rcf-lite 0.25.0 → 0.27.0

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6121.json

@@ -11,21 +11,23 @@
   "acceptanceCriteria": [
     {
       "id": "AC-6121-1",
-      "description": "When `workflowShape.releaseMode` is `none`, the workflow-materialiser writes no `release` workflow file to the provider's workflow path. A project with no release path does not ship a workflow.",
+      "description": "When `workflowShape.releaseMode` is `none`, the workflow-materialiser writes no `release` workflow file to the provider's workflow path. A project with no release path does not ship a workflow. Template values the applying agent sets: The applying agent sets the workflowShape elicits (checkSet, branchModel, releaseMode, scheduledAudit, providerHint); the AC substitutes the project's declaration for the illustrative shape values.",
       "given": "a `workflowShape` with `releaseMode: none`",
       "when": "the workflow-materialiser runs",
       "then": "no `release` workflow file is created at the provider's workflow path and no `.rcf/reports/ci/release.json` file is written",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-6121-2",
-      "description": "When `releaseMode` is `tagOnly`, the release workflow fires on a release trigger and creates a release entity on the CI provider's own release surface. No artefact-publish step ships. When `tagPlusArtefact`, the release workflow additionally runs the project-realised artefact-publish step and uploads its output to the release entity.",
+      "description": "When `releaseMode` is `tagOnly`, the release workflow fires on a release trigger and creates a release entity on the CI provider's own release surface. No artefact-publish step ships. When `tagPlusArtefact`, the release workflow additionally runs the project-realised artefact-publish step and uploads its output to the release entity. Template values the applying agent sets: The applying agent sets the workflowShape elicits (checkSet, branchModel, releaseMode, scheduledAudit, providerHint); the AC substitutes the project's declaration for the illustrative shape values.",
       "given": "a `workflowShape` with `releaseMode: tagPlusArtefact` and a realised artefact-publish step",
       "when": "a release trigger fires",
       "then": "the release workflow creates the release entity, runs the artefact-publish step, uploads the published artefact to the release entity, and records the just-published version identifier in the aggregate report",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-6121-3",
@@ -34,7 +36,22 @@
       "when": "the release trigger fires",
       "then": "the release workflow does not invoke the gate-runner entry point and the `pipeline.json` at the same commit remains the record of the check set outcome",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-6121-4",
+      "description": "A failed release entity creation step (a tag write refused, a release API rejection, a permissions error) fails the release aggregate with a stable-coded RELEASE_CREATE_FAILED naming the step and the provider response; downstream publication and promote steps do not run. Template values the applying agent sets: The applying agent supplies the elicited providerHint and releaseMode; the AC substitutes them for the illustrative GHA / tagOnly.",
+      "given": "a release workflow at releaseMode=tagOnly with the provider forced to return 4xx on the tag write",
+      "when": "the release workflow runs",
+      "then": "the release aggregate is failed with RELEASE_CREATE_FAILED naming the create step and the provider status; no downstream publication step runs; the workflow exit code is non-zero",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-705-delivery-ci-workflows-release-workflow",
+        "field": "internalStructure"
+      }
     }
   ],
   "tacIds": [
@@ -42,5 +59,5 @@
     "TAC-705-delivery-ci-workflows-release-workflow"
   ],
   "createdAt": "2026-08-31T00:00:00Z",
-  "updatedAt": "2026-08-31T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6122.json

@@ -11,30 +11,47 @@
   "acceptanceCriteria": [
     {
       "id": "AC-6122-1",
-      "description": "When `workflowShape.releaseMode` is `deployHandoff:<slug>` and the named deploy blueprint is present in `manifest.blueprints[]`, the release workflow invokes the deploy blueprint's `promote` workflow via `workflow_dispatch` after the artefact-publish step succeeds. The invocation passes the just-published version identifier as the `versionId` input.",
+      "description": "When `workflowShape.releaseMode` is `deployHandoff:<slug>` and the named deploy blueprint is present in `manifest.blueprints[]`, the release workflow invokes the deploy blueprint's `promote` workflow via `workflow_dispatch` after the artefact-publish step succeeds. The invocation passes the just-published version identifier as the `versionId` input. Template values the applying agent sets: The applying agent sets the workflowShape elicits (checkSet, branchModel, releaseMode, scheduledAudit, providerHint); the AC substitutes the project's declaration for the illustrative shape values.",
       "given": "a `workflowShape` with `releaseMode: deployHandoff:deploy-cloudflare-workers`, the named deploy blueprint applied, and an artefact-publish step that succeeded",
       "when": "the release trigger fires",
       "then": "the release workflow dispatches the promote workflow with `versionId` set to the just-published version identifier and waits on the promote workflow's outcome",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-6122-2",
-      "description": "The release workflow's aggregate outcome is `passed` only when the promote workflow's outcome is `passed`. A failed promote workflow flips the release workflow's aggregate to `failed`.",
+      "description": "The release workflow's aggregate outcome is `passed` only when the promote workflow's outcome is `passed`. A failed promote workflow flips the release workflow's aggregate to `failed`. Template values the applying agent sets: The applying agent sets the elicited deployHandoff target blueprint name; the AC substitutes that name for the illustrative slug.",
       "given": "a release workflow in `deployHandoff` mode whose promote workflow returned a failed outcome",
       "when": "the release workflow aggregates its outcome",
       "then": "the release workflow's aggregate report at `.rcf/reports/ci/release.json` records `verdict: failed` and names the promote workflow's failure in its `gates[]` array",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-6122-3",
-      "description": "When `releaseMode` is `deployHandoff:<slug>` and the named deploy blueprint is not present in `manifest.blueprints[]`, the workflow-materialiser boot-check refuses with a stable-coded error naming the missing blueprint slug and pointing at `rcf define blueprint add <deploy-slug>`.",
+      "description": "When `releaseMode` is `deployHandoff:<slug>` and the named deploy blueprint is not present in `manifest.blueprints[]`, the workflow-materialiser boot-check refuses with a stable-coded error naming the missing blueprint slug and pointing at `rcf define blueprint add <deploy-slug>`. Template values the applying agent sets: The applying agent sets the workflowShape elicits (checkSet, branchModel, releaseMode, scheduledAudit, providerHint); the AC substitutes the project's declaration for the illustrative shape values.",
       "given": "a `workflowShape` with `releaseMode: deployHandoff:deploy-cloudflare-workers` and no such blueprint in the manifest",
       "when": "the workflow-materialiser boots",
       "then": "the materialiser exits non-zero with a stable-coded error naming the missing slug and pointing at the resolution command, and no release workflow file lands on disk",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-6122-4",
+      "description": "A failed artefact publication step (a checksum mismatch, an upload rejection, a permissions error) fails the release aggregate with a stable-coded RELEASE_PUBLISH_FAILED naming the artefact and the provider response; the deployHandoff promote workflow is not invoked. Template values the applying agent sets: The applying agent supplies the elicited providerHint, releaseMode and artefact set; the AC substitutes those.",
+      "given": "a release workflow at releaseMode=tagPlusArtefact with the artefact upload forced to fail on a specific artefact",
+      "when": "the release workflow runs",
+      "then": "the release aggregate is failed with RELEASE_PUBLISH_FAILED naming the artefact and the provider response; no promote step runs; the workflow exit code is non-zero",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-705-delivery-ci-workflows-release-workflow",
+        "field": "interfaces.runRelease"
+      }
     }
   ],
   "tacIds": [
@@ -42,5 +59,5 @@
     "TAC-705-delivery-ci-workflows-release-workflow"
   ],
   "createdAt": "2026-08-31T00:00:00Z",
-  "updatedAt": "2026-08-31T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6123.json

@@ -11,21 +11,37 @@
   "acceptanceCriteria": [
     {
       "id": "AC-6123-1",
-      "description": "When `workflowShape.scheduledAudit` is `true`, the workflow-materialiser produces a `scheduled-audit` workflow triggered by the provider's cron surface, running the same required check set the pull-request and default-branch workflows run. The aggregate report writes to `.rcf/reports/ci/scheduled-audit.json` (distinct from the commit-triggered `pipeline.json`).",
+      "description": "When `workflowShape.scheduledAudit` is `true`, the workflow-materialiser produces a `scheduled-audit` workflow triggered by the provider's cron surface, running the same required check set the pull-request and default-branch workflows run. The aggregate report writes to `.rcf/reports/ci/scheduled-audit.json` (distinct from the commit-triggered `pipeline.json`). Template values the applying agent sets: The applying agent sets the workflowShape elicits (checkSet, branchModel, releaseMode, scheduledAudit, providerHint); the AC substitutes the project's declaration for the illustrative shape values.",
       "given": "a `workflowShape` with `scheduledAudit: true`",
       "when": "the workflow-materialiser runs",
       "then": "a `scheduled-audit` workflow file lands at the provider's workflow path, its trigger set names a cron schedule, and its command line invokes the Node gate-runner entry point with the required check set writing to the distinct report path",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-6123-2",
-      "description": "When `scheduledAudit` is `false` or absent, no scheduled workflow ships and no `.rcf/reports/ci/scheduled-audit.json` file path is populated.",
+      "description": "When `scheduledAudit` is `false` or absent, no scheduled workflow ships and no `.rcf/reports/ci/scheduled-audit.json` file path is populated. Template values the applying agent sets: The applying agent sets the workflowShape elicits (checkSet, branchModel, releaseMode, scheduledAudit, providerHint); the AC substitutes the project's declaration for the illustrative shape values.",
       "given": "a `workflowShape` with `scheduledAudit` absent (default `false`)",
       "when": "the workflow-materialiser runs",
       "then": "no `scheduled-audit` workflow file is created and no `.rcf/reports/ci/scheduled-audit.json` file path is written",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-6123-3",
+      "description": "The scheduled-audit workflow refuses to write when the check-set is empty (a workflowShape with scheduled-audit=on but checkSet all-false): the materialiser emits SCHEDULED_AUDIT_EMPTY_CHECKSET naming the empty checkSet; no cron workflow is written. Template values the applying agent sets: The applying agent sets the elicited workflowShape (scheduledAudit and checkSet); the AC substitutes the project's workflowShape for the illustrative scheduled-audit-on with checkSet all-false case.",
+      "given": "a workflowShape with scheduled-audit=on and every checkSet flag false",
+      "when": "the materialiser runs",
+      "then": "the materialiser exits with SCHEDULED_AUDIT_EMPTY_CHECKSET; no scheduled-audit.yml is written",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-706-delivery-ci-workflows-scheduled-audit",
+        "field": "interfaces.runScheduledAudit"
+      }
     }
   ],
   "tacIds": [
@@ -33,5 +49,5 @@
     "TAC-706-delivery-ci-workflows-scheduled-audit"
   ],
   "createdAt": "2026-08-31T00:00:00Z",
-  "updatedAt": "2026-08-31T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6124.json

@@ -11,12 +11,27 @@
   "acceptanceCriteria": [
     {
       "id": "AC-6124-1",
-      "description": "The illustrative pull-request-checks.yml under blueprints/delivery-ci-workflows/assets/ci-provider-examples/github-actions/ carries a documented e2e job block whose header comment names the four points a browser-facing project's e2e job satisfies: (a) runs the project's testLevel: e2e cases against a local preview or a --parity-env runtime, (b) uploads screenshots and HTML captures as workflow artefacts, (c) writes a distinct row to the aggregate pipeline report at .rcf/reports/ci/pipeline.json, (d) writes a per-gate report at .rcf/reports/ci/e2e.json with checkKind: 'e2e'. The header also tells a non-browser project to delete the e2e job before committing. The elicited checkSet.e2e entry exists in the delivery-ci-workflows check catalogue (blueprint.json) so a project that turns the check off does so through a supported knob. The runtime iff wiring (materialiser adds or omits the job based on manifest.blueprints[].source.browserSurface.declared and .rcf/config/delivery-ci-workflows.json:checkSet.e2e) lands in a follow-up train with its own TS entry; this AC is documentation-only per spec amendment A2 (2026-09-03).",
+      "description": "The illustrative pull-request-checks.yml under blueprints/delivery-ci-workflows/assets/ci-provider-examples/github-actions/ carries a documented e2e job block whose header comment names the four points a browser-facing project's e2e job satisfies: (a) runs the project's testLevel: e2e cases against a local preview or a --parity-env runtime, (b) uploads screenshots and HTML captures as workflow artefacts, (c) writes a distinct row to the aggregate pipeline report at .rcf/reports/ci/pipeline.json, (d) writes a per-gate report at .rcf/reports/ci/e2e.json with checkKind: 'e2e'. The header also tells a non-browser project to delete the e2e job before committing. The elicited checkSet.e2e entry exists in the delivery-ci-workflows check catalogue (blueprint.json) so a project that turns the check off does so through a supported knob. The runtime iff wiring (materialiser adds or omits the job based on manifest.blueprints[].source.browserSurface.declared and .rcf/config/delivery-ci-workflows.json:checkSet.e2e) lands in a follow-up train with its own TS entry; this AC is documentation-only per spec amendment A2 (2026-09-03). Template values the applying agent sets: The applying agent sets the workflowShape elicits (checkSet, branchModel, releaseMode, scheduledAudit, providerHint); the AC substitutes the project's declaration for the illustrative shape values.",
       "given": "the delivery-ci-workflows blueprint at v2.2.0",
       "when": "blueprints/delivery-ci-workflows/assets/ci-provider-examples/github-actions/pull-request-checks.yml and blueprint.json are inspected",
       "then": "the illustrative pull-request-checks.yml declares an e2e job; the block above it names the four points and the delete-me note for non-browser projects; blueprint.json's check catalogue carries checkSet.e2e",
       "testable": true,
-      "scope": "library"
+      "scope": "library",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-6124-2",
+      "description": "A project with `checkSet.e2e: true` but no application-spa (or other browserSurface-declaring) blueprint applied fails materialise with E2E_CHECK_UNBACKED naming the missing browserSurface. Prevents shipping an e2e job without an application under test. Template on the elicited checkSet. Template values the applying agent sets: The applying agent sets the elicited workflowShape.checkSet (specifically the e2e flag) and the applied blueprint set; the AC substitutes them for the illustrative checkSet.e2e=true paired with no browserSurface-declaring blueprint.",
+      "given": "a workflowShape with checkSet.e2e=true and no applied blueprint declaring a browserSurface",
+      "when": "the materialiser runs",
+      "then": "the materialiser exits with E2E_CHECK_UNBACKED naming the missing browserSurface; no e2e job is written into the pull-request-checks workflow",
+      "testable": true,
+      "scope": "library",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-704-delivery-ci-workflows-workflow-materialiser",
+        "field": "interfaces.materialise"
+      }
     }
   ],
   "tacIds": [
@@ -24,5 +39,6 @@
     "TAC-702-delivery-ci-workflows-gate-report"
   ],
   "createdAt": "2026-09-03T17:00:00Z",
-  "updatedAt": "2026-09-03T18:30:50Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "description": "Section 7a floor: two ACs. Per spec amendment A2 (2026-09-03) this story is documentation-only at v2.3.0; the runtime iff wiring lands in a follow-up train. Guide and TAC-701 name no e2e-specific runtime failure paths beyond the E2E_CHECK_UNBACKED refusal bound by AC-6124-2; runner-missing and gate-aggregation gaps route generically through AC-6102-3 and AC-6108-1 when the runtime wiring lands."
 }

package/blueprints/delivery-ci-workflows/docs/topics.md

@@ -60,7 +60,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/deploy-cloudflare-workers/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 1.3.2 (register patch, 2026-09-10)
+
+- Register: neutral wording on the ADR-1306 consequences field (closes F-1); no capability change.
+
+## 1.3.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.3.0 - 2026-09-09
+
+Adds deliveredBy on nine REQs (001, 003, 005, 006, 007, 010, 011, 013, 014). Adds ownerRef on AC-12102-2/3 and AC-12109-1 (deployAdapter) and AC-12105-1 (productionUrl). Closes chain-contradiction specimens F-1 (AC-12101-4 rewritten around the boolean run_worker_first = true form; vendor citation https://developers.cloudflare.com/workers/static-assets/binding/ verified 2026-09-09), F-2 (TAC-1302 gains responsibilities for the [assets].directory branches, the boolean and array-of-patterns run_worker_first mappings, and the pages_build_output_dir mutual-exclusion refusal), and F-5 (REQ-002 and TAC-1301 gain the stable deployStatus verb that composes production URL, preview alias URL, and currently serving version id). Closes chain-contradiction on per-version-id (ADR-1303 spelling aligned with TAC-1303). Adds disposition to every AC.
+
 All notable changes to the `deploy-cloudflare-workers` blueprint are recorded here.
 The format follows Keep a Changelog. Versions are semver, per
 `packages/rcf-lite/docs/blueprint-authoring.md` section 6.
@@ -65,5 +77,8 @@ Notes
 - `suggestedCompanions` unchanged (`logging`, `errorHandling`).
 - The shared `cf-platform` sample-app fixture at
   `packages/rcf-lite/test/fixtures/cf-platform/` ships alongside this
-  bump as the probe target. T-1 (KV), T-2 (cron), T-3 (Durable Objects)
-  and T-5's Turnstile sub-fixture extend the same fixture later.
+  bump as the probe target. This blueprint mints the fixture; the KV,
+  cron and Durable Objects blueprints, and the Turnstile sub-fixture,
+  extend the same fixture later.
+
+Review-fix (2026-09-09): Widens the run-worker-first elicit from kind boolean to kind string so both wrangler-side shapes accepted by the Cloudflare Workers static-assets binding (the boolean form and the array-of-patterns form) round-trip through the operator surface without silent narrowing. TAC-1302 responsibility 8 is rewritten to name both shapes with the emitted wrangler literal for each. Adds AC-12113-4 binding the array-of-patterns form on US-12113 with vendorCitation, and adds vendorCitation to AC-12113-2 (boolean form). README and guide teach both shapes. Adds deliveredBy on REQ-002, REQ-004, REQ-008, REQ-009, REQ-012. Sweeps vendorCitation onto fixed ACs resting on vendor facts (AC-12102-2, AC-12102-3, AC-12108-1, AC-12108-3, AC-12111-1, AC-12112-3).

package/blueprints/deploy-cloudflare-workers/README.md

@@ -50,9 +50,9 @@ v1.2.0 is an additive-minor bump. Every shipped v1.1.0 contribution carries thro
 
 - **Workers-with-static-assets shape (`REQ-013`, `REQ-014`).** Two new REQs cover the `[assets] directory` block on `wrangler.toml` and the SPA fallback discipline via `run_worker_first`. Three new USs in the existing 12xx band (`US-12113` SPA-on-Workers deploy, `US-12114` assets-directory elicitation, `US-12115` migrate-from-Pages guidance) bind the runtime-observable ACs to `TAC-1302-deploy-cloudflare-workers-wrangler-manifest`.
 - **Ratified shape decision (`ADR-1306-deploy-cloudflare-workers-spa-shape`).** Body carries the Cloudflare landing-page quote verbatim; the contribution entry carries `recommendedDefault: true` and `standardsTraceClause: Cloudflare Pages landing-page recommendation (2026-09-06)` per `blueprint-authoring.md` section 8a.2. The ADR names a project-level supersede path for projects that keep the bare-Worker shape or stay on Pages.
-- **Two new elicits.** `assets-directory` (kind `string`, default empty) picks the static-assets root; `run-worker-first` (kind `boolean`, default `false`) picks the SPA fallback discipline. The loader-side `when-elicitedNonEmpty` predicate the spec calls for is a mechanism follow-up, so `run-worker-first` fires unconditionally in v1.2.0; the guide teaches that the elicit is only meaningful when `assets-directory` is non-empty.
+- **Two new elicits.** `assets-directory` (kind `string`, default empty) picks the static-assets root; `run-worker-first` (kind `string`, default `"false"`) picks the SPA fallback discipline and accepts both wrangler-side shapes the Cloudflare Workers static-assets binding page documents (https://developers.cloudflare.com/workers/static-assets/binding/, verified 2026-09-09): the boolean form as `"true"` / `"false"` and the array-of-patterns form as a JSON literal such as `["/api/*", "!/api/docs/*"]` (at most 100 entries; glob `*` for deep matching; leading `!` for negatives; negatives take precedence). The loader-side `when-elicitedNonEmpty` predicate the spec calls for is a mechanism follow-up, so `run-worker-first` fires unconditionally in v1.2.0; the guide teaches that the elicit is only meaningful when `assets-directory` is non-empty.
 - **Probe module (`contributions/probes/assets-manifest-scan.mjs`).** `accountBound: false`, `anchorAcId: AC-12113-1`. Source-tree parser reads the applied fixture's `wrangler.toml` and asserts the `[assets]` shape against the elicited answers; refuses on `pages_build_output_dir` presence anywhere on the manifest (the Workers-with-static-assets shape and the Pages shape are mutually exclusive per the Cloudflare static-assets doc).
-- **Shared sample-app fixture (`packages/rcf-lite/test/fixtures/cf-platform/`).** T-0 mints the fixture; T-1 (KV), T-2 (cron), T-3 (Durable Objects) and T-5's Turnstile sub-fixture extend it later. Ships `wrangler.toml` with the ratified `[assets]` block, `dist/index.html`, a minimal `src/index.mjs` Worker entry, `package.json` with `wrangler` as a devDependency and `wrangler dev` as the start script, a `run-assets-manifest-scan.mjs` shim wiring the probe against the fixture, and a `README.md` naming the manual `wrangler dev` boot line and the two induced-failure switches (`SIMULATE_MIXED_SHAPE`, `SIMULATE_EMPTY_ASSETS`). The fixture never binds port 4200.
+- **Shared sample-app fixture (`packages/rcf-lite/test/fixtures/cf-platform/`).** This blueprint mints the fixture; the KV, cron and Durable Objects blueprints, and the Turnstile sub-fixture, extend it later. Ships `wrangler.toml` with the ratified `[assets]` block, `dist/index.html`, a minimal `src/index.mjs` Worker entry, `package.json` with `wrangler` as a devDependency and `wrangler dev` as the start script, a `run-assets-manifest-scan.mjs` shim wiring the probe against the fixture, and a `README.md` naming the manual `wrangler dev` boot line and the two induced-failure switches (`SIMULATE_MIXED_SHAPE`, `SIMULATE_EMPTY_ASSETS`). The fixture never binds port 4200.
 
 A project on v1.1.0 picks up v1.2.0 with the same compose invocation; a fresh apply on a project answering both elicits reads the applied sidecar at `rcf/blueprints/deploy-cloudflare-workers.applied.json`. A project on Pages that wants to migrate reads the guide's new `Workers-with-static-assets: the SPA-on-Workers shape` section for the Cloudflare migrate-from-Pages link.
 

package/blueprints/deploy-cloudflare-workers/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "deploy-cloudflare-workers",
-  "version": "1.2.0",
+  "version": "1.3.2",
   "category": "deploy",
   "contributions": [
     {
@@ -228,9 +228,9 @@
     },
     {
       "id": "run-worker-first",
-      "prompt": "Run Worker first: whether the Worker fetch handler runs BEFORE static asset lookup for every request. True emits run_worker_first = true under the [assets] block (right for a SPA whose Worker owns arbitrary routing or whose auth middleware must gate every path). False (default) omits the field and lets Cloudflare's runtime serve a matching static asset before the Worker runs. Only meaningful when assets-directory is non-empty; the loader-side when-elicitedNonEmpty predicate is a mechanism follow-up.",
-      "kind": "boolean",
-      "default": false
+      "prompt": "Run Worker first: whether the Worker fetch handler runs BEFORE static asset lookup. Two accepted shapes per the Cloudflare Workers static-assets binding page (https://developers.cloudflare.com/workers/static-assets/binding/): (a) the boolean form as the literal string \"true\" or \"false\" (\"true\" emits `run_worker_first = true` under [assets], right for a SPA whose Worker owns arbitrary routing or whose auth middleware must gate every path; \"false\" or the empty string omits the field and lets Cloudflare's runtime serve a matching static asset before the Worker runs); (b) the array-of-patterns form as a JSON literal (for example, `[\"/api/*\", \"!/api/docs/*\"]`) that the manifest emits as `run_worker_first = [...]` under [assets] so the Worker runs first only on matched routes (glob `*` for deep matching; leading `!` for negative patterns; negative patterns take precedence; at most 100 entries per the vendor page). Only meaningful when assets-directory is non-empty.",
+      "kind": "string",
+      "default": "false"
     }
   ],
   "suggestedCompanions": [

package/blueprints/deploy-cloudflare-workers/contributions/adrs/adr-1303-deploy-cloudflare-workers-preview-vs-production.json

@@ -6,7 +6,7 @@
   "status": "accepted",
   "title": "Preview URLs (per-version-id + stable alias) and production URL are distinct addressable surfaces; the promote step is what changes which one production maps to",
   "context": "The failure mode this ADR closes is the collapsed URL: a project where the reviewer of a merged change and the visitor to the deployed application look at the same URL. When the preview surface and the production surface are the same string, every merge is a production act, review is what happens after users notice, and rollback is a second merge landing before enough users notice. The vendor's own primitive shape supports keeping them distinct: every uploaded version has a permanent per-version-id URL and a mutable stable-alias URL that can be pointed at the newest-of-main; production is the mapped custom domain (or the workers.dev production host) whose current version id changes only on an explicit deploy verb.",
-  "decision": "The blueprint mandates three URL kinds per Worker, all distinct hostnames, all discoverable through the Deploy Adapter's `deploy status` verb: (1) a per-VERSION-ID URL, unique per upload, permanent, useful for pinning a change-review link; (2) a STABLE PREVIEW ALIAS URL fixed to an operator-chosen alias string (the common default is `main`), always resolving to the newest-of-main uploaded version, useful for a persistent stakeholder-shareable link; (3) a PRODUCTION URL, declared under the wrangler manifest's `route`/`routes`/`workers_dev`/custom-domain stanza, changing which version it maps to only when a `promote` workflow runs. The Preview URL Resolver (TAC-1303) assembles the first two and refuses any alias string whose assembled host segment equals the production URL's host segment. The manifest loader refuses a wrangler config whose production route resolves to the preview alias URL host with `DEPLOY_URL_COLLAPSED`.",
+  "decision": "The blueprint mandates three URL kinds per Worker, all distinct hostnames, all discoverable through the Deploy Adapter's `deploy status` verb: (1) a per-version-id URL, unique per upload, permanent, useful for pinning a change-review link; (2) a STABLE PREVIEW ALIAS URL fixed to an operator-chosen alias string (the common default is `main`), always resolving to the newest-of-main uploaded version, useful for a persistent stakeholder-shareable link; (3) a PRODUCTION URL, declared under the wrangler manifest's `route`/`routes`/`workers_dev`/custom-domain stanza, changing which version it maps to only when a `promote` workflow runs. The Preview URL Resolver (TAC-1303) assembles the first two and refuses any alias string whose assembled host segment equals the production URL's host segment. The manifest loader refuses a wrangler config whose production route resolves to the preview alias URL host with `DEPLOY_URL_COLLAPSED`.",
   "consequences": "Reviewers and stakeholders reach the newest-of-main at a persistent, memorable URL that never masquerades as production. Users hit production at a hostname that only changes version behind an explicit operator act. Change-review links are pinnable to a specific version id and never rot. The trade is one Worker now surfaces three URLs the project has to reason about (and the operator has to explain once when a new engineer joins); the payoff is the class of leaks-through-collapsed-URL is closed by the manifest's own validation, not by discipline.",
   "alternativesConsidered": [
     {

package/blueprints/deploy-cloudflare-workers/contributions/adrs/adr-1306-deploy-cloudflare-workers-spa-shape.json

@@ -5,9 +5,9 @@
   "version": "1.2.0",
   "status": "accepted",
   "title": "Workers-with-static-assets is the ratified SPA-on-Workers deploy shape; Pages is a documented alternative held for legacy projects only",
-  "context": "Cloudflare ships two shapes for browsing static assets in front of a Workers-tier deploy target: Cloudflare Pages (a workflow-shaped product with its own build pipeline and its own preview URL model) and Workers-with-static-assets (a wrangler.toml [assets] block declaring a directory the Cloudflare runtime serves at the edge). Cloudflare's own Pages landing page states, verbatim (fetched 2026-09-06): 'Workers supports most Pages use cases and offers a broader feature set. It is Cloudflare's primary platform for building applications. Start new projects with Workers.' The prior v1.1.0 blueprint blessed neither shape as the default; v1.1.0 taught the wrangler [assets] block in an asset sample but left the shape choice implicit. The T-0 round bumps the blueprint to v1.2.0 to close the gap: a rcf-lite project choosing SPA-on-Workers gets a single, ratified wrangler shape rather than a hand-rolled convention, and the ratified shape follows Cloudflare's own recommendation for new projects.",
+  "context": "Cloudflare ships two shapes for browsing static assets in front of a Workers-tier deploy target: Cloudflare Pages (a workflow-shaped product with its own build pipeline and its own preview URL model) and Workers-with-static-assets (a wrangler.toml [assets] block declaring a directory the Cloudflare runtime serves at the edge). Cloudflare's own Pages landing page states, verbatim (fetched 2026-09-06): 'Workers supports most Pages use cases and offers a broader feature set. It is Cloudflare's primary platform for building applications. Start new projects with Workers.' The prior v1.1.0 blueprint blessed neither shape as the default; v1.1.0 taught the wrangler [assets] block in an asset sample but left the shape choice implicit. The round-6 bump takes the blueprint to v1.2.0 to close the gap: a rcf-lite project choosing SPA-on-Workers gets a single, ratified wrangler shape rather than a hand-rolled convention, and the ratified shape follows Cloudflare's own recommendation for new projects.",
   "decision": "The blueprint blesses Workers-with-static-assets as the ratified SPA-on-Workers deploy shape (recommendedDefault true for new SPA projects). A project answering the elicited assets-directory parameter with a non-empty path emits an [assets] block on wrangler.toml whose directory value carries the elicited path; a project answering with an empty path keeps the bare-Worker shape (no [assets] block). The elicited run-worker-first (boolean, default false) surfaces the SPA fallback discipline: truthy answers emit run_worker_first = true under the [assets] block; falsy or unanswered answers omit the field, letting Cloudflare's runtime run asset lookup before the Worker fetch handler. The blueprint does not mint a Cloudflare Pages blueprint; a future deploy-cloudflare-pages-legacy sibling mints on demand only if a project cannot make the jump. Every existing v1.1.0 contribution carries through unchanged.",
-  "consequences": "One ratified shape lands on the shelf for greenfield SPA-on-Workers projects; the shape's standards trace is the Cloudflare Pages landing-page recommendation (2026-09-06 snapshot). The two new elicits become part of the operator surface at blueprint add: assets-directory names the static-assets root, run-worker-first names the SPA fallback discipline. A project generating both an [assets] block and a Pages-only pages_build_output_dir field is a mixed-shape drift the T-0 probe (assets-manifest-scan.mjs) refuses. A project on the legacy Pages shape stays on v1.1.0 semantics until it migrates; the guide's new Workers-with-static-assets section links Cloudflare's migrate-from-Pages walkthrough for projects that choose to jump. Future round-6 blueprints (T-1 KV, T-2 cron, T-3 DO, T-4 Access, T-5 Turnstile, T-6 rate-limiting) all compose on this shape via the shared cf-platform sample-app fixture.",
+  "consequences": "One ratified shape lands on the shelf for greenfield SPA-on-Workers projects; the shape's standards trace is the Cloudflare Pages landing-page recommendation (2026-09-06 snapshot). The two new elicits become part of the operator surface at blueprint add: assets-directory names the static-assets root, run-worker-first names the SPA fallback discipline. A project generating both an [assets] block and a Pages-only pages_build_output_dir field is a mixed-shape drift the probe (assets-manifest-scan.mjs) refuses. A project on the legacy Pages shape stays on v1.1.0 semantics until it migrates; the guide's new Workers-with-static-assets section links Cloudflare's migrate-from-Pages walkthrough for projects that choose to jump. Future blueprints in this family (KV, cron, DO, Access, Turnstile, rate-limiting) all compose on this shape via the shared cf-platform sample-app fixture.",
   "alternativesConsidered": [
     {
       "name": "Ship a Cloudflare Pages blueprint alongside deploy-cloudflare-workers",

package/blueprints/deploy-cloudflare-workers/contributions/probes/assets-manifest-scan.mjs

@@ -1,6 +1,6 @@
 // Source-tree scan probe for the deploy-cloudflare-workers v1.2.0
-// Workers-with-static-assets shape (T-0 of the Cloudflare round 6
-// spec, section 5.0). accountBound false: this probe reads the
+// Workers-with-static-assets shape owned by TAC-1302 on this
+// blueprint. accountBound false: this probe reads the
 // applied fixture wrangler.toml and asserts three properties:
 //
 //   1. When the elicited assets-directory answer is non-empty, the
@@ -31,6 +31,24 @@ export const accountBound = false;
 // blueprint's manifest declares (top-level scalars, one [assets]
 // table, and boolean/string literals). Reaches for no runtime dep;
 // keeps the probe accountBound-false and dependency-free.
+
+function interpretRunWorkerFirst(v) {
+  // Accepts boolean true/false, string 'true'/'false', or a JSON array literal such as ["/api/*"].
+  // Returns { truthy: boolean, arrayForm: null | string[] }.
+  if (v === true) return { truthy: true, arrayForm: null };
+  if (v === false) return { truthy: false, arrayForm: null };
+  if (typeof v === 'string') {
+    const s = v.trim();
+    if (s === 'true') return { truthy: true, arrayForm: null };
+    if (s === 'false' || s === '') return { truthy: false, arrayForm: null };
+    if (s.startsWith('[')) {
+      try { const arr = JSON.parse(s); if (Array.isArray(arr)) return { truthy: true, arrayForm: arr }; } catch { /* fall through */ }
+    }
+  }
+  if (Array.isArray(v)) return { truthy: true, arrayForm: v };
+  return { truthy: false, arrayForm: null };
+}
+
 export function parseWranglerToml(text) {
   const lines = text.split(/\r?\n/);
   const root = {};
@@ -90,7 +108,7 @@ export async function scan(opts) {
     parsed,
     elicited: {
       assetsDirectory: elicited['assets-directory'] || '',
-      runWorkerFirst: elicited['run-worker-first'] === true,
+      runWorkerFirst: interpretRunWorkerFirst(elicited['run-worker-first']),
     },
   };
 
@@ -117,17 +135,17 @@ export async function scan(opts) {
       });
     }
     const runWorkerFirstOnManifest = assets && Object.prototype.hasOwnProperty.call(assets, 'run_worker_first');
-    if (detail.elicited.runWorkerFirst) {
-      if (!runWorkerFirstOnManifest || assets.run_worker_first !== true) {
+    if (detail.elicited.runWorkerFirst.truthy) {
+      const expectShape = detail.elicited.runWorkerFirst.arrayForm; const manifestVal = runWorkerFirstOnManifest ? assets.run_worker_first : undefined; const boolMatches = expectShape === null && manifestVal === true; const arrMatches = Array.isArray(expectShape) && Array.isArray(manifestVal) && JSON.stringify(expectShape) === JSON.stringify(manifestVal); if (!runWorkerFirstOnManifest || (!boolMatches && !arrMatches)) {
         results.push({
           verdict: 'fail',
-          detail: 'run_worker_first mismatch: elicited answer is true but manifest carries ' + (runWorkerFirstOnManifest ? String(assets.run_worker_first) : 'no run_worker_first key'),
+          detail: 'run_worker_first mismatch: elicited answer expected ' + (expectShape === null ? 'true' : JSON.stringify(expectShape)) + ' but manifest carries ' + (runWorkerFirstOnManifest ? JSON.stringify(assets.run_worker_first) : 'no run_worker_first key'),
           anchorAcId,
         });
       } else {
         results.push({
           verdict: 'pass',
-          detail: 'assets.run_worker_first equals true, matching the elicited run-worker-first answer',
+          detail: 'assets.run_worker_first ' + (expectShape === null ? 'equals true' : 'equals array ' + JSON.stringify(manifestVal)) + ', matching the elicited run-worker-first answer',
           anchorAcId,
         });
       }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-001.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1302-deploy-cloudflare-workers-wrangler-manifest",
+    "field": "responsibilities.manifest"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-002.json

@@ -2,7 +2,7 @@
   "reqId": "deploy-cloudflare-workers-REQ-002",
   "prdId": "PRD-001",
   "title": "One deploy adapter module is the sole caller of the deploy CLI",
-  "description": "The project exposes a single Deploy Adapter module that wraps the deploy CLI (the vendor's `wrangler` binary when the default vendor is in play). Every path that uploads a version, promotes a version, lists versions, or reads deploy state routes through this module. Nothing else in the project source tree spawns the CLI, imports the vendor SDK, or issues an HTTP call to the vendor's deploy API. The module exposes a fixed named-verb surface (`uploadVersion`, `promoteVersion`, `listVersions`, `resolveNewestOfMain`, `describeVersion`) that is stable across the blueprint's major version.",
+  "description": "The project exposes a single Deploy Adapter module that wraps the deploy CLI (the vendor's `wrangler` binary when the default vendor is in play). Every path that uploads a version, promotes a version, lists versions, or reads deploy state routes through this module. Nothing else in the project source tree spawns the CLI, imports the vendor SDK, or issues an HTTP call to the vendor's deploy API. The module exposes a fixed named-verb surface (`uploadVersion`, `promoteVersion`, `listVersions`, `resolveNewestOfMain`, `describeVersion`) that is stable across the blueprint's major version. The adapter exposes a stable deployStatus verb that composes the manifest-declared production URL, the preview alias URL resolved via the Preview URL Resolver, and the currently serving version id (from the Cloudflare Deployments API); the verb is the sole channel through which any AC observes those addressable surfaces.",
   "category": "technical",
   "domain": "deploy",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1301-deploy-cloudflare-workers-deploy-adapter",
+    "field": "responsibilities.uploadVersion"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-003.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1303-deploy-cloudflare-workers-preview-url-resolver",
+    "field": "interfaces.aliasQuery"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-004.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1304-deploy-cloudflare-workers-promote-gate",
+    "field": "responsibilities.explicitPromote"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-005.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1302-deploy-cloudflare-workers-wrangler-manifest",
+    "field": "interfaces.productionUrl"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-006.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1302-deploy-cloudflare-workers-wrangler-manifest",
+    "field": "interfaces.bindings"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-007.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1306-deploy-cloudflare-workers-deploy-ci-workflows",
+    "field": "responsibilities.build-and-upload"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-008.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1306-deploy-cloudflare-workers-deploy-ci-workflows",
+    "field": "responsibilities.promoteWorkflow"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-009.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1304-deploy-cloudflare-workers-rollback-is-promote",
+    "field": "decision.rollbackIsPromote"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-010.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1305-deploy-cloudflare-workers-served-surface-verifier",
+    "field": "responsibilities.probe"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-011.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1305-deploy-cloudflare-workers-dev-mode-drift",
+    "field": "decision.devMode"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-012.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1306-deploy-cloudflare-workers-deploy-ci-workflows",
+    "field": "responsibilities.buildProvenance"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-013.json

@@ -14,5 +14,9 @@
   "version": "1.2.0",
   "status": "approved",
   "createdAt": "2026-09-07T00:00:00Z",
-  "updatedAt": "2026-09-07T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1306-deploy-cloudflare-workers-spa-shape",
+    "field": "decision.assets"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-014.json

@@ -2,10 +2,10 @@
   "reqId": "deploy-cloudflare-workers-REQ-014",
   "prdId": "PRD-001",
   "title": "SPA fallback discipline: run_worker_first flips the assets pipeline off the fetch handler's critical path",
-  "description": "The blueprint elicits `run-worker-first` (boolean, default false) alongside the `[assets] directory` shape from REQ-013. When the operator answers truthy, the generated wrangler manifest emits `run_worker_first = true` under the `[assets]` block: Cloudflare's runtime runs the Worker's fetch handler BEFORE looking up a static asset for the requested path. That is the shape a SPA-on-Workers project uses when the Worker owns arbitrary routing or when the Worker's auth middleware must gate every path a static file could shadow. When the operator answers falsy or leaves the elicit unanswered, `run_worker_first` is absent from the manifest and Cloudflare's runtime looks up a static asset first, falling back to the Worker only when no asset matches. The Worker code and the guide teach both shapes; the elicit surface is one boolean, the wrangler shape is one line.",
+  "description": "The blueprint elicits `run-worker-first` (boolean, default false) alongside the `[assets] directory` shape from REQ-013. When the operator answers truthy, the generated wrangler manifest emits `run_worker_first = true` under the `[assets]` block: Cloudflare's runtime runs the Worker's fetch handler BEFORE looking up a static asset for the requested path. That is the shape a SPA-on-Workers project uses when the Worker owns arbitrary routing or when the Worker's auth middleware must gate every path a static file could shadow. When the operator answers falsy or leaves the elicit unanswered, `run_worker_first` is absent from the manifest and Cloudflare's runtime looks up a static asset first, falling back to the Worker only when no asset matches. The Worker code and the guide teach both shapes; the elicit surface is one boolean, the wrangler shape is one line. The elicited run-worker-first answer is true to emit run_worker_first = true on the wrangler [assets] block (Worker gates every request before asset lookup); false or absent omits the field (Cloudflare's runtime serves a matching static asset before the Worker runs).",
   "category": "technical",
   "domain": "deploy",
-  "priority": "should",
+  "priority": "must",
   "rationale": "The default (asset lookup first, Worker on miss) is right for a static-content-heavy project. The truthy branch is what keeps auth middleware from being silently bypassed by an unauthenticated request for a file the assets pipeline serves from the edge cache. Naming the discipline as its own REQ makes the shape trade legible; anchoring the elicit to a wrangler line keeps the choice observable in the applied project.",
   "tags": [
     "blueprint:deploy-cloudflare-workers",
@@ -14,5 +14,9 @@
   "version": "1.2.0",
   "status": "approved",
   "createdAt": "2026-09-07T00:00:00Z",
-  "updatedAt": "2026-09-07T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1306-deploy-cloudflare-workers-spa-shape",
+    "field": "decision.run_worker_first"
+  }
 }