rcf-lite 0.26.0 → 0.27.0

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6123.json

@@ -11,21 +11,37 @@
   "acceptanceCriteria": [
     {
       "id": "AC-6123-1",
-      "description": "When `workflowShape.scheduledAudit` is `true`, the workflow-materialiser produces a `scheduled-audit` workflow triggered by the provider's cron surface, running the same required check set the pull-request and default-branch workflows run. The aggregate report writes to `.rcf/reports/ci/scheduled-audit.json` (distinct from the commit-triggered `pipeline.json`).",
+      "description": "When `workflowShape.scheduledAudit` is `true`, the workflow-materialiser produces a `scheduled-audit` workflow triggered by the provider's cron surface, running the same required check set the pull-request and default-branch workflows run. The aggregate report writes to `.rcf/reports/ci/scheduled-audit.json` (distinct from the commit-triggered `pipeline.json`). Template values the applying agent sets: The applying agent sets the workflowShape elicits (checkSet, branchModel, releaseMode, scheduledAudit, providerHint); the AC substitutes the project's declaration for the illustrative shape values.",
       "given": "a `workflowShape` with `scheduledAudit: true`",
       "when": "the workflow-materialiser runs",
       "then": "a `scheduled-audit` workflow file lands at the provider's workflow path, its trigger set names a cron schedule, and its command line invokes the Node gate-runner entry point with the required check set writing to the distinct report path",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-6123-2",
-      "description": "When `scheduledAudit` is `false` or absent, no scheduled workflow ships and no `.rcf/reports/ci/scheduled-audit.json` file path is populated.",
+      "description": "When `scheduledAudit` is `false` or absent, no scheduled workflow ships and no `.rcf/reports/ci/scheduled-audit.json` file path is populated. Template values the applying agent sets: The applying agent sets the workflowShape elicits (checkSet, branchModel, releaseMode, scheduledAudit, providerHint); the AC substitutes the project's declaration for the illustrative shape values.",
       "given": "a `workflowShape` with `scheduledAudit` absent (default `false`)",
       "when": "the workflow-materialiser runs",
       "then": "no `scheduled-audit` workflow file is created and no `.rcf/reports/ci/scheduled-audit.json` file path is written",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-6123-3",
+      "description": "The scheduled-audit workflow refuses to write when the check-set is empty (a workflowShape with scheduled-audit=on but checkSet all-false): the materialiser emits SCHEDULED_AUDIT_EMPTY_CHECKSET naming the empty checkSet; no cron workflow is written. Template values the applying agent sets: The applying agent sets the elicited workflowShape (scheduledAudit and checkSet); the AC substitutes the project's workflowShape for the illustrative scheduled-audit-on with checkSet all-false case.",
+      "given": "a workflowShape with scheduled-audit=on and every checkSet flag false",
+      "when": "the materialiser runs",
+      "then": "the materialiser exits with SCHEDULED_AUDIT_EMPTY_CHECKSET; no scheduled-audit.yml is written",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-706-delivery-ci-workflows-scheduled-audit",
+        "field": "interfaces.runScheduledAudit"
+      }
     }
   ],
   "tacIds": [
@@ -33,5 +49,5 @@
     "TAC-706-delivery-ci-workflows-scheduled-audit"
   ],
   "createdAt": "2026-08-31T00:00:00Z",
-  "updatedAt": "2026-08-31T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6124.json

@@ -11,12 +11,27 @@
   "acceptanceCriteria": [
     {
       "id": "AC-6124-1",
-      "description": "The illustrative pull-request-checks.yml under blueprints/delivery-ci-workflows/assets/ci-provider-examples/github-actions/ carries a documented e2e job block whose header comment names the four points a browser-facing project's e2e job satisfies: (a) runs the project's testLevel: e2e cases against a local preview or a --parity-env runtime, (b) uploads screenshots and HTML captures as workflow artefacts, (c) writes a distinct row to the aggregate pipeline report at .rcf/reports/ci/pipeline.json, (d) writes a per-gate report at .rcf/reports/ci/e2e.json with checkKind: 'e2e'. The header also tells a non-browser project to delete the e2e job before committing. The elicited checkSet.e2e entry exists in the delivery-ci-workflows check catalogue (blueprint.json) so a project that turns the check off does so through a supported knob. The runtime iff wiring (materialiser adds or omits the job based on manifest.blueprints[].source.browserSurface.declared and .rcf/config/delivery-ci-workflows.json:checkSet.e2e) lands in a follow-up train with its own TS entry; this AC is documentation-only per spec amendment A2 (2026-09-03).",
+      "description": "The illustrative pull-request-checks.yml under blueprints/delivery-ci-workflows/assets/ci-provider-examples/github-actions/ carries a documented e2e job block whose header comment names the four points a browser-facing project's e2e job satisfies: (a) runs the project's testLevel: e2e cases against a local preview or a --parity-env runtime, (b) uploads screenshots and HTML captures as workflow artefacts, (c) writes a distinct row to the aggregate pipeline report at .rcf/reports/ci/pipeline.json, (d) writes a per-gate report at .rcf/reports/ci/e2e.json with checkKind: 'e2e'. The header also tells a non-browser project to delete the e2e job before committing. The elicited checkSet.e2e entry exists in the delivery-ci-workflows check catalogue (blueprint.json) so a project that turns the check off does so through a supported knob. The runtime iff wiring (materialiser adds or omits the job based on manifest.blueprints[].source.browserSurface.declared and .rcf/config/delivery-ci-workflows.json:checkSet.e2e) lands in a follow-up train with its own TS entry; this AC is documentation-only per spec amendment A2 (2026-09-03). Template values the applying agent sets: The applying agent sets the workflowShape elicits (checkSet, branchModel, releaseMode, scheduledAudit, providerHint); the AC substitutes the project's declaration for the illustrative shape values.",
       "given": "the delivery-ci-workflows blueprint at v2.2.0",
       "when": "blueprints/delivery-ci-workflows/assets/ci-provider-examples/github-actions/pull-request-checks.yml and blueprint.json are inspected",
       "then": "the illustrative pull-request-checks.yml declares an e2e job; the block above it names the four points and the delete-me note for non-browser projects; blueprint.json's check catalogue carries checkSet.e2e",
       "testable": true,
-      "scope": "library"
+      "scope": "library",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-6124-2",
+      "description": "A project with `checkSet.e2e: true` but no application-spa (or other browserSurface-declaring) blueprint applied fails materialise with E2E_CHECK_UNBACKED naming the missing browserSurface. Prevents shipping an e2e job without an application under test. Template on the elicited checkSet. Template values the applying agent sets: The applying agent sets the elicited workflowShape.checkSet (specifically the e2e flag) and the applied blueprint set; the AC substitutes them for the illustrative checkSet.e2e=true paired with no browserSurface-declaring blueprint.",
+      "given": "a workflowShape with checkSet.e2e=true and no applied blueprint declaring a browserSurface",
+      "when": "the materialiser runs",
+      "then": "the materialiser exits with E2E_CHECK_UNBACKED naming the missing browserSurface; no e2e job is written into the pull-request-checks workflow",
+      "testable": true,
+      "scope": "library",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-704-delivery-ci-workflows-workflow-materialiser",
+        "field": "interfaces.materialise"
+      }
     }
   ],
   "tacIds": [
@@ -24,5 +39,6 @@
     "TAC-702-delivery-ci-workflows-gate-report"
   ],
   "createdAt": "2026-09-03T17:00:00Z",
-  "updatedAt": "2026-09-03T18:30:50Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "description": "Section 7a floor: two ACs. Per spec amendment A2 (2026-09-03) this story is documentation-only at v2.3.0; the runtime iff wiring lands in a follow-up train. Guide and TAC-701 name no e2e-specific runtime failure paths beyond the E2E_CHECK_UNBACKED refusal bound by AC-6124-2; runner-missing and gate-aggregation gaps route generically through AC-6102-3 and AC-6108-1 when the runtime wiring lands."
 }

package/blueprints/deploy-cloudflare-workers/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 1.3.2 (register patch, 2026-09-10)
+
+- Register: neutral wording on the ADR-1306 consequences field (closes F-1); no capability change.
+
+## 1.3.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.3.0 - 2026-09-09
+
+Adds deliveredBy on nine REQs (001, 003, 005, 006, 007, 010, 011, 013, 014). Adds ownerRef on AC-12102-2/3 and AC-12109-1 (deployAdapter) and AC-12105-1 (productionUrl). Closes chain-contradiction specimens F-1 (AC-12101-4 rewritten around the boolean run_worker_first = true form; vendor citation https://developers.cloudflare.com/workers/static-assets/binding/ verified 2026-09-09), F-2 (TAC-1302 gains responsibilities for the [assets].directory branches, the boolean and array-of-patterns run_worker_first mappings, and the pages_build_output_dir mutual-exclusion refusal), and F-5 (REQ-002 and TAC-1301 gain the stable deployStatus verb that composes production URL, preview alias URL, and currently serving version id). Closes chain-contradiction on per-version-id (ADR-1303 spelling aligned with TAC-1303). Adds disposition to every AC.
+
 All notable changes to the `deploy-cloudflare-workers` blueprint are recorded here.
 The format follows Keep a Changelog. Versions are semver, per
 `packages/rcf-lite/docs/blueprint-authoring.md` section 6.
@@ -65,5 +77,8 @@ Notes
 - `suggestedCompanions` unchanged (`logging`, `errorHandling`).
 - The shared `cf-platform` sample-app fixture at
   `packages/rcf-lite/test/fixtures/cf-platform/` ships alongside this
-  bump as the probe target. T-1 (KV), T-2 (cron), T-3 (Durable Objects)
-  and T-5's Turnstile sub-fixture extend the same fixture later.
+  bump as the probe target. This blueprint mints the fixture; the KV,
+  cron and Durable Objects blueprints, and the Turnstile sub-fixture,
+  extend the same fixture later.
+
+Review-fix (2026-09-09): Widens the run-worker-first elicit from kind boolean to kind string so both wrangler-side shapes accepted by the Cloudflare Workers static-assets binding (the boolean form and the array-of-patterns form) round-trip through the operator surface without silent narrowing. TAC-1302 responsibility 8 is rewritten to name both shapes with the emitted wrangler literal for each. Adds AC-12113-4 binding the array-of-patterns form on US-12113 with vendorCitation, and adds vendorCitation to AC-12113-2 (boolean form). README and guide teach both shapes. Adds deliveredBy on REQ-002, REQ-004, REQ-008, REQ-009, REQ-012. Sweeps vendorCitation onto fixed ACs resting on vendor facts (AC-12102-2, AC-12102-3, AC-12108-1, AC-12108-3, AC-12111-1, AC-12112-3).

package/blueprints/deploy-cloudflare-workers/README.md

@@ -50,9 +50,9 @@ v1.2.0 is an additive-minor bump. Every shipped v1.1.0 contribution carries thro
 
 - **Workers-with-static-assets shape (`REQ-013`, `REQ-014`).** Two new REQs cover the `[assets] directory` block on `wrangler.toml` and the SPA fallback discipline via `run_worker_first`. Three new USs in the existing 12xx band (`US-12113` SPA-on-Workers deploy, `US-12114` assets-directory elicitation, `US-12115` migrate-from-Pages guidance) bind the runtime-observable ACs to `TAC-1302-deploy-cloudflare-workers-wrangler-manifest`.
 - **Ratified shape decision (`ADR-1306-deploy-cloudflare-workers-spa-shape`).** Body carries the Cloudflare landing-page quote verbatim; the contribution entry carries `recommendedDefault: true` and `standardsTraceClause: Cloudflare Pages landing-page recommendation (2026-09-06)` per `blueprint-authoring.md` section 8a.2. The ADR names a project-level supersede path for projects that keep the bare-Worker shape or stay on Pages.
-- **Two new elicits.** `assets-directory` (kind `string`, default empty) picks the static-assets root; `run-worker-first` (kind `boolean`, default `false`) picks the SPA fallback discipline. The loader-side `when-elicitedNonEmpty` predicate the spec calls for is a mechanism follow-up, so `run-worker-first` fires unconditionally in v1.2.0; the guide teaches that the elicit is only meaningful when `assets-directory` is non-empty.
+- **Two new elicits.** `assets-directory` (kind `string`, default empty) picks the static-assets root; `run-worker-first` (kind `string`, default `"false"`) picks the SPA fallback discipline and accepts both wrangler-side shapes the Cloudflare Workers static-assets binding page documents (https://developers.cloudflare.com/workers/static-assets/binding/, verified 2026-09-09): the boolean form as `"true"` / `"false"` and the array-of-patterns form as a JSON literal such as `["/api/*", "!/api/docs/*"]` (at most 100 entries; glob `*` for deep matching; leading `!` for negatives; negatives take precedence). The loader-side `when-elicitedNonEmpty` predicate the spec calls for is a mechanism follow-up, so `run-worker-first` fires unconditionally in v1.2.0; the guide teaches that the elicit is only meaningful when `assets-directory` is non-empty.
 - **Probe module (`contributions/probes/assets-manifest-scan.mjs`).** `accountBound: false`, `anchorAcId: AC-12113-1`. Source-tree parser reads the applied fixture's `wrangler.toml` and asserts the `[assets]` shape against the elicited answers; refuses on `pages_build_output_dir` presence anywhere on the manifest (the Workers-with-static-assets shape and the Pages shape are mutually exclusive per the Cloudflare static-assets doc).
-- **Shared sample-app fixture (`packages/rcf-lite/test/fixtures/cf-platform/`).** T-0 mints the fixture; T-1 (KV), T-2 (cron), T-3 (Durable Objects) and T-5's Turnstile sub-fixture extend it later. Ships `wrangler.toml` with the ratified `[assets]` block, `dist/index.html`, a minimal `src/index.mjs` Worker entry, `package.json` with `wrangler` as a devDependency and `wrangler dev` as the start script, a `run-assets-manifest-scan.mjs` shim wiring the probe against the fixture, and a `README.md` naming the manual `wrangler dev` boot line and the two induced-failure switches (`SIMULATE_MIXED_SHAPE`, `SIMULATE_EMPTY_ASSETS`). The fixture never binds port 4200.
+- **Shared sample-app fixture (`packages/rcf-lite/test/fixtures/cf-platform/`).** This blueprint mints the fixture; the KV, cron and Durable Objects blueprints, and the Turnstile sub-fixture, extend it later. Ships `wrangler.toml` with the ratified `[assets]` block, `dist/index.html`, a minimal `src/index.mjs` Worker entry, `package.json` with `wrangler` as a devDependency and `wrangler dev` as the start script, a `run-assets-manifest-scan.mjs` shim wiring the probe against the fixture, and a `README.md` naming the manual `wrangler dev` boot line and the two induced-failure switches (`SIMULATE_MIXED_SHAPE`, `SIMULATE_EMPTY_ASSETS`). The fixture never binds port 4200.
 
 A project on v1.1.0 picks up v1.2.0 with the same compose invocation; a fresh apply on a project answering both elicits reads the applied sidecar at `rcf/blueprints/deploy-cloudflare-workers.applied.json`. A project on Pages that wants to migrate reads the guide's new `Workers-with-static-assets: the SPA-on-Workers shape` section for the Cloudflare migrate-from-Pages link.
 

package/blueprints/deploy-cloudflare-workers/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "deploy-cloudflare-workers",
-  "version": "1.2.0",
+  "version": "1.3.2",
   "category": "deploy",
   "contributions": [
     {
@@ -228,9 +228,9 @@
     },
     {
       "id": "run-worker-first",
-      "prompt": "Run Worker first: whether the Worker fetch handler runs BEFORE static asset lookup for every request. True emits run_worker_first = true under the [assets] block (right for a SPA whose Worker owns arbitrary routing or whose auth middleware must gate every path). False (default) omits the field and lets Cloudflare's runtime serve a matching static asset before the Worker runs. Only meaningful when assets-directory is non-empty; the loader-side when-elicitedNonEmpty predicate is a mechanism follow-up.",
-      "kind": "boolean",
-      "default": false
+      "prompt": "Run Worker first: whether the Worker fetch handler runs BEFORE static asset lookup. Two accepted shapes per the Cloudflare Workers static-assets binding page (https://developers.cloudflare.com/workers/static-assets/binding/): (a) the boolean form as the literal string \"true\" or \"false\" (\"true\" emits `run_worker_first = true` under [assets], right for a SPA whose Worker owns arbitrary routing or whose auth middleware must gate every path; \"false\" or the empty string omits the field and lets Cloudflare's runtime serve a matching static asset before the Worker runs); (b) the array-of-patterns form as a JSON literal (for example, `[\"/api/*\", \"!/api/docs/*\"]`) that the manifest emits as `run_worker_first = [...]` under [assets] so the Worker runs first only on matched routes (glob `*` for deep matching; leading `!` for negative patterns; negative patterns take precedence; at most 100 entries per the vendor page). Only meaningful when assets-directory is non-empty.",
+      "kind": "string",
+      "default": "false"
     }
   ],
   "suggestedCompanions": [

package/blueprints/deploy-cloudflare-workers/contributions/adrs/adr-1303-deploy-cloudflare-workers-preview-vs-production.json

@@ -6,7 +6,7 @@
   "status": "accepted",
   "title": "Preview URLs (per-version-id + stable alias) and production URL are distinct addressable surfaces; the promote step is what changes which one production maps to",
   "context": "The failure mode this ADR closes is the collapsed URL: a project where the reviewer of a merged change and the visitor to the deployed application look at the same URL. When the preview surface and the production surface are the same string, every merge is a production act, review is what happens after users notice, and rollback is a second merge landing before enough users notice. The vendor's own primitive shape supports keeping them distinct: every uploaded version has a permanent per-version-id URL and a mutable stable-alias URL that can be pointed at the newest-of-main; production is the mapped custom domain (or the workers.dev production host) whose current version id changes only on an explicit deploy verb.",
-  "decision": "The blueprint mandates three URL kinds per Worker, all distinct hostnames, all discoverable through the Deploy Adapter's `deploy status` verb: (1) a per-VERSION-ID URL, unique per upload, permanent, useful for pinning a change-review link; (2) a STABLE PREVIEW ALIAS URL fixed to an operator-chosen alias string (the common default is `main`), always resolving to the newest-of-main uploaded version, useful for a persistent stakeholder-shareable link; (3) a PRODUCTION URL, declared under the wrangler manifest's `route`/`routes`/`workers_dev`/custom-domain stanza, changing which version it maps to only when a `promote` workflow runs. The Preview URL Resolver (TAC-1303) assembles the first two and refuses any alias string whose assembled host segment equals the production URL's host segment. The manifest loader refuses a wrangler config whose production route resolves to the preview alias URL host with `DEPLOY_URL_COLLAPSED`.",
+  "decision": "The blueprint mandates three URL kinds per Worker, all distinct hostnames, all discoverable through the Deploy Adapter's `deploy status` verb: (1) a per-version-id URL, unique per upload, permanent, useful for pinning a change-review link; (2) a STABLE PREVIEW ALIAS URL fixed to an operator-chosen alias string (the common default is `main`), always resolving to the newest-of-main uploaded version, useful for a persistent stakeholder-shareable link; (3) a PRODUCTION URL, declared under the wrangler manifest's `route`/`routes`/`workers_dev`/custom-domain stanza, changing which version it maps to only when a `promote` workflow runs. The Preview URL Resolver (TAC-1303) assembles the first two and refuses any alias string whose assembled host segment equals the production URL's host segment. The manifest loader refuses a wrangler config whose production route resolves to the preview alias URL host with `DEPLOY_URL_COLLAPSED`.",
   "consequences": "Reviewers and stakeholders reach the newest-of-main at a persistent, memorable URL that never masquerades as production. Users hit production at a hostname that only changes version behind an explicit operator act. Change-review links are pinnable to a specific version id and never rot. The trade is one Worker now surfaces three URLs the project has to reason about (and the operator has to explain once when a new engineer joins); the payoff is the class of leaks-through-collapsed-URL is closed by the manifest's own validation, not by discipline.",
   "alternativesConsidered": [
     {

package/blueprints/deploy-cloudflare-workers/contributions/adrs/adr-1306-deploy-cloudflare-workers-spa-shape.json

@@ -5,9 +5,9 @@
   "version": "1.2.0",
   "status": "accepted",
   "title": "Workers-with-static-assets is the ratified SPA-on-Workers deploy shape; Pages is a documented alternative held for legacy projects only",
-  "context": "Cloudflare ships two shapes for browsing static assets in front of a Workers-tier deploy target: Cloudflare Pages (a workflow-shaped product with its own build pipeline and its own preview URL model) and Workers-with-static-assets (a wrangler.toml [assets] block declaring a directory the Cloudflare runtime serves at the edge). Cloudflare's own Pages landing page states, verbatim (fetched 2026-09-06): 'Workers supports most Pages use cases and offers a broader feature set. It is Cloudflare's primary platform for building applications. Start new projects with Workers.' The prior v1.1.0 blueprint blessed neither shape as the default; v1.1.0 taught the wrangler [assets] block in an asset sample but left the shape choice implicit. The T-0 round bumps the blueprint to v1.2.0 to close the gap: a rcf-lite project choosing SPA-on-Workers gets a single, ratified wrangler shape rather than a hand-rolled convention, and the ratified shape follows Cloudflare's own recommendation for new projects.",
+  "context": "Cloudflare ships two shapes for browsing static assets in front of a Workers-tier deploy target: Cloudflare Pages (a workflow-shaped product with its own build pipeline and its own preview URL model) and Workers-with-static-assets (a wrangler.toml [assets] block declaring a directory the Cloudflare runtime serves at the edge). Cloudflare's own Pages landing page states, verbatim (fetched 2026-09-06): 'Workers supports most Pages use cases and offers a broader feature set. It is Cloudflare's primary platform for building applications. Start new projects with Workers.' The prior v1.1.0 blueprint blessed neither shape as the default; v1.1.0 taught the wrangler [assets] block in an asset sample but left the shape choice implicit. The round-6 bump takes the blueprint to v1.2.0 to close the gap: a rcf-lite project choosing SPA-on-Workers gets a single, ratified wrangler shape rather than a hand-rolled convention, and the ratified shape follows Cloudflare's own recommendation for new projects.",
   "decision": "The blueprint blesses Workers-with-static-assets as the ratified SPA-on-Workers deploy shape (recommendedDefault true for new SPA projects). A project answering the elicited assets-directory parameter with a non-empty path emits an [assets] block on wrangler.toml whose directory value carries the elicited path; a project answering with an empty path keeps the bare-Worker shape (no [assets] block). The elicited run-worker-first (boolean, default false) surfaces the SPA fallback discipline: truthy answers emit run_worker_first = true under the [assets] block; falsy or unanswered answers omit the field, letting Cloudflare's runtime run asset lookup before the Worker fetch handler. The blueprint does not mint a Cloudflare Pages blueprint; a future deploy-cloudflare-pages-legacy sibling mints on demand only if a project cannot make the jump. Every existing v1.1.0 contribution carries through unchanged.",
-  "consequences": "One ratified shape lands on the shelf for greenfield SPA-on-Workers projects; the shape's standards trace is the Cloudflare Pages landing-page recommendation (2026-09-06 snapshot). The two new elicits become part of the operator surface at blueprint add: assets-directory names the static-assets root, run-worker-first names the SPA fallback discipline. A project generating both an [assets] block and a Pages-only pages_build_output_dir field is a mixed-shape drift the T-0 probe (assets-manifest-scan.mjs) refuses. A project on the legacy Pages shape stays on v1.1.0 semantics until it migrates; the guide's new Workers-with-static-assets section links Cloudflare's migrate-from-Pages walkthrough for projects that choose to jump. Future round-6 blueprints (T-1 KV, T-2 cron, T-3 DO, T-4 Access, T-5 Turnstile, T-6 rate-limiting) all compose on this shape via the shared cf-platform sample-app fixture.",
+  "consequences": "One ratified shape lands on the shelf for greenfield SPA-on-Workers projects; the shape's standards trace is the Cloudflare Pages landing-page recommendation (2026-09-06 snapshot). The two new elicits become part of the operator surface at blueprint add: assets-directory names the static-assets root, run-worker-first names the SPA fallback discipline. A project generating both an [assets] block and a Pages-only pages_build_output_dir field is a mixed-shape drift the probe (assets-manifest-scan.mjs) refuses. A project on the legacy Pages shape stays on v1.1.0 semantics until it migrates; the guide's new Workers-with-static-assets section links Cloudflare's migrate-from-Pages walkthrough for projects that choose to jump. Future blueprints in this family (KV, cron, DO, Access, Turnstile, rate-limiting) all compose on this shape via the shared cf-platform sample-app fixture.",
   "alternativesConsidered": [
     {
       "name": "Ship a Cloudflare Pages blueprint alongside deploy-cloudflare-workers",

package/blueprints/deploy-cloudflare-workers/contributions/probes/assets-manifest-scan.mjs

@@ -1,6 +1,6 @@
 // Source-tree scan probe for the deploy-cloudflare-workers v1.2.0
-// Workers-with-static-assets shape (T-0 of the Cloudflare round 6
-// spec, section 5.0). accountBound false: this probe reads the
+// Workers-with-static-assets shape owned by TAC-1302 on this
+// blueprint. accountBound false: this probe reads the
 // applied fixture wrangler.toml and asserts three properties:
 //
 //   1. When the elicited assets-directory answer is non-empty, the
@@ -31,6 +31,24 @@ export const accountBound = false;
 // blueprint's manifest declares (top-level scalars, one [assets]
 // table, and boolean/string literals). Reaches for no runtime dep;
 // keeps the probe accountBound-false and dependency-free.
+
+function interpretRunWorkerFirst(v) {
+  // Accepts boolean true/false, string 'true'/'false', or a JSON array literal such as ["/api/*"].
+  // Returns { truthy: boolean, arrayForm: null | string[] }.
+  if (v === true) return { truthy: true, arrayForm: null };
+  if (v === false) return { truthy: false, arrayForm: null };
+  if (typeof v === 'string') {
+    const s = v.trim();
+    if (s === 'true') return { truthy: true, arrayForm: null };
+    if (s === 'false' || s === '') return { truthy: false, arrayForm: null };
+    if (s.startsWith('[')) {
+      try { const arr = JSON.parse(s); if (Array.isArray(arr)) return { truthy: true, arrayForm: arr }; } catch { /* fall through */ }
+    }
+  }
+  if (Array.isArray(v)) return { truthy: true, arrayForm: v };
+  return { truthy: false, arrayForm: null };
+}
+
 export function parseWranglerToml(text) {
   const lines = text.split(/\r?\n/);
   const root = {};
@@ -90,7 +108,7 @@ export async function scan(opts) {
     parsed,
     elicited: {
       assetsDirectory: elicited['assets-directory'] || '',
-      runWorkerFirst: elicited['run-worker-first'] === true,
+      runWorkerFirst: interpretRunWorkerFirst(elicited['run-worker-first']),
     },
   };
 
@@ -117,17 +135,17 @@ export async function scan(opts) {
       });
     }
     const runWorkerFirstOnManifest = assets && Object.prototype.hasOwnProperty.call(assets, 'run_worker_first');
-    if (detail.elicited.runWorkerFirst) {
-      if (!runWorkerFirstOnManifest || assets.run_worker_first !== true) {
+    if (detail.elicited.runWorkerFirst.truthy) {
+      const expectShape = detail.elicited.runWorkerFirst.arrayForm; const manifestVal = runWorkerFirstOnManifest ? assets.run_worker_first : undefined; const boolMatches = expectShape === null && manifestVal === true; const arrMatches = Array.isArray(expectShape) && Array.isArray(manifestVal) && JSON.stringify(expectShape) === JSON.stringify(manifestVal); if (!runWorkerFirstOnManifest || (!boolMatches && !arrMatches)) {
         results.push({
           verdict: 'fail',
-          detail: 'run_worker_first mismatch: elicited answer is true but manifest carries ' + (runWorkerFirstOnManifest ? String(assets.run_worker_first) : 'no run_worker_first key'),
+          detail: 'run_worker_first mismatch: elicited answer expected ' + (expectShape === null ? 'true' : JSON.stringify(expectShape)) + ' but manifest carries ' + (runWorkerFirstOnManifest ? JSON.stringify(assets.run_worker_first) : 'no run_worker_first key'),
           anchorAcId,
         });
       } else {
         results.push({
           verdict: 'pass',
-          detail: 'assets.run_worker_first equals true, matching the elicited run-worker-first answer',
+          detail: 'assets.run_worker_first ' + (expectShape === null ? 'equals true' : 'equals array ' + JSON.stringify(manifestVal)) + ', matching the elicited run-worker-first answer',
           anchorAcId,
         });
       }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-001.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1302-deploy-cloudflare-workers-wrangler-manifest",
+    "field": "responsibilities.manifest"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-002.json

@@ -2,7 +2,7 @@
   "reqId": "deploy-cloudflare-workers-REQ-002",
   "prdId": "PRD-001",
   "title": "One deploy adapter module is the sole caller of the deploy CLI",
-  "description": "The project exposes a single Deploy Adapter module that wraps the deploy CLI (the vendor's `wrangler` binary when the default vendor is in play). Every path that uploads a version, promotes a version, lists versions, or reads deploy state routes through this module. Nothing else in the project source tree spawns the CLI, imports the vendor SDK, or issues an HTTP call to the vendor's deploy API. The module exposes a fixed named-verb surface (`uploadVersion`, `promoteVersion`, `listVersions`, `resolveNewestOfMain`, `describeVersion`) that is stable across the blueprint's major version.",
+  "description": "The project exposes a single Deploy Adapter module that wraps the deploy CLI (the vendor's `wrangler` binary when the default vendor is in play). Every path that uploads a version, promotes a version, lists versions, or reads deploy state routes through this module. Nothing else in the project source tree spawns the CLI, imports the vendor SDK, or issues an HTTP call to the vendor's deploy API. The module exposes a fixed named-verb surface (`uploadVersion`, `promoteVersion`, `listVersions`, `resolveNewestOfMain`, `describeVersion`) that is stable across the blueprint's major version. The adapter exposes a stable deployStatus verb that composes the manifest-declared production URL, the preview alias URL resolved via the Preview URL Resolver, and the currently serving version id (from the Cloudflare Deployments API); the verb is the sole channel through which any AC observes those addressable surfaces.",
   "category": "technical",
   "domain": "deploy",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1301-deploy-cloudflare-workers-deploy-adapter",
+    "field": "responsibilities.uploadVersion"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-003.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1303-deploy-cloudflare-workers-preview-url-resolver",
+    "field": "interfaces.aliasQuery"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-004.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1304-deploy-cloudflare-workers-promote-gate",
+    "field": "responsibilities.explicitPromote"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-005.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1302-deploy-cloudflare-workers-wrangler-manifest",
+    "field": "interfaces.productionUrl"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-006.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1302-deploy-cloudflare-workers-wrangler-manifest",
+    "field": "interfaces.bindings"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-007.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1306-deploy-cloudflare-workers-deploy-ci-workflows",
+    "field": "responsibilities.build-and-upload"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-008.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1306-deploy-cloudflare-workers-deploy-ci-workflows",
+    "field": "responsibilities.promoteWorkflow"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-009.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1304-deploy-cloudflare-workers-rollback-is-promote",
+    "field": "decision.rollbackIsPromote"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-010.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1305-deploy-cloudflare-workers-served-surface-verifier",
+    "field": "responsibilities.probe"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-011.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1305-deploy-cloudflare-workers-dev-mode-drift",
+    "field": "decision.devMode"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-012.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1306-deploy-cloudflare-workers-deploy-ci-workflows",
+    "field": "responsibilities.buildProvenance"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-013.json

@@ -14,5 +14,9 @@
   "version": "1.2.0",
   "status": "approved",
   "createdAt": "2026-09-07T00:00:00Z",
-  "updatedAt": "2026-09-07T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1306-deploy-cloudflare-workers-spa-shape",
+    "field": "decision.assets"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-014.json

@@ -2,10 +2,10 @@
   "reqId": "deploy-cloudflare-workers-REQ-014",
   "prdId": "PRD-001",
   "title": "SPA fallback discipline: run_worker_first flips the assets pipeline off the fetch handler's critical path",
-  "description": "The blueprint elicits `run-worker-first` (boolean, default false) alongside the `[assets] directory` shape from REQ-013. When the operator answers truthy, the generated wrangler manifest emits `run_worker_first = true` under the `[assets]` block: Cloudflare's runtime runs the Worker's fetch handler BEFORE looking up a static asset for the requested path. That is the shape a SPA-on-Workers project uses when the Worker owns arbitrary routing or when the Worker's auth middleware must gate every path a static file could shadow. When the operator answers falsy or leaves the elicit unanswered, `run_worker_first` is absent from the manifest and Cloudflare's runtime looks up a static asset first, falling back to the Worker only when no asset matches. The Worker code and the guide teach both shapes; the elicit surface is one boolean, the wrangler shape is one line.",
+  "description": "The blueprint elicits `run-worker-first` (boolean, default false) alongside the `[assets] directory` shape from REQ-013. When the operator answers truthy, the generated wrangler manifest emits `run_worker_first = true` under the `[assets]` block: Cloudflare's runtime runs the Worker's fetch handler BEFORE looking up a static asset for the requested path. That is the shape a SPA-on-Workers project uses when the Worker owns arbitrary routing or when the Worker's auth middleware must gate every path a static file could shadow. When the operator answers falsy or leaves the elicit unanswered, `run_worker_first` is absent from the manifest and Cloudflare's runtime looks up a static asset first, falling back to the Worker only when no asset matches. The Worker code and the guide teach both shapes; the elicit surface is one boolean, the wrangler shape is one line. The elicited run-worker-first answer is true to emit run_worker_first = true on the wrangler [assets] block (Worker gates every request before asset lookup); false or absent omits the field (Cloudflare's runtime serves a matching static asset before the Worker runs).",
   "category": "technical",
   "domain": "deploy",
-  "priority": "should",
+  "priority": "must",
   "rationale": "The default (asset lookup first, Worker on miss) is right for a static-content-heavy project. The truthy branch is what keeps auth middleware from being silently bypassed by an unauthenticated request for a file the assets pipeline serves from the edge cache. Naming the discipline as its own REQ makes the shape trade legible; anchoring the elicit to a wrangler line keeps the choice observable in the applied project.",
   "tags": [
     "blueprint:deploy-cloudflare-workers",
@@ -14,5 +14,9 @@
   "version": "1.2.0",
   "status": "approved",
   "createdAt": "2026-09-07T00:00:00Z",
-  "updatedAt": "2026-09-07T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1306-deploy-cloudflare-workers-spa-shape",
+    "field": "decision.run_worker_first"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/tacs/tac-1301-deploy-cloudflare-workers-deploy-adapter.json

@@ -14,7 +14,8 @@
     "Expose `describeVersion({ versionId })` returning provenance (`versionSha`, `builtAt`, `ciRunUrl`) and URLs (`versionIdUrl`) for the named version; `versionSha` is the git commit sha baked into the version's bundle by `build-and-upload`, distinct from the version UUID `versionId` names (AC-12112-1, AC-12112-2).",
     "Expose `resolveSubdomain()` that returns the account's workers.dev subdomain string every URL-assembly path needs; reads the `WORKERS_DEV_SUBDOMAIN` env var when set (project pin) and otherwise queries the vendor's `GET /accounts/<accountId>/workers/subdomain` REST endpoint; caches the value for the process's lifetime (AC-12105-1).",
     "Refuse a manifest whose production route resolves to the same host as the preview alias URL with `DEPLOY_URL_COLLAPSED` (AC-12105-2).",
-    "Route every CLI invocation through a redactor that scrubs the vendor API token and account id from every emitted log line (AC-12107-3, AC-12106-2)."
+    "Route every CLI invocation through a redactor that scrubs the vendor API token and account id from every emitted log line (AC-12107-3, AC-12106-2).",
+    "Expose a stable deployStatus verb that composes the manifest-declared production URL, the preview alias URL (via the Preview URL Resolver TAC-1303), and the currently serving version id (via the Cloudflare Deployments API); every AC that observes an addressable served surface reads it through this verb (AC-12105-1)."
   ],
   "internalStructure": "One stateless class per process with an injected vendor binding and an injected redactor. The vendor binding is a project-authored module implementing the port in the interfaces block; the default vendor binding shells to the `wrangler` CLI and lives under the same package as the adapter. Every verb is a thin translation from the named surface to a vendor CLI invocation (or SDK call) plus response parsing plus provenance-URL assembly.",
   "interfaces": [
@@ -50,5 +51,5 @@
   ],
   "tradeoffs": "The adapter is process-local and stateless; every call reaches the vendor. That means a chain of adapter calls in one CI step costs one vendor round-trip per call rather than a shared session. The trade keeps the adapter easy to reason about and easy to reimplement against a different vendor. A project that wants a session-shared invocation supplies a vendor binding whose backing is a long-lived process rather than a CLI spawn per call; the port shape does not change.",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-cloudflare-workers/contributions/tacs/tac-1302-deploy-cloudflare-workers-wrangler-manifest.json

@@ -13,7 +13,10 @@
     "Refuse a manifest that carries any inline secret value; scan the parsed object for keys under the vendor's secret-declaration primitive whose value is not an empty declaration (AC-12101-3, AC-12106-1).",
     "Refuse a manifest whose production route stanza resolves to the same host as the preview alias URL with `DEPLOY_URL_COLLAPSED` (AC-12105-2).",
     "Expose a `bindings()` accessor listing every declared binding (kind, name) for downstream consumers.",
-    "Expose a `productionUrl()` accessor deriving the production URL from the `routes`/`route`/`workers_dev`/custom-domain declaration."
+    "Expose a `productionUrl()` accessor deriving the production URL from the `routes`/`route`/`workers_dev`/custom-domain declaration.",
+    "Load and expose the [assets] block per the current Cloudflare Workers static-assets contract (https://developers.cloudflare.com/workers/static-assets/binding/): an empty or absent [assets].directory answer keeps the bare-Worker shape and emits no [assets] block; a non-empty answer emits [assets].directory verbatim and enables the static-asset pipeline (AC-12113-1, AC-12114-1).",
+    "Map the elicited run-worker-first answer to the wrangler literal on the emitted [assets] block per the Cloudflare Workers static-assets binding page (https://developers.cloudflare.com/workers/static-assets/binding/, verified 2026-09-09). Two accepted answer shapes; both round-trip through the manifest reader (AC-12115-1): (a) boolean shape - \"false\", the empty string or absent OMITS the field and lets asset lookup run first, \"true\" EMITS `run_worker_first = true` and the Worker runs first for every request; (b) array-of-patterns shape - a JSON literal such as [\"/api/*\", \"!/api/docs/*\"] EMITS `run_worker_first = [\"/api/*\", \"!/api/docs/*\"]` and the Worker runs first only on matched routes (glob `*` for deep matching; leading `!` for negatives; negatives take precedence; at most 100 entries). Any other shape refuses at load with an unknownRunWorkerFirstShape error kind naming the accepted forms.",
+    "Refuse a wrangler manifest that declares both an [assets] block and a legacy pages_build_output_dir field (their meanings collide on the same deploy). The refusal names the collision and points the operator at the [assets] block as the ratified shape."
   ],
   "internalStructure": "One parser module per format (TOML and JSONC), one validator that walks the parsed object against the shape rules, one binding-usage scanner that walks the Worker source AST for env-accessor patterns, and one URL-derivation module that inspects the routes stanza. All pure functions; no I/O outside the initial file read.",
   "interfaces": [
@@ -41,5 +44,5 @@
   "dependencies": [],
   "tradeoffs": "The loader owns validation but does not own the vendor's own manifest-level validation (which happens later at the vendor CLI). Two-stage validation means a manifest that passes this loader can still fail the vendor's own load; the trade keeps the loader project-local and fast (no vendor round-trip on every CI step) while catching the classes this blueprint cares about (undeclared bindings, inline secrets, collapsed URLs) before the vendor call. A project can point the loader at a project-authored TOML dialect (a preprocessor step) by wrapping the manifestFile interface.",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-cloudflare-workers/contributions/user-stories/deploy-cloudflare-workers-us-12101.json

@@ -16,7 +16,8 @@
       "when": "a manifest loader parses the file",
       "then": "the loader returns a config object whose `name` is a non-empty string, `main` resolves to an existing entry file, `compatibility_date` matches `\\d{4}-\\d{2}-\\d{2}`, and every non-secret binding name referenced from the Worker's source appears as a declaration key in the config; the config carries no `[secrets]` block",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-12101-2",
@@ -25,7 +26,8 @@
       "when": "the CI gate runs on the change",
       "then": "the run fails with a stable-coded `WRANGLER_BINDING_UNDECLARED` error naming the offending source path and the missing binding name",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-12101-3",
@@ -34,21 +36,31 @@
       "when": "a redaction-scanner runs against `wrangler.toml`, any committed environment file, and the CI workflows",
       "then": "no file in the scanned set contains any byte sequence in `V`",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "disposition": "template"
     },
     {
       "id": "AC-12101-4",
-      "description": "When the manifest declares an `[assets]` block AND the Worker's fetch handler installs an auth gate on any route whose path could be shadowed by a file under the assets `directory`, the manifest MUST declare `[assets] run_worker_first` naming every gated route (glob-matched); a deployed request to any listed path is answered by the fetch handler before the assets pipeline runs. Without the listing, the assets pipeline serves the shadowing file directly and the auth gate is silently bypassed at the edge.",
-      "given": "a Worker whose fetch handler installs an auth middleware on `/notes` and a `./public/notes.html` file present at build time; the deployed Worker is reachable at production URL P",
-      "when": "an unauthenticated HTTP GET hits `P/notes`",
-      "then": "the response is the auth middleware's unauthenticated response (a redirect to sign-in, a 401, or the middleware's declared shape); the response is NOT the byte content of `./public/notes.html`; a manifest that omits `/notes` from `[assets] run_worker_first` fails the deployed observation because the assets pipeline answered before the fetch handler ran",
+      "description": "The wrangler manifest [assets] block, when the elicited run-worker-first answer is true, carries the boolean literal run_worker_first = true (and only that literal). Every application shipped under this shape asserts that an unauthenticated request to any protected route (for example /notes) reaches the Worker fetch handler before the static-asset pipeline runs, and the Worker's auth middleware gates it. The array-of-patterns form on the same field is a vendor-supported alternative recorded on TAC-1302 but not the shape this AC binds.",
+      "given": "wrangler manifest [assets].directory non-empty and run_worker_first = true",
+      "when": "an unauthenticated request lands on a Worker route the auth middleware protects",
+      "then": "the fetch handler runs before the static-asset pipeline, the auth middleware refuses, and no static asset is served",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1302-deploy-cloudflare-workers-wrangler-manifest",
+        "field": "interfaces.manifestFile"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/workers/static-assets/binding/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-1302-deploy-cloudflare-workers-wrangler-manifest"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }