rcf-lite 0.26.0 → 0.28.0

package/blueprints/deploy-cloudflare-workers/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 1.3.2 (register patch, 2026-09-10)
+
+- Register: neutral wording on the ADR-1306 consequences field (closes F-1); no capability change.
+
+## 1.3.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.3.0 - 2026-09-09
+
+Adds deliveredBy on nine REQs (001, 003, 005, 006, 007, 010, 011, 013, 014). Adds ownerRef on AC-12102-2/3 and AC-12109-1 (deployAdapter) and AC-12105-1 (productionUrl). AC-12101-4 rests on the boolean `run_worker_first = true` form with vendor citation https://developers.cloudflare.com/workers/static-assets/binding/. TAC-1302 carries responsibilities for the `[assets].directory` branches, the boolean and array-of-patterns `run_worker_first` mappings, and the `pages_build_output_dir` mutual-exclusion refusal. REQ-002 and TAC-1301 carry the stable `deployStatus` verb that composes production URL, preview alias URL, and currently serving version id. ADR-1303 spelling aligns with TAC-1303. Adds disposition to every AC.
+
 All notable changes to the `deploy-cloudflare-workers` blueprint are recorded here.
 The format follows Keep a Changelog. Versions are semver, per
 `packages/rcf-lite/docs/blueprint-authoring.md` section 6.
@@ -7,7 +19,7 @@ The format follows Keep a Changelog. Versions are semver, per
 ## 1.2.0 - 2026-09-07
 
 Additive minor bump. Blesses the Workers-with-static-assets shape as the
-ratified SPA-on-Workers deploy shape, per the Cloudflare Pages
+shipped SPA-on-Workers deploy shape, per the Cloudflare Pages
 landing-page recommendation (2026-09-06). Seven new contributions in the
 existing 12xx US band and 13xx suffix block; every shipped v1.1.0
 contribution carries through unchanged.
@@ -30,7 +42,7 @@ Added
 - US `-US-12115`: migrate-from-Pages guidance. Guide section links
   Cloudflare's own migrate-from-Pages walkthrough.
 - ADR `ADR-1306-deploy-cloudflare-workers-spa-shape`: Workers-with-
-  static-assets as the ratified SPA-on-Workers deploy shape.
+  static-assets as the shipped SPA-on-Workers deploy shape.
   Contribution entry carries `recommendedDefault: true` and
   `standardsTraceClause: Cloudflare Pages landing-page recommendation
   (2026-09-06)`. Body quotes the landing-page recommendation verbatim
@@ -65,5 +77,8 @@ Notes
 - `suggestedCompanions` unchanged (`logging`, `errorHandling`).
 - The shared `cf-platform` sample-app fixture at
   `packages/rcf-lite/test/fixtures/cf-platform/` ships alongside this
-  bump as the probe target. T-1 (KV), T-2 (cron), T-3 (Durable Objects)
-  and T-5's Turnstile sub-fixture extend the same fixture later.
+  bump as the probe target. This blueprint mints the fixture; the KV,
+  cron and Durable Objects blueprints, and the Turnstile sub-fixture,
+  extend the same fixture later.
+
+Widens the run-worker-first elicit from kind boolean to kind string so both wrangler-side shapes accepted by the Cloudflare Workers static-assets binding (the boolean form and the array-of-patterns form) round-trip through the operator surface without silent narrowing. TAC-1302 responsibility 8 is rewritten to name both shapes with the emitted wrangler literal for each. Adds AC-12113-4 binding the array-of-patterns form on US-12113 with vendorCitation, and adds vendorCitation to AC-12113-2 (boolean form). README and guide teach both shapes. Adds deliveredBy on REQ-002, REQ-004, REQ-008, REQ-009, REQ-012. AC-12102-2, AC-12102-3, AC-12108-1, AC-12108-3, AC-12111-1, and AC-12112-3 carry vendorCitation.

package/blueprints/deploy-cloudflare-workers/README.md

@@ -28,9 +28,9 @@ The doc set is contributions (copied into the project tree by `rcf define bluepr
 
 ## What it contributes, and what it deliberately does not
 
-Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision 5) and no code.
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (shipped policy 5) and no code.
 
-No FBS contributions, as a matter of principle (ratified policy 2026-08-19): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the deploy shape, the adapter contract, the manifest shape, the three URL kinds, the promote-is-explicit posture, the rollback-is-promote posture, the served-surface verify shape, the dev-mode drift posture, the build-provenance surface); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
+No FBS contributions, as a matter of principle (policy): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the deploy shape, the adapter contract, the manifest shape, the three URL kinds, the promote-is-explicit posture, the rollback-is-promote posture, the served-surface verify shape, the dev-mode drift posture, the build-provenance surface); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
 
 Deliberately not contributed: a vendor CLI implementation (the default vendor is named in ADR-1302 as Cloudflare's `wrangler`, the shape of the vendor binding is fixed by TAC-1301, the actual binding code is a project-authored implementation shelling to the CLI); a project's authorisation model for who is allowed to promote (promote authorisation sits at the CI platform's own permission model on the `workflow_dispatch` primitive); a promote-approval workflow (a project that wants an approver review on every promote layers a manual-approval step above the `workflow_dispatch` trigger); a canary or gradual-rollout controller (the vendor's own primitives support gradual promote where the operator wants it; the blueprint mandates the served-surface verifier on the eventual full promote); an image or artefact registry (the vendor's own upload-and-version primitive is the artefact store); a project's audit-log storage engine (the blueprint fixes the deploy-log record shape, not where the records land); a status page (the observability-essentials blueprint owns `statusPageContract`; the deploy log feeds into it); the secrets pipeline itself (the security-secrets-management blueprint owns `secretsSource`; this blueprint consumes it for the vendor API token and any application secret bindings the Worker reads).
 
@@ -46,13 +46,13 @@ Repo-root wrangler manifest as the sole declaration of Worker name, entry, compa
 
 ## What v1.2.0 adds
 
-v1.2.0 is an additive-minor bump. Every shipped v1.1.0 contribution carries through unchanged; the compose invocation is identical (`rcf define blueprint add <path-to>/blueprints/deploy-cloudflare-workers` unchanged); no capability minted; no new global topic; no runtime dependency added; `suggestedCompanions` unchanged (`logging`, `errorHandling`). The bump blesses the Workers-with-static-assets shape as the ratified SPA-on-Workers deploy shape, per the Cloudflare Pages landing-page recommendation (fetched 2026-09-06, verbatim quote on `ADR-1306`).
+v1.2.0 is an additive-minor bump. Every shipped v1.1.0 contribution carries through unchanged; the compose invocation is identical (`rcf define blueprint add <path-to>/blueprints/deploy-cloudflare-workers` unchanged); no capability minted; no new global topic; no runtime dependency added; `suggestedCompanions` unchanged (`logging`, `errorHandling`). The bump blesses the Workers-with-static-assets shape as the shipped SPA-on-Workers deploy shape, per the Cloudflare Pages landing-page recommendation (verbatim quote on `ADR-1306`).
 
 - **Workers-with-static-assets shape (`REQ-013`, `REQ-014`).** Two new REQs cover the `[assets] directory` block on `wrangler.toml` and the SPA fallback discipline via `run_worker_first`. Three new USs in the existing 12xx band (`US-12113` SPA-on-Workers deploy, `US-12114` assets-directory elicitation, `US-12115` migrate-from-Pages guidance) bind the runtime-observable ACs to `TAC-1302-deploy-cloudflare-workers-wrangler-manifest`.
 - **Ratified shape decision (`ADR-1306-deploy-cloudflare-workers-spa-shape`).** Body carries the Cloudflare landing-page quote verbatim; the contribution entry carries `recommendedDefault: true` and `standardsTraceClause: Cloudflare Pages landing-page recommendation (2026-09-06)` per `blueprint-authoring.md` section 8a.2. The ADR names a project-level supersede path for projects that keep the bare-Worker shape or stay on Pages.
-- **Two new elicits.** `assets-directory` (kind `string`, default empty) picks the static-assets root; `run-worker-first` (kind `boolean`, default `false`) picks the SPA fallback discipline. The loader-side `when-elicitedNonEmpty` predicate the spec calls for is a mechanism follow-up, so `run-worker-first` fires unconditionally in v1.2.0; the guide teaches that the elicit is only meaningful when `assets-directory` is non-empty.
+- **Two new elicits.** `assets-directory` (kind `string`, default empty) picks the static-assets root; `run-worker-first` (kind `string`, default `"false"`) picks the SPA fallback discipline and accepts both wrangler-side shapes the Cloudflare Workers static-assets binding page documents (https://developers.cloudflare.com/workers/static-assets/binding/, verified 2026-09-09): the boolean form as `"true"` / `"false"` and the array-of-patterns form as a JSON literal such as `["/api/*", "!/api/docs/*"]` (at most 100 entries; glob `*` for deep matching; leading `!` for negatives; negatives take precedence). The loader-side `when-elicitedNonEmpty` predicate the spec calls for is a mechanism follow-up, so `run-worker-first` fires unconditionally in v1.2.0; the guide teaches that the elicit is only meaningful when `assets-directory` is non-empty.
 - **Probe module (`contributions/probes/assets-manifest-scan.mjs`).** `accountBound: false`, `anchorAcId: AC-12113-1`. Source-tree parser reads the applied fixture's `wrangler.toml` and asserts the `[assets]` shape against the elicited answers; refuses on `pages_build_output_dir` presence anywhere on the manifest (the Workers-with-static-assets shape and the Pages shape are mutually exclusive per the Cloudflare static-assets doc).
-- **Shared sample-app fixture (`packages/rcf-lite/test/fixtures/cf-platform/`).** T-0 mints the fixture; T-1 (KV), T-2 (cron), T-3 (Durable Objects) and T-5's Turnstile sub-fixture extend it later. Ships `wrangler.toml` with the ratified `[assets]` block, `dist/index.html`, a minimal `src/index.mjs` Worker entry, `package.json` with `wrangler` as a devDependency and `wrangler dev` as the start script, a `run-assets-manifest-scan.mjs` shim wiring the probe against the fixture, and a `README.md` naming the manual `wrangler dev` boot line and the two induced-failure switches (`SIMULATE_MIXED_SHAPE`, `SIMULATE_EMPTY_ASSETS`). The fixture never binds port 4200.
+- **Shared sample-app fixture (`packages/rcf-lite/test/fixtures/cf-platform/`).** This blueprint mints the fixture; the KV, cron and Durable Objects blueprints, and the Turnstile sub-fixture, extend it later. Ships `wrangler.toml` with the ratified `[assets]` block, `dist/index.html`, a minimal `src/index.mjs` Worker entry, `package.json` with `wrangler` as a devDependency and `wrangler dev` as the start script, a `run-assets-manifest-scan.mjs` shim wiring the probe against the fixture, and a `README.md` naming the manual `wrangler dev` boot line and the two induced-failure switches (`SIMULATE_MIXED_SHAPE`, `SIMULATE_EMPTY_ASSETS`). The fixture never binds port 4200.
 
 A project on v1.1.0 picks up v1.2.0 with the same compose invocation; a fresh apply on a project answering both elicits reads the applied sidecar at `rcf/blueprints/deploy-cloudflare-workers.applied.json`. A project on Pages that wants to migrate reads the guide's new `Workers-with-static-assets: the SPA-on-Workers shape` section for the Cloudflare migrate-from-Pages link.
 

package/blueprints/deploy-cloudflare-workers/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "deploy-cloudflare-workers",
-  "version": "1.2.0",
+  "version": "1.3.2",
   "category": "deploy",
   "contributions": [
     {
@@ -228,9 +228,9 @@
     },
     {
       "id": "run-worker-first",
-      "prompt": "Run Worker first: whether the Worker fetch handler runs BEFORE static asset lookup for every request. True emits run_worker_first = true under the [assets] block (right for a SPA whose Worker owns arbitrary routing or whose auth middleware must gate every path). False (default) omits the field and lets Cloudflare's runtime serve a matching static asset before the Worker runs. Only meaningful when assets-directory is non-empty; the loader-side when-elicitedNonEmpty predicate is a mechanism follow-up.",
-      "kind": "boolean",
-      "default": false
+      "prompt": "Run Worker first: whether the Worker fetch handler runs BEFORE static asset lookup. Two accepted shapes per the Cloudflare Workers static-assets binding page (https://developers.cloudflare.com/workers/static-assets/binding/): (a) the boolean form as the literal string \"true\" or \"false\" (\"true\" emits `run_worker_first = true` under [assets], right for a SPA whose Worker owns arbitrary routing or whose auth middleware must gate every path; \"false\" or the empty string omits the field and lets Cloudflare's runtime serve a matching static asset before the Worker runs); (b) the array-of-patterns form as a JSON literal (for example, `[\"/api/*\", \"!/api/docs/*\"]`) that the manifest emits as `run_worker_first = [...]` under [assets] so the Worker runs first only on matched routes (glob `*` for deep matching; leading `!` for negative patterns; negative patterns take precedence; at most 100 entries per the vendor page). Only meaningful when assets-directory is non-empty.",
+      "kind": "string",
+      "default": "false"
     }
   ],
   "suggestedCompanions": [

package/blueprints/deploy-cloudflare-workers/contributions/adrs/adr-1303-deploy-cloudflare-workers-preview-vs-production.json

@@ -6,7 +6,7 @@
   "status": "accepted",
   "title": "Preview URLs (per-version-id + stable alias) and production URL are distinct addressable surfaces; the promote step is what changes which one production maps to",
   "context": "The failure mode this ADR closes is the collapsed URL: a project where the reviewer of a merged change and the visitor to the deployed application look at the same URL. When the preview surface and the production surface are the same string, every merge is a production act, review is what happens after users notice, and rollback is a second merge landing before enough users notice. The vendor's own primitive shape supports keeping them distinct: every uploaded version has a permanent per-version-id URL and a mutable stable-alias URL that can be pointed at the newest-of-main; production is the mapped custom domain (or the workers.dev production host) whose current version id changes only on an explicit deploy verb.",
-  "decision": "The blueprint mandates three URL kinds per Worker, all distinct hostnames, all discoverable through the Deploy Adapter's `deploy status` verb: (1) a per-VERSION-ID URL, unique per upload, permanent, useful for pinning a change-review link; (2) a STABLE PREVIEW ALIAS URL fixed to an operator-chosen alias string (the common default is `main`), always resolving to the newest-of-main uploaded version, useful for a persistent stakeholder-shareable link; (3) a PRODUCTION URL, declared under the wrangler manifest's `route`/`routes`/`workers_dev`/custom-domain stanza, changing which version it maps to only when a `promote` workflow runs. The Preview URL Resolver (TAC-1303) assembles the first two and refuses any alias string whose assembled host segment equals the production URL's host segment. The manifest loader refuses a wrangler config whose production route resolves to the preview alias URL host with `DEPLOY_URL_COLLAPSED`.",
+  "decision": "The blueprint mandates three URL kinds per Worker, all distinct hostnames, all discoverable through the Deploy Adapter's `deploy status` verb: (1) a per-version-id URL, unique per upload, permanent, useful for pinning a change-review link; (2) a STABLE PREVIEW ALIAS URL fixed to an operator-chosen alias string (the common default is `main`), always resolving to the newest-of-main uploaded version, useful for a persistent stakeholder-shareable link; (3) a PRODUCTION URL, declared under the wrangler manifest's `route`/`routes`/`workers_dev`/custom-domain stanza, changing which version it maps to only when a `promote` workflow runs. The Preview URL Resolver (TAC-1303) assembles the first two and refuses any alias string whose assembled host segment equals the production URL's host segment. The manifest loader refuses a wrangler config whose production route resolves to the preview alias URL host with `DEPLOY_URL_COLLAPSED`.",
   "consequences": "Reviewers and stakeholders reach the newest-of-main at a persistent, memorable URL that never masquerades as production. Users hit production at a hostname that only changes version behind an explicit operator act. Change-review links are pinnable to a specific version id and never rot. The trade is one Worker now surfaces three URLs the project has to reason about (and the operator has to explain once when a new engineer joins); the payoff is the class of leaks-through-collapsed-URL is closed by the manifest's own validation, not by discipline.",
   "alternativesConsidered": [
     {

package/blueprints/deploy-cloudflare-workers/contributions/adrs/adr-1306-deploy-cloudflare-workers-spa-shape.json

@@ -4,10 +4,10 @@
   "tadId": "TAD-001",
   "version": "1.2.0",
   "status": "accepted",
-  "title": "Workers-with-static-assets is the ratified SPA-on-Workers deploy shape; Pages is a documented alternative held for legacy projects only",
-  "context": "Cloudflare ships two shapes for browsing static assets in front of a Workers-tier deploy target: Cloudflare Pages (a workflow-shaped product with its own build pipeline and its own preview URL model) and Workers-with-static-assets (a wrangler.toml [assets] block declaring a directory the Cloudflare runtime serves at the edge). Cloudflare's own Pages landing page states, verbatim (fetched 2026-09-06): 'Workers supports most Pages use cases and offers a broader feature set. It is Cloudflare's primary platform for building applications. Start new projects with Workers.' The prior v1.1.0 blueprint blessed neither shape as the default; v1.1.0 taught the wrangler [assets] block in an asset sample but left the shape choice implicit. The T-0 round bumps the blueprint to v1.2.0 to close the gap: a rcf-lite project choosing SPA-on-Workers gets a single, ratified wrangler shape rather than a hand-rolled convention, and the ratified shape follows Cloudflare's own recommendation for new projects.",
-  "decision": "The blueprint blesses Workers-with-static-assets as the ratified SPA-on-Workers deploy shape (recommendedDefault true for new SPA projects). A project answering the elicited assets-directory parameter with a non-empty path emits an [assets] block on wrangler.toml whose directory value carries the elicited path; a project answering with an empty path keeps the bare-Worker shape (no [assets] block). The elicited run-worker-first (boolean, default false) surfaces the SPA fallback discipline: truthy answers emit run_worker_first = true under the [assets] block; falsy or unanswered answers omit the field, letting Cloudflare's runtime run asset lookup before the Worker fetch handler. The blueprint does not mint a Cloudflare Pages blueprint; a future deploy-cloudflare-pages-legacy sibling mints on demand only if a project cannot make the jump. Every existing v1.1.0 contribution carries through unchanged.",
-  "consequences": "One ratified shape lands on the shelf for greenfield SPA-on-Workers projects; the shape's standards trace is the Cloudflare Pages landing-page recommendation (2026-09-06 snapshot). The two new elicits become part of the operator surface at blueprint add: assets-directory names the static-assets root, run-worker-first names the SPA fallback discipline. A project generating both an [assets] block and a Pages-only pages_build_output_dir field is a mixed-shape drift the T-0 probe (assets-manifest-scan.mjs) refuses. A project on the legacy Pages shape stays on v1.1.0 semantics until it migrates; the guide's new Workers-with-static-assets section links Cloudflare's migrate-from-Pages walkthrough for projects that choose to jump. Future round-6 blueprints (T-1 KV, T-2 cron, T-3 DO, T-4 Access, T-5 Turnstile, T-6 rate-limiting) all compose on this shape via the shared cf-platform sample-app fixture.",
+  "title": "Workers-with-static-assets is the shipped SPA-on-Workers deploy shape; Pages is a documented alternative held for legacy projects only",
+  "context": "Cloudflare ships two shapes for browsing static assets in front of a Workers-tier deploy target: Cloudflare Pages (a workflow-shaped product with its own build pipeline and its own preview URL model) and Workers-with-static-assets (a wrangler.toml [assets] block declaring a directory the Cloudflare runtime serves at the edge). Cloudflare's own Pages landing page states, verbatim (fetched 2026-09-06): 'Workers supports most Pages use cases and offers a broader feature set. It is Cloudflare's primary platform for building applications. Start new projects with Workers.' The prior v1.1.0 blueprint blessed neither shape as the default; v1.1.0 taught the wrangler [assets] block in an asset sample but left the shape choice implicit. The round-6 bump takes the blueprint to v1.2.0 to close the gap: a rcf-lite project choosing SPA-on-Workers gets a single, ratified wrangler shape rather than a hand-rolled convention, and the ratified shape follows Cloudflare's own recommendation for new projects.",
+  "decision": "The blueprint blesses Workers-with-static-assets as the shipped SPA-on-Workers deploy shape (recommendedDefault true for new SPA projects). A project answering the elicited assets-directory parameter with a non-empty path emits an [assets] block on wrangler.toml whose directory value carries the elicited path; a project answering with an empty path keeps the bare-Worker shape (no [assets] block). The elicited run-worker-first (boolean, default false) surfaces the SPA fallback discipline: truthy answers emit run_worker_first = true under the [assets] block; falsy or unanswered answers omit the field, letting Cloudflare's runtime run asset lookup before the Worker fetch handler. The blueprint does not mint a Cloudflare Pages blueprint; a future deploy-cloudflare-pages-legacy sibling mints on demand only if a project cannot make the jump. Every existing v1.1.0 contribution carries through unchanged.",
+  "consequences": "One ratified shape lands on the shelf for greenfield SPA-on-Workers projects; the shape's standards trace is the Cloudflare Pages landing-page recommendation (2026-09-06 snapshot). The two new elicits become part of the operator surface at blueprint add: assets-directory names the static-assets root, run-worker-first names the SPA fallback discipline. A project generating both an [assets] block and a Pages-only pages_build_output_dir field is a mixed-shape drift the probe (assets-manifest-scan.mjs) refuses. A project on the legacy Pages shape stays on v1.1.0 semantics until it migrates; the guide's new Workers-with-static-assets section links Cloudflare's migrate-from-Pages walkthrough for projects that choose to jump. Future blueprints in this family (KV, cron, DO, Access, Turnstile, rate-limiting) all compose on this shape via the shared cf-platform sample-app fixture.",
   "alternativesConsidered": [
     {
       "name": "Ship a Cloudflare Pages blueprint alongside deploy-cloudflare-workers",

package/blueprints/deploy-cloudflare-workers/contributions/probes/assets-manifest-scan.mjs

@@ -1,6 +1,6 @@
 // Source-tree scan probe for the deploy-cloudflare-workers v1.2.0
-// Workers-with-static-assets shape (T-0 of the Cloudflare round 6
-// spec, section 5.0). accountBound false: this probe reads the
+// Workers-with-static-assets shape owned by TAC-1302 on this
+// blueprint. accountBound false: this probe reads the
 // applied fixture wrangler.toml and asserts three properties:
 //
 //   1. When the elicited assets-directory answer is non-empty, the
@@ -31,6 +31,24 @@ export const accountBound = false;
 // blueprint's manifest declares (top-level scalars, one [assets]
 // table, and boolean/string literals). Reaches for no runtime dep;
 // keeps the probe accountBound-false and dependency-free.
+
+function interpretRunWorkerFirst(v) {
+  // Accepts boolean true/false, string 'true'/'false', or a JSON array literal such as ["/api/*"].
+  // Returns { truthy: boolean, arrayForm: null | string[] }.
+  if (v === true) return { truthy: true, arrayForm: null };
+  if (v === false) return { truthy: false, arrayForm: null };
+  if (typeof v === 'string') {
+    const s = v.trim();
+    if (s === 'true') return { truthy: true, arrayForm: null };
+    if (s === 'false' || s === '') return { truthy: false, arrayForm: null };
+    if (s.startsWith('[')) {
+      try { const arr = JSON.parse(s); if (Array.isArray(arr)) return { truthy: true, arrayForm: arr }; } catch { /* fall through */ }
+    }
+  }
+  if (Array.isArray(v)) return { truthy: true, arrayForm: v };
+  return { truthy: false, arrayForm: null };
+}
+
 export function parseWranglerToml(text) {
   const lines = text.split(/\r?\n/);
   const root = {};
@@ -90,7 +108,7 @@ export async function scan(opts) {
     parsed,
     elicited: {
       assetsDirectory: elicited['assets-directory'] || '',
-      runWorkerFirst: elicited['run-worker-first'] === true,
+      runWorkerFirst: interpretRunWorkerFirst(elicited['run-worker-first']),
     },
   };
 
@@ -117,17 +135,17 @@ export async function scan(opts) {
       });
     }
     const runWorkerFirstOnManifest = assets && Object.prototype.hasOwnProperty.call(assets, 'run_worker_first');
-    if (detail.elicited.runWorkerFirst) {
-      if (!runWorkerFirstOnManifest || assets.run_worker_first !== true) {
+    if (detail.elicited.runWorkerFirst.truthy) {
+      const expectShape = detail.elicited.runWorkerFirst.arrayForm; const manifestVal = runWorkerFirstOnManifest ? assets.run_worker_first : undefined; const boolMatches = expectShape === null && manifestVal === true; const arrMatches = Array.isArray(expectShape) && Array.isArray(manifestVal) && JSON.stringify(expectShape) === JSON.stringify(manifestVal); if (!runWorkerFirstOnManifest || (!boolMatches && !arrMatches)) {
         results.push({
           verdict: 'fail',
-          detail: 'run_worker_first mismatch: elicited answer is true but manifest carries ' + (runWorkerFirstOnManifest ? String(assets.run_worker_first) : 'no run_worker_first key'),
+          detail: 'run_worker_first mismatch: elicited answer expected ' + (expectShape === null ? 'true' : JSON.stringify(expectShape)) + ' but manifest carries ' + (runWorkerFirstOnManifest ? JSON.stringify(assets.run_worker_first) : 'no run_worker_first key'),
           anchorAcId,
         });
       } else {
         results.push({
           verdict: 'pass',
-          detail: 'assets.run_worker_first equals true, matching the elicited run-worker-first answer',
+          detail: 'assets.run_worker_first ' + (expectShape === null ? 'equals true' : 'equals array ' + JSON.stringify(manifestVal)) + ', matching the elicited run-worker-first answer',
           anchorAcId,
         });
       }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-001.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1302-deploy-cloudflare-workers-wrangler-manifest",
+    "field": "responsibilities.manifest"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-002.json

@@ -2,7 +2,7 @@
   "reqId": "deploy-cloudflare-workers-REQ-002",
   "prdId": "PRD-001",
   "title": "One deploy adapter module is the sole caller of the deploy CLI",
-  "description": "The project exposes a single Deploy Adapter module that wraps the deploy CLI (the vendor's `wrangler` binary when the default vendor is in play). Every path that uploads a version, promotes a version, lists versions, or reads deploy state routes through this module. Nothing else in the project source tree spawns the CLI, imports the vendor SDK, or issues an HTTP call to the vendor's deploy API. The module exposes a fixed named-verb surface (`uploadVersion`, `promoteVersion`, `listVersions`, `resolveNewestOfMain`, `describeVersion`) that is stable across the blueprint's major version.",
+  "description": "The project exposes a single Deploy Adapter module that wraps the deploy CLI (the vendor's `wrangler` binary when the default vendor is in play). Every path that uploads a version, promotes a version, lists versions, or reads deploy state routes through this module. Nothing else in the project source tree spawns the CLI, imports the vendor SDK, or issues an HTTP call to the vendor's deploy API. The module exposes a fixed named-verb surface (`uploadVersion`, `promoteVersion`, `listVersions`, `resolveNewestOfMain`, `describeVersion`) that is stable across the blueprint's major version. The adapter exposes a stable deployStatus verb that composes the manifest-declared production URL, the preview alias URL resolved via the Preview URL Resolver, and the currently serving version id (from the Cloudflare Deployments API); the verb is the sole channel through which any AC observes those addressable surfaces.",
   "category": "technical",
   "domain": "deploy",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1301-deploy-cloudflare-workers-deploy-adapter",
+    "field": "responsibilities.uploadVersion"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-003.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1303-deploy-cloudflare-workers-preview-url-resolver",
+    "field": "interfaces.aliasQuery"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-004.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1304-deploy-cloudflare-workers-promote-gate",
+    "field": "responsibilities.explicitPromote"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-005.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1302-deploy-cloudflare-workers-wrangler-manifest",
+    "field": "interfaces.productionUrl"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-006.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1302-deploy-cloudflare-workers-wrangler-manifest",
+    "field": "interfaces.bindings"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-007.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1306-deploy-cloudflare-workers-deploy-ci-workflows",
+    "field": "responsibilities.build-and-upload"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-008.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1306-deploy-cloudflare-workers-deploy-ci-workflows",
+    "field": "responsibilities.promoteWorkflow"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-009.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1304-deploy-cloudflare-workers-rollback-is-promote",
+    "field": "decision.rollbackIsPromote"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-010.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1305-deploy-cloudflare-workers-served-surface-verifier",
+    "field": "responsibilities.probe"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-011.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1305-deploy-cloudflare-workers-dev-mode-drift",
+    "field": "decision.devMode"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-012.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1306-deploy-cloudflare-workers-deploy-ci-workflows",
+    "field": "responsibilities.buildProvenance"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-013.json

@@ -14,5 +14,9 @@
   "version": "1.2.0",
   "status": "approved",
   "createdAt": "2026-09-07T00:00:00Z",
-  "updatedAt": "2026-09-07T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1306-deploy-cloudflare-workers-spa-shape",
+    "field": "decision.assets"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/requirements/deploy-cloudflare-workers-req-014.json

@@ -2,10 +2,10 @@
   "reqId": "deploy-cloudflare-workers-REQ-014",
   "prdId": "PRD-001",
   "title": "SPA fallback discipline: run_worker_first flips the assets pipeline off the fetch handler's critical path",
-  "description": "The blueprint elicits `run-worker-first` (boolean, default false) alongside the `[assets] directory` shape from REQ-013. When the operator answers truthy, the generated wrangler manifest emits `run_worker_first = true` under the `[assets]` block: Cloudflare's runtime runs the Worker's fetch handler BEFORE looking up a static asset for the requested path. That is the shape a SPA-on-Workers project uses when the Worker owns arbitrary routing or when the Worker's auth middleware must gate every path a static file could shadow. When the operator answers falsy or leaves the elicit unanswered, `run_worker_first` is absent from the manifest and Cloudflare's runtime looks up a static asset first, falling back to the Worker only when no asset matches. The Worker code and the guide teach both shapes; the elicit surface is one boolean, the wrangler shape is one line.",
+  "description": "The blueprint elicits `run-worker-first` (boolean, default false) alongside the `[assets] directory` shape from REQ-013. When the operator answers truthy, the generated wrangler manifest emits `run_worker_first = true` under the `[assets]` block: Cloudflare's runtime runs the Worker's fetch handler BEFORE looking up a static asset for the requested path. That is the shape a SPA-on-Workers project uses when the Worker owns arbitrary routing or when the Worker's auth middleware must gate every path a static file could shadow. When the operator answers falsy or leaves the elicit unanswered, `run_worker_first` is absent from the manifest and Cloudflare's runtime looks up a static asset first, falling back to the Worker only when no asset matches. The Worker code and the guide teach both shapes; the elicit surface is one boolean, the wrangler shape is one line. The elicited run-worker-first answer is true to emit run_worker_first = true on the wrangler [assets] block (Worker gates every request before asset lookup); false or absent omits the field (Cloudflare's runtime serves a matching static asset before the Worker runs).",
   "category": "technical",
   "domain": "deploy",
-  "priority": "should",
+  "priority": "must",
   "rationale": "The default (asset lookup first, Worker on miss) is right for a static-content-heavy project. The truthy branch is what keeps auth middleware from being silently bypassed by an unauthenticated request for a file the assets pipeline serves from the edge cache. Naming the discipline as its own REQ makes the shape trade legible; anchoring the elicit to a wrangler line keeps the choice observable in the applied project.",
   "tags": [
     "blueprint:deploy-cloudflare-workers",
@@ -14,5 +14,9 @@
   "version": "1.2.0",
   "status": "approved",
   "createdAt": "2026-09-07T00:00:00Z",
-  "updatedAt": "2026-09-07T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-1306-deploy-cloudflare-workers-spa-shape",
+    "field": "decision.run_worker_first"
+  }
 }

package/blueprints/deploy-cloudflare-workers/contributions/tacs/tac-1301-deploy-cloudflare-workers-deploy-adapter.json

@@ -14,7 +14,8 @@
     "Expose `describeVersion({ versionId })` returning provenance (`versionSha`, `builtAt`, `ciRunUrl`) and URLs (`versionIdUrl`) for the named version; `versionSha` is the git commit sha baked into the version's bundle by `build-and-upload`, distinct from the version UUID `versionId` names (AC-12112-1, AC-12112-2).",
     "Expose `resolveSubdomain()` that returns the account's workers.dev subdomain string every URL-assembly path needs; reads the `WORKERS_DEV_SUBDOMAIN` env var when set (project pin) and otherwise queries the vendor's `GET /accounts/<accountId>/workers/subdomain` REST endpoint; caches the value for the process's lifetime (AC-12105-1).",
     "Refuse a manifest whose production route resolves to the same host as the preview alias URL with `DEPLOY_URL_COLLAPSED` (AC-12105-2).",
-    "Route every CLI invocation through a redactor that scrubs the vendor API token and account id from every emitted log line (AC-12107-3, AC-12106-2)."
+    "Route every CLI invocation through a redactor that scrubs the vendor API token and account id from every emitted log line (AC-12107-3, AC-12106-2).",
+    "Expose a stable deployStatus verb that composes the manifest-declared production URL, the preview alias URL (via the Preview URL Resolver TAC-1303), and the currently serving version id (via the Cloudflare Deployments API); every AC that observes an addressable served surface reads it through this verb (AC-12105-1)."
   ],
   "internalStructure": "One stateless class per process with an injected vendor binding and an injected redactor. The vendor binding is a project-authored module implementing the port in the interfaces block; the default vendor binding shells to the `wrangler` CLI and lives under the same package as the adapter. Every verb is a thin translation from the named surface to a vendor CLI invocation (or SDK call) plus response parsing plus provenance-URL assembly.",
   "interfaces": [
@@ -50,5 +51,5 @@
   ],
   "tradeoffs": "The adapter is process-local and stateless; every call reaches the vendor. That means a chain of adapter calls in one CI step costs one vendor round-trip per call rather than a shared session. The trade keeps the adapter easy to reason about and easy to reimplement against a different vendor. A project that wants a session-shared invocation supplies a vendor binding whose backing is a long-lived process rather than a CLI spawn per call; the port shape does not change.",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-cloudflare-workers/contributions/tacs/tac-1302-deploy-cloudflare-workers-wrangler-manifest.json

@@ -13,7 +13,10 @@
     "Refuse a manifest that carries any inline secret value; scan the parsed object for keys under the vendor's secret-declaration primitive whose value is not an empty declaration (AC-12101-3, AC-12106-1).",
     "Refuse a manifest whose production route stanza resolves to the same host as the preview alias URL with `DEPLOY_URL_COLLAPSED` (AC-12105-2).",
     "Expose a `bindings()` accessor listing every declared binding (kind, name) for downstream consumers.",
-    "Expose a `productionUrl()` accessor deriving the production URL from the `routes`/`route`/`workers_dev`/custom-domain declaration."
+    "Expose a `productionUrl()` accessor deriving the production URL from the `routes`/`route`/`workers_dev`/custom-domain declaration.",
+    "Load and expose the [assets] block per the current Cloudflare Workers static-assets contract (https://developers.cloudflare.com/workers/static-assets/binding/): an empty or absent [assets].directory answer keeps the bare-Worker shape and emits no [assets] block; a non-empty answer emits [assets].directory verbatim and enables the static-asset pipeline (AC-12113-1, AC-12114-1).",
+    "Map the elicited run-worker-first answer to the wrangler literal on the emitted [assets] block per the Cloudflare Workers static-assets binding page (https://developers.cloudflare.com/workers/static-assets/binding/, verified 2026-09-09). Two accepted answer shapes; both round-trip through the manifest reader (AC-12115-1): (a) boolean shape - \"false\", the empty string or absent OMITS the field and lets asset lookup run first, \"true\" EMITS `run_worker_first = true` and the Worker runs first for every request; (b) array-of-patterns shape - a JSON literal such as [\"/api/*\", \"!/api/docs/*\"] EMITS `run_worker_first = [\"/api/*\", \"!/api/docs/*\"]` and the Worker runs first only on matched routes (glob `*` for deep matching; leading `!` for negatives; negatives take precedence; at most 100 entries). Any other shape refuses at load with an unknownRunWorkerFirstShape error kind naming the accepted forms.",
+    "Refuse a wrangler manifest that declares both an [assets] block and a legacy pages_build_output_dir field (their meanings collide on the same deploy). The refusal names the collision and points the operator at the [assets] block as the ratified shape."
   ],
   "internalStructure": "One parser module per format (TOML and JSONC), one validator that walks the parsed object against the shape rules, one binding-usage scanner that walks the Worker source AST for env-accessor patterns, and one URL-derivation module that inspects the routes stanza. All pure functions; no I/O outside the initial file read.",
   "interfaces": [
@@ -41,5 +44,5 @@
   "dependencies": [],
   "tradeoffs": "The loader owns validation but does not own the vendor's own manifest-level validation (which happens later at the vendor CLI). Two-stage validation means a manifest that passes this loader can still fail the vendor's own load; the trade keeps the loader project-local and fast (no vendor round-trip on every CI step) while catching the classes this blueprint cares about (undeclared bindings, inline secrets, collapsed URLs) before the vendor call. A project can point the loader at a project-authored TOML dialect (a preprocessor step) by wrapping the manifestFile interface.",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-cloudflare-workers/contributions/user-stories/deploy-cloudflare-workers-us-12101.json

@@ -16,7 +16,8 @@
       "when": "a manifest loader parses the file",
       "then": "the loader returns a config object whose `name` is a non-empty string, `main` resolves to an existing entry file, `compatibility_date` matches `\\d{4}-\\d{2}-\\d{2}`, and every non-secret binding name referenced from the Worker's source appears as a declaration key in the config; the config carries no `[secrets]` block",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-12101-2",
@@ -25,7 +26,8 @@
       "when": "the CI gate runs on the change",
       "then": "the run fails with a stable-coded `WRANGLER_BINDING_UNDECLARED` error naming the offending source path and the missing binding name",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-12101-3",
@@ -34,21 +36,31 @@
       "when": "a redaction-scanner runs against `wrangler.toml`, any committed environment file, and the CI workflows",
       "then": "no file in the scanned set contains any byte sequence in `V`",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "disposition": "template"
     },
     {
       "id": "AC-12101-4",
-      "description": "When the manifest declares an `[assets]` block AND the Worker's fetch handler installs an auth gate on any route whose path could be shadowed by a file under the assets `directory`, the manifest MUST declare `[assets] run_worker_first` naming every gated route (glob-matched); a deployed request to any listed path is answered by the fetch handler before the assets pipeline runs. Without the listing, the assets pipeline serves the shadowing file directly and the auth gate is silently bypassed at the edge.",
-      "given": "a Worker whose fetch handler installs an auth middleware on `/notes` and a `./public/notes.html` file present at build time; the deployed Worker is reachable at production URL P",
-      "when": "an unauthenticated HTTP GET hits `P/notes`",
-      "then": "the response is the auth middleware's unauthenticated response (a redirect to sign-in, a 401, or the middleware's declared shape); the response is NOT the byte content of `./public/notes.html`; a manifest that omits `/notes` from `[assets] run_worker_first` fails the deployed observation because the assets pipeline answered before the fetch handler ran",
+      "description": "The wrangler manifest [assets] block, when the elicited run-worker-first answer is true, carries the boolean literal run_worker_first = true (and only that literal). Every application shipped under this shape asserts that an unauthenticated request to any protected route (for example /notes) reaches the Worker fetch handler before the static-asset pipeline runs, and the Worker's auth middleware gates it. The array-of-patterns form on the same field is a vendor-supported alternative recorded on TAC-1302 but not the shape this AC binds.",
+      "given": "wrangler manifest [assets].directory non-empty and run_worker_first = true",
+      "when": "an unauthenticated request lands on a Worker route the auth middleware protects",
+      "then": "the fetch handler runs before the static-asset pipeline, the auth middleware refuses, and no static asset is served",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1302-deploy-cloudflare-workers-wrangler-manifest",
+        "field": "interfaces.manifestFile"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/workers/static-assets/binding/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-1302-deploy-cloudflare-workers-wrangler-manifest"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/deploy-cloudflare-workers/contributions/user-stories/deploy-cloudflare-workers-us-12102.json

@@ -16,7 +16,8 @@
       "when": "the source tree is scanned for spawns of `wrangler` (or the vendor's CLI binary name) and for imports of the vendor's deploy SDK identifier",
       "then": "the only source file that matches either scan is the Deploy Adapter module; no other module names an alternative deploy call path",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-12102-2",
@@ -25,7 +26,16 @@
       "when": "a caller invokes `deployAdapter.uploadVersion({ previewAlias: 'main' })`",
       "then": "the call resolves with a `versionId` string matching the vendor's version-id format, a `versionIdUrl` naming the per-version URL, and a `previewAliasUrl` whose host segment carries the alias `main`; a call with `previewAlias: ''` throws a `DEPLOY_PREVIEW_ALIAS_REQUIRED` error",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1304-deploy-cloudflare-workers-promote-gate",
+        "field": "interfaces.deployAdapter"
+      },
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/workers/versions-and-deployments/",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-12102-3",
@@ -34,12 +44,21 @@
       "when": "a caller invokes `deployAdapter.promoteVersion({ versionId: 'bogus-v1' })`",
       "then": "the call throws a `DEPLOY_VERSION_NOT_FOUND` error naming `bogus-v1` and no vendor promote call is issued",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-1304-deploy-cloudflare-workers-promote-gate",
+        "field": "interfaces.deployAdapter"
+      },
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/workers/wrangler/commands/#versions",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-1301-deploy-cloudflare-workers-deploy-adapter"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }