rcf-lite 0.25.0 → 0.27.0

package/blueprints/deploy-cloudflare-workers/contributions/tacs/tac-1301-deploy-cloudflare-workers-deploy-adapter.json

@@ -14,7 +14,8 @@
     "Expose `describeVersion({ versionId })` returning provenance (`versionSha`, `builtAt`, `ciRunUrl`) and URLs (`versionIdUrl`) for the named version; `versionSha` is the git commit sha baked into the version's bundle by `build-and-upload`, distinct from the version UUID `versionId` names (AC-12112-1, AC-12112-2).",
     "Expose `resolveSubdomain()` that returns the account's workers.dev subdomain string every URL-assembly path needs; reads the `WORKERS_DEV_SUBDOMAIN` env var when set (project pin) and otherwise queries the vendor's `GET /accounts/<accountId>/workers/subdomain` REST endpoint; caches the value for the process's lifetime (AC-12105-1).",
     "Refuse a manifest whose production route resolves to the same host as the preview alias URL with `DEPLOY_URL_COLLAPSED` (AC-12105-2).",
-    "Route every CLI invocation through a redactor that scrubs the vendor API token and account id from every emitted log line (AC-12107-3, AC-12106-2)."
+    "Route every CLI invocation through a redactor that scrubs the vendor API token and account id from every emitted log line (AC-12107-3, AC-12106-2).",
+    "Expose a stable deployStatus verb that composes the manifest-declared production URL, the preview alias URL (via the Preview URL Resolver TAC-1303), and the currently serving version id (via the Cloudflare Deployments API); every AC that observes an addressable served surface reads it through this verb (AC-12105-1)."
   ],
   "internalStructure": "One stateless class per process with an injected vendor binding and an injected redactor. The vendor binding is a project-authored module implementing the port in the interfaces block; the default vendor binding shells to the `wrangler` CLI and lives under the same package as the adapter. Every verb is a thin translation from the named surface to a vendor CLI invocation (or SDK call) plus response parsing plus provenance-URL assembly.",
   "interfaces": [
@@ -50,5 +51,5 @@
   ],
   "tradeoffs": "The adapter is process-local and stateless; every call reaches the vendor. That means a chain of adapter calls in one CI step costs one vendor round-trip per call rather than a shared session. The trade keeps the adapter easy to reason about and easy to reimplement against a different vendor. A project that wants a session-shared invocation supplies a vendor binding whose backing is a long-lived process rather than a CLI spawn per call; the port shape does not change.",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-cloudflare-workers/contributions/tacs/tac-1302-deploy-cloudflare-workers-wrangler-manifest.json

@@ -13,7 +13,10 @@
     "Refuse a manifest that carries any inline secret value; scan the parsed object for keys under the vendor's secret-declaration primitive whose value is not an empty declaration (AC-12101-3, AC-12106-1).",
     "Refuse a manifest whose production route stanza resolves to the same host as the preview alias URL with `DEPLOY_URL_COLLAPSED` (AC-12105-2).",
     "Expose a `bindings()` accessor listing every declared binding (kind, name) for downstream consumers.",
-    "Expose a `productionUrl()` accessor deriving the production URL from the `routes`/`route`/`workers_dev`/custom-domain declaration."
+    "Expose a `productionUrl()` accessor deriving the production URL from the `routes`/`route`/`workers_dev`/custom-domain declaration.",
+    "Load and expose the [assets] block per the current Cloudflare Workers static-assets contract (https://developers.cloudflare.com/workers/static-assets/binding/): an empty or absent [assets].directory answer keeps the bare-Worker shape and emits no [assets] block; a non-empty answer emits [assets].directory verbatim and enables the static-asset pipeline (AC-12113-1, AC-12114-1).",
+    "Map the elicited run-worker-first answer to the wrangler literal on the emitted [assets] block per the Cloudflare Workers static-assets binding page (https://developers.cloudflare.com/workers/static-assets/binding/, verified 2026-09-09). Two accepted answer shapes; both round-trip through the manifest reader (AC-12115-1): (a) boolean shape - \"false\", the empty string or absent OMITS the field and lets asset lookup run first, \"true\" EMITS `run_worker_first = true` and the Worker runs first for every request; (b) array-of-patterns shape - a JSON literal such as [\"/api/*\", \"!/api/docs/*\"] EMITS `run_worker_first = [\"/api/*\", \"!/api/docs/*\"]` and the Worker runs first only on matched routes (glob `*` for deep matching; leading `!` for negatives; negatives take precedence; at most 100 entries). Any other shape refuses at load with an unknownRunWorkerFirstShape error kind naming the accepted forms.",
+    "Refuse a wrangler manifest that declares both an [assets] block and a legacy pages_build_output_dir field (their meanings collide on the same deploy). The refusal names the collision and points the operator at the [assets] block as the ratified shape."
   ],
   "internalStructure": "One parser module per format (TOML and JSONC), one validator that walks the parsed object against the shape rules, one binding-usage scanner that walks the Worker source AST for env-accessor patterns, and one URL-derivation module that inspects the routes stanza. All pure functions; no I/O outside the initial file read.",
   "interfaces": [
@@ -41,5 +44,5 @@
   "dependencies": [],
   "tradeoffs": "The loader owns validation but does not own the vendor's own manifest-level validation (which happens later at the vendor CLI). Two-stage validation means a manifest that passes this loader can still fail the vendor's own load; the trade keeps the loader project-local and fast (no vendor round-trip on every CI step) while catching the classes this blueprint cares about (undeclared bindings, inline secrets, collapsed URLs) before the vendor call. A project can point the loader at a project-authored TOML dialect (a preprocessor step) by wrapping the manifestFile interface.",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-cloudflare-workers/contributions/user-stories/deploy-cloudflare-workers-us-12101.json

@@ -16,7 +16,8 @@
       "when": "a manifest loader parses the file",
       "then": "the loader returns a config object whose `name` is a non-empty string, `main` resolves to an existing entry file, `compatibility_date` matches `\\d{4}-\\d{2}-\\d{2}`, and every non-secret binding name referenced from the Worker's source appears as a declaration key in the config; the config carries no `[secrets]` block",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-12101-2",
@@ -25,7 +26,8 @@
       "when": "the CI gate runs on the change",
       "then": "the run fails with a stable-coded `WRANGLER_BINDING_UNDECLARED` error naming the offending source path and the missing binding name",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-12101-3",
@@ -34,21 +36,31 @@
       "when": "a redaction-scanner runs against `wrangler.toml`, any committed environment file, and the CI workflows",
       "then": "no file in the scanned set contains any byte sequence in `V`",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "disposition": "template"
     },
     {
       "id": "AC-12101-4",
-      "description": "When the manifest declares an `[assets]` block AND the Worker's fetch handler installs an auth gate on any route whose path could be shadowed by a file under the assets `directory`, the manifest MUST declare `[assets] run_worker_first` naming every gated route (glob-matched); a deployed request to any listed path is answered by the fetch handler before the assets pipeline runs. Without the listing, the assets pipeline serves the shadowing file directly and the auth gate is silently bypassed at the edge.",
-      "given": "a Worker whose fetch handler installs an auth middleware on `/notes` and a `./public/notes.html` file present at build time; the deployed Worker is reachable at production URL P",
-      "when": "an unauthenticated HTTP GET hits `P/notes`",
-      "then": "the response is the auth middleware's unauthenticated response (a redirect to sign-in, a 401, or the middleware's declared shape); the response is NOT the byte content of `./public/notes.html`; a manifest that omits `/notes` from `[assets] run_worker_first` fails the deployed observation because the assets pipeline answered before the fetch handler ran",
+      "description": "The wrangler manifest [assets] block, when the elicited run-worker-first answer is true, carries the boolean literal run_worker_first = true (and only that literal). Every application shipped under this shape asserts that an unauthenticated request to any protected route (for example /notes) reaches the Worker fetch handler before the static-asset pipeline runs, and the Worker's auth middleware gates it. The array-of-patterns form on the same field is a vendor-supported alternative recorded on TAC-1302 but not the shape this AC binds.",
+      "given": "wrangler manifest [assets].directory non-empty and run_worker_first = true",
+      "when": "an unauthenticated request lands on a Worker route the auth middleware protects",
+      "then": "the fetch handler runs before the static-asset pipeline, the auth middleware refuses, and no static asset is served",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1302-deploy-cloudflare-workers-wrangler-manifest",
+        "field": "interfaces.manifestFile"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/workers/static-assets/binding/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-1302-deploy-cloudflare-workers-wrangler-manifest"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-cloudflare-workers/contributions/user-stories/deploy-cloudflare-workers-us-12102.json

@@ -16,7 +16,8 @@
       "when": "the source tree is scanned for spawns of `wrangler` (or the vendor's CLI binary name) and for imports of the vendor's deploy SDK identifier",
       "then": "the only source file that matches either scan is the Deploy Adapter module; no other module names an alternative deploy call path",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-12102-2",
@@ -25,7 +26,16 @@
       "when": "a caller invokes `deployAdapter.uploadVersion({ previewAlias: 'main' })`",
       "then": "the call resolves with a `versionId` string matching the vendor's version-id format, a `versionIdUrl` naming the per-version URL, and a `previewAliasUrl` whose host segment carries the alias `main`; a call with `previewAlias: ''` throws a `DEPLOY_PREVIEW_ALIAS_REQUIRED` error",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1304-deploy-cloudflare-workers-promote-gate",
+        "field": "interfaces.deployAdapter"
+      },
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/workers/versions-and-deployments/",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-12102-3",
@@ -34,12 +44,21 @@
       "when": "a caller invokes `deployAdapter.promoteVersion({ versionId: 'bogus-v1' })`",
       "then": "the call throws a `DEPLOY_VERSION_NOT_FOUND` error naming `bogus-v1` and no vendor promote call is issued",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1304-deploy-cloudflare-workers-promote-gate",
+        "field": "interfaces.deployAdapter"
+      },
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/workers/wrangler/commands/#versions",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-1301-deploy-cloudflare-workers-deploy-adapter"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-cloudflare-workers/contributions/user-stories/deploy-cloudflare-workers-us-12103.json

@@ -16,7 +16,8 @@
       "when": "an HTTP request hits A and then a second HTTP request hits U within five minutes of the run completing",
       "then": "both responses carry the `versionSha` field of V's build provenance in the health-probe body, and the two responses agree on that field",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "disposition": "template"
     },
     {
       "id": "AC-12103-2",
@@ -25,7 +26,8 @@
       "when": "requests hit A and the version-id URLs for V and W after W's run completes",
       "then": "the response at A carries W's `versionSha`; the response at V's version-id URL still carries V's `versionSha`; the two are distinct",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "disposition": "template"
     },
     {
       "id": "AC-12103-3",
@@ -34,7 +36,8 @@
       "when": "the `build-and-upload` run completes and no promote has run",
       "then": "the production URL's health probe carries P's `versionSha`, not W's",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "disposition": "template"
     }
   ],
   "tacIds": [
@@ -42,5 +45,5 @@
     "TAC-1301-deploy-cloudflare-workers-deploy-adapter"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-cloudflare-workers/contributions/user-stories/deploy-cloudflare-workers-us-12104.json

@@ -16,7 +16,8 @@
       "when": "a lint scan walks every workflow file and inspects the trigger set of each and the deploy verb it invokes",
       "then": "no workflow file both matches trigger `push` on branch `main` (or a linear-history proxy) AND invokes a promote verb; the scan reports zero offenders",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-12104-2",
@@ -25,7 +26,8 @@
       "when": "the trigger stanza is parsed",
       "then": "the only trigger present is the platform's explicit-manual-trigger primitive (`workflow_dispatch` on GitHub Actions or the equivalent) and no `push`, `pull_request`, or `schedule` trigger appears",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-12104-3",
@@ -34,7 +36,8 @@
       "when": "the deploy log store is inspected after the run",
       "then": "a new record exists whose fields include `promotedVersionId`, `promotedBy`, `previousVersionId`, and `promotedAt`; every field is populated and no field carries a secret value",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "disposition": "template"
     }
   ],
   "tacIds": [
@@ -42,5 +45,5 @@
     "TAC-1306-deploy-cloudflare-workers-deploy-ci-workflows"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-cloudflare-workers/contributions/user-stories/deploy-cloudflare-workers-us-12105.json

@@ -16,7 +16,12 @@
       "when": "the operator invokes the adapter's `deploy status` verb",
       "then": "the response is a structured object whose fields include `productionUrl`, `previewAliasUrl`, and `currentlyServingVersionId`; every field is populated",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1302-deploy-cloudflare-workers-wrangler-manifest",
+        "field": "interfaces.productionUrl"
+      },
+      "disposition": "template"
     },
     {
       "id": "AC-12105-2",
@@ -25,7 +30,8 @@
       "when": "the adapter loads the manifest",
       "then": "the load throws a `DEPLOY_URL_COLLAPSED` error naming both URLs; no deploy verb accepts the manifest",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-12105-3",
@@ -34,7 +40,8 @@
       "when": "a health probe hits the production URL and a second health probe hits A",
       "then": "the production response body carries `versionSha` of P and the preview response body carries `versionSha` of W; the two values are not equal",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "disposition": "template"
     }
   ],
   "tacIds": [
@@ -42,5 +49,5 @@
     "TAC-1301-deploy-cloudflare-workers-deploy-adapter"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-cloudflare-workers/contributions/user-stories/deploy-cloudflare-workers-us-12106.json

@@ -16,7 +16,8 @@
       "when": "the Worker source is scanned for env-accessor references that resolve to secret bindings (per the manifest loader's binding-kind classification) and each such name is cross-checked against the secrets contract's declared names",
       "then": "every implicitly-referenced secret name maps to a name declared in the secrets contract; every name has a resolvable value in the active deploy environment; the manifest carries no `[secrets]` block, no `secrets.required[]` list, and no binding declaration with an inline secret value",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-12106-2",
@@ -25,7 +26,8 @@
       "when": "the run's captured logs are inspected byte-for-byte after completion",
       "then": "no log line contains any byte sequence in the resolved-values set; every substitution shows a fixed placeholder in the emitted line",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "disposition": "fixed"
     },
     {
       "id": "AC-12106-3",
@@ -34,7 +36,8 @@
       "when": "the CI gate scans the change",
       "then": "the run fails with a stable-coded `DEPLOY_SECRET_LEAKED_IN_FILE` error naming the offending path and the logical name of the matching secret",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -42,5 +45,5 @@
     "TAC-1301-deploy-cloudflare-workers-deploy-adapter"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-cloudflare-workers/contributions/user-stories/deploy-cloudflare-workers-us-12107.json

@@ -16,7 +16,8 @@
       "when": "the trigger stanza is parsed",
       "then": "the trigger set contains `push` scoped to the `main` branch (or the equivalent linear-history proxy); it contains no `pull_request` or `schedule` trigger",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-12107-2",
@@ -25,7 +26,8 @@
       "when": "the run's outputs are inspected after completion",
       "then": "a structured output object exists whose fields include `versionId`, `versionIdUrl`, and `previewAliasUrl`; every field is populated with a non-empty string; the `previewAliasUrl` host segment carries the operator-chosen alias string",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "disposition": "template"
     },
     {
       "id": "AC-12107-3",
@@ -34,7 +36,8 @@
       "when": "the run's captured logs are inspected byte-for-byte",
       "then": "no log line contains the API token bytes; no log line contains the account id bytes; both are populated only into the vendor CLI's environment and redacted from any emitted line",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -42,5 +45,5 @@
     "TAC-1301-deploy-cloudflare-workers-deploy-adapter"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-cloudflare-workers/contributions/user-stories/deploy-cloudflare-workers-us-12108.json

@@ -16,7 +16,12 @@
       "when": "the input stanza is parsed",
       "then": "one input `versionId` exists and is not marked required; the workflow declares no other input fields",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_dispatch",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-12108-2",
@@ -25,7 +30,8 @@
       "when": "the `promote` workflow runs with `versionId=''`",
       "then": "the workflow invokes `resolveNewestOfMain` returning W, calls `promoteVersion({ versionId: W })`, and the recorded promote record names W as `promotedVersionId`",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "disposition": "template"
     },
     {
       "id": "AC-12108-3",
@@ -34,7 +40,12 @@
       "when": "the `promote` workflow runs with `versionId='not-a-version'`",
       "then": "the run fails with the `DEPLOY_VERSION_NOT_FOUND` code from the adapter, no vendor promote call is issued, and no promote record is appended to the deploy log",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/workers/wrangler/commands/#versions",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
@@ -42,5 +53,5 @@
     "TAC-1306-deploy-cloudflare-workers-deploy-ci-workflows"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-cloudflare-workers/contributions/user-stories/deploy-cloudflare-workers-us-12109.json

@@ -16,7 +16,12 @@
       "when": "the operator invokes `deployAdapter.listVersions()` and picks a prior id P then triggers the `promote` workflow with `versionId=P`",
       "then": "`listVersions` returns a list containing P with the currently-serving flag on the correct entry; the `promote` run succeeds; the deploy-log record names P as `promotedVersionId` and the prior currently-serving id as `previousVersionId`",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "ownerRef": {
+        "tacId": "TAC-1304-deploy-cloudflare-workers-promote-gate",
+        "field": "interfaces.deployAdapter"
+      },
+      "disposition": "template"
     },
     {
       "id": "AC-12109-2",
@@ -25,7 +30,8 @@
       "when": "a scan searches for verbs named `rollback` (or synonyms `revert`, `undoPromote`) that spawn the vendor CLI or issue a vendor deploy call outside the Deploy Adapter",
       "then": "no such verb exists; every rollback path routes through the `promote` workflow and the Deploy Adapter",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-12109-3",
@@ -34,7 +40,8 @@
       "when": "the `promote` workflow completes",
       "then": "the workflow exits non-zero with `PROMOTE_VERIFY_FAILED`; the failing probe path and the response status are recorded; the deploy-log record does not mark the release successful",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "disposition": "template"
     }
   ],
   "tacIds": [
@@ -43,5 +50,5 @@
     "TAC-1305-deploy-cloudflare-workers-served-surface-verifier"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-cloudflare-workers/contributions/user-stories/deploy-cloudflare-workers-us-12110.json

@@ -16,7 +16,8 @@
       "when": "the verifier runs",
       "then": "at least one HTTP request to the production URL's `/healthz` completes within the sixty-second window; the request carries no `Authorization` header that would bypass a production auth layer; the retry count for any single probe does not exceed six",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "disposition": "template"
     },
     {
       "id": "AC-12110-2",
@@ -25,7 +26,8 @@
       "when": "the verifier receives the response",
       "then": "the verifier substitutes `sha-W` into the `expectShape.versionSha` slot before requesting; the probe passes exactly when the status is 200 AND the JSON body's `versionSha` matches `sha-W`; a 200 response whose `versionSha` names a different sha fails the probe",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "disposition": "template"
     },
     {
       "id": "AC-12110-3",
@@ -34,7 +36,8 @@
       "when": "the verifier completes",
       "then": "the workflow exits non-zero; the exit records include the stable code `PROMOTE_VERIFY_FAILED`; the deploy log entry names the failing probe path, the last status observed, and the elapsed time; the release is not marked successful",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -42,5 +45,5 @@
     "TAC-1304-deploy-cloudflare-workers-promote-gate"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-cloudflare-workers/contributions/user-stories/deploy-cloudflare-workers-us-12111.json

@@ -16,7 +16,12 @@
       "when": "the coverage gate walks the AC-to-TC bindings",
       "then": "the gate reports the binding as `DEPLOY_DEV_MODE_INADMISSIBLE`, refuses to count it toward the AC's coverage, and lists the offending TC and its target URL",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/workers/wrangler/commands/#dev",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-12111-2",
@@ -25,7 +30,8 @@
       "when": "the coverage gate walks the AC-to-TC bindings",
       "then": "the gate accepts the binding as valid coverage; the coverage counter increments for the AC",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-12111-3",
@@ -34,12 +40,13 @@
       "when": "the file is read",
       "then": "the file names at least four dev-mode drift classes with a one-line example of each and a pointer to the vendor's changelog or release notes where the class is described",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
   "tacIds": [
     "TAC-1305-deploy-cloudflare-workers-served-surface-verifier"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-cloudflare-workers/contributions/user-stories/deploy-cloudflare-workers-us-12112.json

@@ -16,7 +16,8 @@
       "when": "the resulting Worker's runtime code reads the provenance surface",
       "then": "the surface returns an object whose `versionSha` equals C's short sha, whose `builtAt` equals T formatted as ISO 8601, and whose `ciRunUrl` equals R",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "disposition": "fixed"
     },
     {
       "id": "AC-12112-2",
@@ -25,7 +26,8 @@
       "when": "an HTTP GET hits the project's declared health-probe path",
       "then": "the response body is JSON with fields `versionSha`, `builtAt`, `ciRunUrl`; all three fields are populated with non-empty strings; the response status is in the success set",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "disposition": "template"
     },
     {
       "id": "AC-12112-3",
@@ -34,7 +36,12 @@
       "when": "the verifier's post-promote probe returns a body whose `versionSha` reads `sha-P` (a stale prior version)",
       "then": "the verifier records the mismatch as `PROMOTE_VERIFY_FAILED` with the observed `sha-P` and the expected `sha-W`; the release is not marked successful",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/workers/versions-and-deployments/#version-metadata",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
@@ -42,5 +49,5 @@
     "TAC-1306-deploy-cloudflare-workers-deploy-ci-workflows"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-cloudflare-workers/contributions/user-stories/deploy-cloudflare-workers-us-12113.json

@@ -16,7 +16,8 @@
       "when": "the probe module assets-manifest-scan.mjs parses the fixture wrangler.toml",
       "then": "the parsed structure contains an assets table whose directory string equals ./dist and no top-level pages_build_output_dir key; the probe returns verdict pass",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-12113-2",
@@ -25,12 +26,49 @@
       "when": "the probe module parses the fixture wrangler.toml",
       "then": "the parsed [assets] table carries run_worker_first equal to true; when the fixture is switched with SIMULATE_EMPTY_ASSETS=true the run_worker_first field is absent (the whole [assets] block is absent) and the probe still returns verdict pass because the bare-Worker shape is legal",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/workers/static-assets/binding/",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-12113-3",
+      "description": "Empty assets-directory keeps the bare-Worker shape. Given the elicited assets-directory answered as the empty string, when the deploy adapter renders the wrangler manifest, then no [assets] block is emitted (the file has no assets header), no static-asset probe fires, and the deploy runs as a bare Worker; a mutation SIMULATE_UNWANTED_ASSETS_BLOCK=true forces an [assets] block into the generated manifest and the ship gate FAILS naming the unwanted block.",
+      "given": "assets-directory answered as the empty string",
+      "when": "the deploy adapter renders the wrangler manifest",
+      "then": "no [assets] block is emitted; the deploy runs as a bare Worker; the unwanted-block mutation FAILS the ship gate",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1302-deploy-cloudflare-workers-wrangler-manifest",
+        "field": "responsibilities.assets"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-12113-4",
+      "description": "Run Worker first array-of-patterns form. Given the operator answers run-worker-first with a JSON array literal such as [\"/api/*\", \"!/api/docs/*\"] alongside a non-empty assets-directory, when the wrangler manifest is generated, then the emitted [assets] block carries `run_worker_first = [\"/api/*\", \"!/api/docs/*\"]` verbatim; a deployed request to /api/orders reaches the Worker fetch handler before asset lookup, a deployed request to /api/docs/openapi.json falls back to the static-asset pipeline (negative pattern precedence), and an answer of more than 100 entries refuses at load with tooManyRunWorkerFirstPatterns naming the vendor's 100-entry cap.",
+      "given": "run-worker-first answered as a JSON array of route patterns alongside a non-empty assets-directory",
+      "when": "the wrangler manifest is generated and the applied Worker deploys",
+      "then": "the [assets] block carries `run_worker_first = [\"/api/*\", \"!/api/docs/*\"]`; a request to /api/orders hits the Worker first; a request to /api/docs/openapi.json hits the static-asset pipeline first; over-100 entries refuse with tooManyRunWorkerFirstPatterns",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1302-deploy-cloudflare-workers-wrangler-manifest",
+        "field": "responsibilities.runWorkerFirstArrayForm"
+      },
+      "disposition": "template",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/workers/static-assets/binding/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-1302-deploy-cloudflare-workers-wrangler-manifest"
   ],
   "createdAt": "2026-09-07T00:00:00Z",
-  "updatedAt": "2026-09-07T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }