider({
 });
 ```
 
-The runtime gets three required adapter ports (`db`, `kv`, `assets`)
+The runtime gets two required adapter ports (`db`, `assets`)
 alongside manifests, handlers, templates, and site defaults. Auth is
 owned by the adapter layer that mounts HTTP/MCP surfaces; the runtime
 receives authenticated context when the adapter dispatches requests.
@@ -220,28 +206,25 @@ There's no module-global state holding adapter-specific bindings.
 
 **Hard-enforced boundaries**:
 - `@aotter/mantle-runtime` MUST NOT import `D1Database`, `KVNamespace`, `Fetcher` (CF Workers ASSETS), `@cloudflare/*`, or any other adapter-specific type. CI will lint for this; PR reviewers can grep.
-- A new required port can be added only by amending this ADR and updating ALL adapters (CF + Netlify stub) in the same change. Optional feature ports must be documented here and must state when adapters are required to implement them.
+- A new required port can be added only by amending this ADR and updating every shipping adapter in the same change. Optional feature ports must be documented here and must state when adapters are required to implement them.
 - Removing a port is also possible (if a port is found to overlap or be unnecessary), again by amending this ADR.
 
 **Discoverability for adapter authors**:
-- A future Bun/Deno/Vercel/Netlify port author reads this ADR + [`docs/adapter-guide.md`](../adapter-guide.md), implements the three required ports, then wires boot and HTTP/MCP surfaces. That's the contract. No hidden state, no implicit assumptions about the HTTP framework.
+- A future adapter author reads this ADR + [`docs/adapter-guide.md`](../adapter-guide.md), implements the two required ports, then wires boot and HTTP/MCP surfaces. That's the contract. No hidden state, no implicit assumptions about the HTTP framework.
 
 **Test ergonomics**:
-- Each port is small and isolated. Tests can mock individual ports without spinning up D1 / KV / OAuth provider.
+- Each port is small and isolated. Tests can mock individual ports without spinning up D1 or an OAuth provider.
 - The runtime's test suite exercises against in-memory port impls; the adapter's test suite exercises the binding against real CF resources via `wrangler dev` or live deploy.
 
-**The Netlify stub's job**:
-- The `@aotter/mantle-netlify` package's README declares a public commitment to an N>=2 adapter world. If a PR adds CF-specific code to runtime, reviewers point at the stub README and reject. The stub doesn't have to ship code to perform its function — its existence is the constraint.
-
 ## Alternatives considered
 
-**(a) Single mega-port** — One `RuntimePorts` interface containing every method (db.prepare, kv.get, assets.fetch, media.createUpload, …). **Rejected**: leaks the entire surface onto every adapter. Adapter authors who only want to swap KV would have to touch the mega-port impl. Discrete ports keep change blast radius per port.
+**(a) Single mega-port** — One `RuntimePorts` interface containing every method (db.prepare, assets.fetch, media.createUpload, …). **Rejected**: leaks the entire surface onto every adapter. Discrete ports keep change blast radius per port.
 
 **(b) Concrete CF types in runtime** — Just `import type { D1Database } from "@cloudflare/workers-types"` directly into `mantle-runtime`. Treat "CF-only" as a v0.1.0 reality, defer the abstraction. **Rejected**: this is what the POC did (via `cms-server` having implicit assumptions about D1 shape) and it's the trap the rebuild exists to escape. Once concrete CF types land in runtime, removing them is a multi-PR uplift later. Cheaper to do it right at v0.1.0.
 
-**(c) Function-injection (no interfaces, just functions)** — Runtime accepts a record of functions: `{ dbPrepare, kvGet, kvPut, sessionRead, … }`. **Rejected**: TypeScript interfaces are more discoverable (an adapter author IDE-jumps from `DatabaseDriver` to its surface; jumping from `dbPrepare` is harder). Interfaces also document grouping; functions don't.
+**(c) Function-injection (no interfaces, just functions)** — Runtime accepts a record of functions such as `{ dbPrepare, assetFetch, sessionRead, … }`. **Rejected**: TypeScript interfaces are more discoverable and document grouping.
 
-**(d) Plugin pattern (each port is a separate package)** — `@aotter/mantle-port-database`, `@aotter/mantle-port-kv`, etc., and runtime depends on one package per port. **Rejected**: the port set is too small to warrant per-port packages. The current 5-package structure (spec / runtime / admin-ui / cloudflare / netlify) is already at the boundary of "too many"; splitting further increases the maintenance tax without useful benefit. Ports are TS interfaces in `mantle-runtime`'s `src/domain/port/` directory — that's enough.
+**(d) Plugin pattern (each port is a separate package)** — `@aotter/mantle-port-database`, `@aotter/mantle-port-kv`, etc., and runtime depends on one package per port. **Rejected**: the port set is too small to warrant per-port packages. Ports are TypeScript interfaces in `mantle-runtime`'s `src/domain/port/` directory — that's enough.
 
 **(e) gRPC / wire-protocol seam** — Make ports a network protocol so adapters can be in any language. **Rejected**: the runtime is not an external service, it's a TypeScript library that adapters compose into a single Worker / Function. Network seam adds latency, deployment complexity, and operational surface for zero authoring benefit. The ports are in-process; they always will be.
 
@@ -251,29 +234,28 @@ When you're authoring `@aotter/mantle-runtime` code:
 
 1. If you reach for a CF-specific type, **stop**. Define a method on a port instead.
 2. If a port is missing the method you need, **amend this ADR first** in the same PR, then add the method. Adapters in the same PR.
-3. Tests must use port mocks (in-memory implementations) — never reach into a real D1 / KV from runtime tests.
+3. Tests must use port mocks (in-memory implementations) — never reach into a real D1 from runtime tests.
 
-When you're authoring an adapter (`@aotter/mantle-cloudflare` for v0.1.0; future `mantle-netlify`, `mantle-bun`, …):
+When you're authoring an adapter:
 
 1. Read `mantle-runtime/src/domain/port/`. Implement each required port against your runtime's primitives.
-2. Compose the runtime via `createCmsRuntime({ db, kv, assets, manifests, handlers, templates, siteDefaults, ... })`.
+2. Compose the runtime via `createCmsRuntime({ db, assets, manifests, handlers, templates, siteDefaults, ... })`.
 3. Call `runtime.bootInit()` once before serving CMS traffic.
-4. Bind to your HTTP framework — Hono on CF, Netlify Functions handler, raw `fetch` Worker, …
+4. Bind to your HTTP framework.
 5. Provide adapter-owned auth and map sessions/scopes/roles into runtime handler context.
 6. Bundle `@aotter/mantle-admin-ui`'s `dist/` via your runtime's static-asset surface and bind `AssetServer` to it.
 
 When you're reviewing a PR:
 
 1. Grep the diff for `@cloudflare`, `D1Database`, `KVNamespace`, `Fetcher` — flag any occurrence in `mantle-runtime/`.
-2. If a new port method shows up, check it's also reflected in this ADR + the Netlify stub README.
-3. If a port shape changed, all 2 adapters (CF real, Netlify stub) get updated in the same PR.
+2. If a new port method shows up, check it is also reflected in this ADR.
+3. If a port shape changed, every shipping adapter gets updated in the same PR.
 
 ## Implementation status
 
 - [x] Required port interface files live in `packages/mantle-runtime/src/domain/port/*.ts`.
 - [x] Cloudflare required port implementations live in `packages/adapters/cloudflare/src/bindings/*.ts`.
 - [x] Optional feature port `MediaStorage` (public bucket) is declared but not required by first-run adapters. `PrivateMediaStorage` is v0.2.
-- [x] Netlify stub README references this ADR.
 - [ ] CI lint: forbid `@cloudflare/*` / `D1Database` / `KVNamespace` imports in `mantle-runtime/` (post-v0.1.0; manual review until then)
 
 ## See also

package/docs/adr/0012-views-as-public-rest.md

@@ -88,7 +88,7 @@ spec:
     eq: { field: locale, value: { $param: locale } }
 ```
 
-The `$param` discriminator key was chosen to match the JSON Schema `$ref` convention. Future sentinels (`$now`, `$ctx.user`) follow the same `$<name>` shape; this ADR adds none of them.
+The `$param` discriminator key was chosen to match the JSON Schema `$ref` convention. The later closed `{ "$ctx.user": "id" }` sentinel follows the same `$<name>` shape; `$now` remains unimplemented.
 
 Boot validator gates:
 - `View.spec.params` MUST be `type: object` with `properties` declared (`VIEW_PARAMS_INVALID_SHAPE`).
@@ -96,8 +96,6 @@ Boot validator gates:
 - Every `{ $param: <name> }` ref MUST resolve to a declared param (`VIEW_FILTER_PARAM_REF_UNKNOWN`).
 - Every `{ $param: <name> }` ref MUST appear in `params.required` (`VIEW_FILTER_PARAM_REF_NOT_REQUIRED`).
 
-The required-only rule is a v0.1.0 simplification. v0.1.x will promote optional-with-skip semantics (filter clauses referencing missing optional params evaluate to TRUE / no-op) — the runtime compiler already implements drop semantics for forward compatibility, but the parser rejects it today so authors get a clear "not yet" diagnostic.
-
 ### 6. Response envelope is `{ rows, page, show, hasMore }`
 
 ```json
@@ -130,12 +128,11 @@ Query strings arrive as strings; `View.spec.params` declares the JSON Schema typ
 
 Required params not present → `400 INPUT_VALIDATION_FAILED`. Coercion failure → `400 INPUT_VALIDATION_FAILED`. Unknown query-string keys are silently ignored (lenient v0.1.0; strict mode is a candidate v0.1.x flag).
 
-## Out of scope (deferred)
+## Current limits
 
-- **`Trigger.target.view`** (lifecycle/projection triggers fired by Views). Tracked separately as a v0.2 grammar move.
-- **`spec.output.kind`** (declaring scalar / tree / tabular result shape per View). Lands with join + group-by support in v0.1.x.
-- **Optional param-ref drop semantics in the parser.** Runtime is already implemented; parser promotes when v0.1.x lands.
-- **DRAFT filter operators** (`contains` / `in` / `like` / `not`). v0.1 keeps comparison operators closed to `eq` / `gt` / `gte` / `lt` / `lte`; field-to-field comparisons remain out of scope.
+- Param refs must be required.
+- Filter operators are closed to `eq` / `gt` / `gte` / `lt` / `lte`;
+  field-to-field comparisons are unsupported.
 - **Row-level policy rewriting.** `requires` authorizes the whole View; it does
   not inject per-row visibility predicates. Consumer-specific membership,
   payment, or entitlement checks belong in the optional guard Procedure.
@@ -149,13 +146,12 @@ Required params not present → `400 INPUT_VALIDATION_FAILED`. Coercion failure
 - Cheap pagination + dynamic filters without hand-writing handlers.
 
 **Authors lose:**
-- A View per filter combination (until DRAFT operators land). `posts-by-locale` plus `posts-by-tag` plus `posts-by-locale-and-tag` would be three Views in v0.1.0.
+- Each named query shape remains an explicit View.
 - No internal-only View surface; choose public/staff or keep the query in a TS
   helper.
 
 **Runtime gains:**
 - One executor and response shape cover public/staff REST and MCP reads.
-- Forward-compat for join / group-by / aggregation: envelope generalises by Views declaring `output.kind` later.
 
 **Reviewers / future contributors should:**
 - Reject any PR adding `Schema.spec.expose.rest` or a similar Schema-level public-read flag.

package/docs/adr/0014-auth-better-auth-and-multi-tenant-mcp.md

@@ -44,7 +44,7 @@ A 2026 Workers-friendly auth library — [Better Auth](https://better-auth.com)
 - **MCP plugin (`mcp`)** — purpose-built on top of the OAuth 2.1 provider for MCP DCR; auto-mounts `.well-known/oauth-authorization-server` + `.well-known/oauth-protected-resource`, exposes `auth.api.getMcpSession()` for protected-resource validation
 - Account linking with policies (verified-email match + reauth requirement)
 
-Better Auth depends on a Kysely / Drizzle / Prisma adapter for the database, not on any Cloudflare-specific service. The auth machinery becomes platform-agnostic — porting to Netlify / Bun / Deno is config-only.
+Better Auth depends on a Kysely / Drizzle / Prisma adapter for the database, not on any Cloudflare-specific service. The auth machinery remains platform-agnostic.
 
 ## Decision (historical baseline; amended below)
 
@@ -64,7 +64,7 @@ Adopt Better Auth as the SDK's full auth surface. It owns:
 
 The auth runtime stops being an adapter port. `OAuthVerifier` port + `WorkersOAuthVerifier` adapter are deleted. Validating bearer tokens at `/mcp` and `/staff/mcp` becomes `auth.api.getMcpSession(req.raw)` — a direct Better Auth API call, no port indirection.
 
-This makes the runtime more platform-agnostic, not less: Better Auth runs on Workers (D1 via Kysely), Bun (sqlite), Node (postgres) without code changes. Future Netlify / partner adapters get the auth surface for free.
+This makes the runtime more platform-agnostic, not less: Better Auth runs on Workers (D1 via Kysely), Bun (sqlite), and Node (postgres) without runtime changes.
 
 ### 2. `staff` table → `user.role` via Better Auth admin plugin
 
@@ -81,23 +81,18 @@ admin({
 
 The manifest grammar predicate `requires.auth.all: [{ "ctx.staff": ["editor"] }]` evaluates against `session.user.role` at runtime. Closed enum membership unchanged.
 
-What we lose: `grantedBy` / `grantedAt` audit trail. v0.1.0 doesn't need this; v0.1.x can re-add via `additionalFields` on user, or via a separate append-only `staff_audit_log` table.
+### 3. Two explicit MCP surfaces
 
-### 3. Two MCP routes, surface-derived from manifest predicate
-
-`/mcp` and `/staff/mcp` are mounted side-by-side from boot. v0.1.0 ships the conservative partition: `/staff/mcp` exposes all staff authoring/lifecycle tools and requires `mcp:staff` plus an admin role; `/mcp` exposes only read-only `query_view_<name>` tools and requires `mcp:read`. The v0.2+ extension point is **automatic** surface partition derived from each Procedure's `requires.auth.all` predicate:
-
-```
-predicate contains ctx.staff: [...]    → tool exposed on /staff/mcp only
-predicate only ctx.user / no predicate → tool exposed on /mcp only
-```
+`/mcp` and `/staff/mcp` are mounted side-by-side from boot. `/staff/mcp`
+exposes staff authoring/lifecycle tools and `/mcp` exposes declared public
+Views and Procedures. An MCP Trigger explicitly chooses `surface: public |
+staff`; the target's `requires.auth` still gates every call.
 
 Tool partition rules:
 
 - Per-collection auto-emitted authoring tools (`create_draft_<schema>`, `update_draft_<schema>`) — predicate baked-in to require `ctx.staff: [contributor+]`; route to `/staff/mcp`
 - `list_entries` / `get_entry` / `request_publish` / `archive_entry` / `unpublish_entry` — staff-only (return drafts, mutate state); `/staff/mcp` only
-- `query_view_<name>` (auto-emitted from each parsed View, mirroring the existing `/api/views/<name>` REST shape) — public; `/mcp` only
-- v0.2 community / v0.2.x fan-club user-facing writes (comment, reaction, subscribe, ...) — predicate `ctx.user` or `ctx.user.subscription`; `/mcp`
+- `query_view_<name>` follows `View.spec.surface`.
 
 ### 4. Scope-aware DCR via Better Auth `oauthProvider`
 
@@ -140,7 +135,7 @@ The token can carry `role` via `customAccessTokenClaims` for caller convenience,
 
 ### 6. Single auth surface, no port indirection
 
-Auth is no longer an adapter port. `mantle-runtime` does NOT define an auth port and `createCmsRuntime()` does not accept auth. Adapter packages (`mantle-cloudflare`, future `mantle-netlify`) construct the Better Auth instance with the right database adapter for their platform and keep it in the adapter-owned HTTP/MCP mount layer.
+Auth is no longer an adapter port. `mantle-runtime` does NOT define an auth port and `createCmsRuntime()` does not accept auth. Adapter packages construct the Better Auth instance with the right database adapter for their platform and keep it in the adapter-owned HTTP/MCP mount layer.
 
 The adapter uses Better Auth to validate sessions, MCP bearer tokens, scopes, and roles, then passes authenticated user/staff context into runtime dispatchers. Better Auth remains platform-agnostic, but it is not a runtime dependency.
 
@@ -188,7 +183,7 @@ This makes the implicit explicit. The SDK's auth surface is committee-curated; u
 
 ### 8. Path to `@aotter/mantle-better-auth` separate package (deferred)
 
-When `mantle-netlify` lands, the Better Auth wiring moves to its own package. Today the seam is in place:
+Each adapter owns its Better Auth wiring. Today the seam is:
 
 - `Auth` interface lives in the adapter (could move to runtime or a separate package without breaking the contract — adapters consume the type, not the implementation).
 - `createAuth.ts` is the only file with `import { betterAuth }` (~290 LOC, no Cloudflare-binding-specific code outside `config.database: D1Database`).
@@ -201,10 +196,10 @@ The future split looks like:
 @aotter/mantle-runtime           ← ports + use cases (today)
 @aotter/mantle-better-auth       ← createAuth + EmailSender impls + appleClientSecret (new, when needed)
 @aotter/mantle-cloudflare        ← Workers adapter; depends on (or accepts) Auth-shape (today)
-@aotter/mantle-netlify           ← Netlify adapter; same shape (v0.2)
+future adapter                   ← same contract, implemented when needed
 ```
 
-The pivot point — when to extract — is when the second adapter (`mantle-netlify`) needs the same wiring. Until then, in-place co-location is cheaper than a new package boundary.
+The pivot point — when to extract — is when a second adapter needs the same wiring. Until then, in-place co-location is cheaper than a new package boundary.
 
 ## Consequences
 
@@ -241,7 +236,6 @@ The pivot point — when to extract — is when the second adapter (`mantle-netl
 - `databaseHooks.user.create.after` for `ensureBootstrapOwner` semantics
 - Two `/.well-known/oauth-protected-resource/*` metadata endpoints (Better Auth helpers)
 - Public View MCP tools: dispatcher emits `query_view_<name>` on `/mcp`.
-- Future manifest grammar tools: dispatcher will read `Procedure.requires.auth.all` to route user-facing tools to `/mcp` or `/staff/mcp`.
 - Skills + docs updates for the dual MCP URL handoff
 
 ### Backward compatibility
@@ -263,20 +257,9 @@ User MCP URL:   https://<worker>.workers.dev/mcp           (give to visitors / t
 The publication starter repo's production smoke recipe uses `/mcp/staff`
 for the MCP operator smoke step.
 
-### Future-proof for v0.2
-
-The end-user MCP via DCR + role-gated content (community / fan-club) requires no architectural change — just:
-
-- Enable Better Auth `socialProviders.google` / `.apple` (config-only)
-- Enable `magicLink` and `emailOTP` plugins (config + `EmailSender` wiring already in place)
-- Promote DRAFT manifest grammar from POC ADR-0005 — `Schema.spec.policies.readable: ctx.user` and `requires.auth.all: [{ ctx.user.subscription: [premium] }]`
-- Add `additionalFields: { subscriptionTier: ... }` on user when Stripe entitlement lands
-
-No config flag flips, no surface migration. The dispatcher partition rule (predicate → surface) handles new tool emission automatically.
-
 ### Platform agnosticism
 
-By removing `@cloudflare/workers-oauth-provider` and routing auth through Better Auth, the SDK no longer depends on any CF-specific auth service. A future Netlify adapter constructs a Better Auth instance backed by a Netlify-compatible D1 / postgres / sqlite database; the rest of the runtime + dispatcher + skills + prompts work unchanged. ADR-0011 (adapter port spec) is amended: the `OAuthVerifier` port disappears; auth becomes a direct constructor argument with platform-agnostic Better Auth as the type.
+By removing `@cloudflare/workers-oauth-provider` and routing auth through Better Auth, the SDK no longer depends on any CF-specific auth service. A future adapter can construct Better Auth against its database while the runtime + dispatcher + skills + prompts stay unchanged. ADR-0011 (adapter port spec) is amended: the `OAuthVerifier` port disappears; auth becomes adapter-owned, with platform-agnostic Better Auth as the type.
 
 ## Alternatives considered
 
@@ -346,13 +329,6 @@ Phase 2 (v0.1.x):
 - Magic-link + email-OTP plugins enabled (need `ResendEmailSender` wired)
 - Account-linking with reauth UI in publication starter
 
-Phase 3 (v0.2+, with community / fan-club):
-
-- POC ADR-0005 DRAFT grammar promotion: `Schema.spec.policies.readable`, `requires.auth.all: ctx.user.subscription[*]`
-- Subscription tier on user (`additionalFields`)
-- Stripe webhook → entitlement updater
-- Community / fan-club starter manifests
-
 ## How to apply
 
 When reviewing or implementing a change that touches auth, MCP routing, or roles:

package/docs/adr/README.md

@@ -12,7 +12,7 @@ Records of *why* mantle ended up shaped this way. The numbering preserves POC AD
 | [0008](0008-structured-diagnostic-shape.md) | Diagnostic shape for validate/boot/runtime failures, with a reserved consumer-test phase; measured harnesses keep purpose-shaped reports. | Accepted + amended |
 | [0009](0009-consumer-supplied-manifests.md) | Consumers own manifest YAML; the installed CLI emits the parser-free runtime module and handler types. Core ships no application manifests. | Accepted + amended |
 | [0010](0010-locale-and-translates.md) | Locale 3-layer (manifest / D1 site_config / data field) + translates pattern. Boot decoupled from `site_config` (issue #60 fix). | Accepted (refreshed) |
-| [0011](0011-adapter-port-spec.md) | Adapter port spec. Required runtime ports plus optional feature ports. CF impl + Netlify stub. | Accepted (new) |
+| [0011](0011-adapter-port-spec.md) | Adapter port spec. Required runtime ports plus optional feature ports. | Accepted (new) |
 | [0012](0012-views-as-public-rest.md) | Views auto-expose matching REST and `query_view_*` MCP reads on their declared `public` or `staff` surface. Schemas never get a public REST endpoint. | Accepted + amended |
 | [0013](0013-agent-provisioned-consumer-projects.md) | Historical agent-provisioned consumer projects path. Superseded for first launch by landing provision bundles. | Superseded |
 | [0014](0014-auth-better-auth-and-multi-tenant-mcp.md) | The Cloudflare adapter owns the curated Better Auth identity/session facade and top-level `@cloudflare/workers-oauth-provider` MCP transport. Both normalize verified callers into runtime context; mutable staff role and target authorization are re-evaluated per call. | Accepted + amended |
@@ -39,12 +39,12 @@ for new v0.1.0 boundaries, and folds / drops the rest:
 
 - **POC ADR-0003** OpenAPI emission → folded into `mantle-spec` README (the *what* is implementation; the *why* was already captured by ADR-0001's grammar lock).
 - **POC ADR-0004** D1 today, Hyperdrive PG tomorrow → folded into `mantle-cloudflare` README (now a v0.2 roadmap item, not an architectural decision).
-- **POC ADR-0005** v0.1 minimum vs DRAFT discipline → folded into ADR-0001 §"Future grammar discipline."
+- **POC ADR-0005** v0.1 minimum grammar → folded into ADR-0001's fail-closed grammar policy.
 - **POC ADR-0006** multi-doc YAML → folded into ADR-0001 §"Authoring shape: multi-doc YAML."
-- **POC ADR-0011** lifecycle binary opt-in → distilled to a §"Lifecycle" subsection in `docs/design-atoms.md`. v0.1.0 ships `simple` only; `editorial` is a v0.1.x feature.
+- **POC ADR-0011** lifecycle binary opt-in → distilled to a §"Lifecycle" subsection in `docs/design-atoms.md`. v0.1.0 ships `publishing` and `operational`.
 - **POC ADR-0012** strategic posture vs adjacent CMS designs → strategic / marketing material, lives in `README.md` if anywhere.
 - **POC ADR-0013** role-split surfaces (coder agent vs operator agent) → folded into ADR-0007 (Part B).
-- **POC ADR-0014** builtin handlers and lifecycle Triggers → promoted to v0.1.0 and implemented in the rebuild via `LifecycleHookingEntryRepository` and `InvokeBuiltinUseCase`. Editorial lifecycle remains v0.1.x-gated. Full shape spec lives in `docs/design-atoms.md`.
+- **POC ADR-0014** builtin handlers and lifecycle Triggers → promoted to v0.1.0 and implemented in the rebuild via `LifecycleHookingEntryRepository` and `InvokeBuiltinUseCase`. Full shape spec lives in `docs/design-atoms.md`.
 - **POC ADR-0015** cms-astro internal seam discipline → POC-specific to a package that no longer exists; replaced by ADR-0011 (adapter port spec).
 - **POC ADR-0029** drop Astro from cms-cloudflare → POC-specific historical record; the rebuild starts post-Astro.
 

package/docs/api-mcp-authorization.md

@@ -78,6 +78,63 @@ Missing/invalid credentials return `401`; a verified caller missing a required
 role or scope returns `403`; a site guard may return
 `ENTITLEMENT_REQUIRED`/`402`. Guards run on every call and are not cached.
 
+### Identity-bound Views
+
+Use the closed `{ "$ctx.user": "id" }` filter sentinel for rows owned by the
+current site-local Better Auth user. The caller never supplies this value, so
+the same View is safe on both REST and public MCP:
+
+```yaml
+apiVersion: cms.mantle.aotter.net/v1
+kind: Schema
+metadata: { name: orders }
+spec:
+  schema:
+    type: object
+    properties:
+      userId: { type: string, x-mantle-bind: ctx.user }
+      orderNumber: { type: string }
+      orderStatus: { type: string }
+      totalMinor: { type: integer }
+      placedAt: { type: integer }
+  indexes: [[userId, placedAt]]
+---
+apiVersion: cms.mantle.aotter.net/v1
+kind: View
+metadata: { name: my-orders }
+spec:
+  surface: public
+  from: orders
+  requires:
+    auth:
+      all: [ctx.user]
+  filter:
+    and:
+      - { eq: { field: status, value: published } }
+      - { eq: { field: userId, value: { "$ctx.user": id } } }
+  fields: [orderNumber, orderStatus, totalMinor, placedAt]
+  orderBy: [{ field: placedAt, direction: desc }]
+  limit: 50
+```
+
+Core rejects this sentinel unless the View requires `ctx.user` and the bound
+field is the leftmost field of a declared Schema index. Missing identity fails
+with `401`; it never drops the filter or falls back to all rows. REST exposes
+`GET /api/views/my-orders`; public MCP exposes `query_view_my_orders`. Both
+call `ExecuteViewUseCase` and bind the same `ctx.user.id`.
+
+The id belongs to the customer site's Better Auth user row. It is not a
+Mantle Platform user id, Hosted Auth upstream subject, email, or provider id.
+Hosted Auth may establish the site session, but Platform is not part of the
+View query path.
+
+## Site OAuth symmetry
+
+A site-issued OAuth access token represents the same caller on public MCP and
+manifest HTTP routes. Both surfaces populate `ctx.user` and `ctx.auth` from the
+same token grant; expiry, revocation, scope, client, and resource audience are
+enforced before the Procedure or View runs.
+
 ## Cloudflare consumer wiring
 
 Pass one site-owned resolver to `createCmsRef`. Return `not-handled` when the
@@ -173,7 +230,6 @@ import {
   createMcpApiHandler,
   createOAuthProvider,
   D1DatabaseDriver,
-  KvCacheBinding,
   mountServerEndpoints,
 } from "@aotter/mantle/cloudflare";
 
@@ -182,7 +238,6 @@ const runtimeRef = createCmsRef({
   handlers,
   bindings: {
     db: new D1DatabaseDriver(env.DB),
-    kv: new KvCacheBinding(env.KV),
     assets: env.ASSETS
       ? new AssetsAssetServer(env.ASSETS)
       : { fetch: async () => null },

package/docs/cloudflare-low-level-composition.md

@@ -72,7 +72,7 @@ function assemble(env: Env) {
 }
 ```
 
-Keep the conventional `DB`, `KV` and `OAUTH_KV` bindings and
+Keep the conventional `DB` and `OAUTH_KV` bindings and
 `nodejs_compat`; add the Queue producer in `wrangler.jsonc`:
 
 ```jsonc

package/docs/deferred-lifecycle-queues.md

@@ -103,7 +103,6 @@ import type { DeferredHookEnvelope } from "@aotter/mantle/runtime";
 import {
   AssetsAssetServer,
   D1DatabaseDriver,
-  KvCacheBinding,
   WorkersQueueHookDispatcher,
   createCmsRef,
   createQueueHandler,
@@ -112,7 +111,6 @@ import {
 
 interface Env {
   DB: D1Database;
-  KV: KVNamespace;
   ASSETS: Fetcher;
   MANTLE_INTERNAL_QUEUE: Queue<DeferredHookEnvelope>;
 }
@@ -124,7 +122,6 @@ function buildWorker(env: Env) {
     auth: createSiteAuth(env),
     bindings: {
       db: new D1DatabaseDriver(env.DB),
-      kv: new KvCacheBinding(env.KV),
       assets: new AssetsAssetServer(env.ASSETS),
       deferredHookDispatcher: new WorkersQueueHookDispatcher(
         env.MANTLE_INTERNAL_QUEUE,