cfctl v1.3.1 — efficient workspace discovery

Workspace operation discovery now selects repositories by their committed operation identity before inspecting the selected source. This removes repeated full workspace graph scans that could make Maildesk compatibility checks exceed their timeout in a large registered workspace. Duplicate ownership, nested repository boundaries and selected-source integrity checks remain enforced.

This is a source release. Build and install from the tagged checkout using ./bootstrap.sh. No prebuilt binaries or signed installers are attached; Apple notarization is not needed for the local source-build workflow.

Validation: independent review and the complete native gate passed on 72261cb9c6d3b54de77f7fc9295756284d567a63 (PR #201), including 495 runtime tests, public CLI/workspace checks, clean site reproducibility and Linux cross-compilation. Both Maildesk compatibility modes passed against the repaired candidate and actual registered workspace, with catalog lookup reduced from 13–20 seconds to 2.36–2.65 seconds.

cfctl v1.3.0 — source release

cfctl v1.3.0 — source-only release

cfctl v1.3.0 expands the governed Cloudflare control plane and strengthens the connection between a reviewed operation, the effect it attempts, and the evidence used to verify or recover it.

This is a source-only release. It includes no uploaded prebuilt executables, binary checksum sets, or installer manifests. GitHub-generated archives contain source. It is published with GitHub latest set to false, does not replace the latest binary release, and does not require Apple signing credentials to publish or build the accepted source locally.

Material changes since v1.2.1

• Worker and Pages deployment workflows. Worker version upload, traffic promotion, and rollback have distinct governed lifecycles. Plans bind source, configuration, artifact inputs, account targets, and live preconditions; verification checks the intended version and traffic state. Pages coverage includes direct artifact deployment, Git-integrated project creation, and domain workflows. Provider effects retain their own capability-specific approval and verification requirements.
• D1 operations with bounded recovery. Added and strengthened governed exports, schema inspection, exact-bookmark restore, reviewed migration imports, and workspace-owned migration and evidence operations. Import execution records boundary stages and supports reconciliation after an uncertain response without replaying a consumed operation. Workspace declarations bind their repository, configuration, database, and compiler-owned behavior rather than accepting arbitrary caller SQL.
• Body-free Maildesk and private-object evidence. Workspace D1 projections expose approved policy, schema, audit, route-health, inbound-acceptance, and reply-admission facts. R2 digest reads return bounded object identity and digest information without returning private object bodies. Independent policy and provider observations remain separate evidence; database counters alone do not establish inbox receipt or an outward reply.
• Email Routing and Access contracts. Email Routing reads use typed, privacy-preserving projections and account for documented pagination and response variants. Governed reply-subdomain ingress and catch-all operations bind their owning zone and Worker. Specialized Access application updates and operator-group policy operations preserve owned state and verify the intended result; generic mutation paths remain subject to their existing blockers.
• Evidence authentication and recovery. Qualifying local evidence is bound to its state root and authenticated with generation-specific keys. Legacy unauthenticated rows remain historical observations rather than becoming current proof. Evidence-key initialization and managed recovery have explicit interruption handling. Valid-registry adoption remains held until an authenticated installed-identity receipt can support it.
• Credential and delegated-operation reliability. Native macOS Keychain access, managed credential journals, deterministic fallback reads, scoped analytics-profile renewal, and bounded delegated process handling replace several fragile recovery paths. Post-boundary failures retain attempted/performed state and recovery context instead of reporting that nothing happened. Eligible reversible operations can explicitly report unattested effects when authority is unavailable; destructive, identity, communication, spend, and unknown-risk operations retain their stricter gates.
• CLI discovery, telemetry, and local proof. The parser-generated command map, deterministic resolution, capability guides, and generated agent integration make the supported command surface discoverable. Governed telemetry workflows distinguish previews, component reads, mutation authority, and operational proof. Local verification covers Rust, the edge site, supporting tooling, dependencies, and source contracts.

Reliability and operability improvements

The final committed source also includes:

• A narrowly bounded create operation for an owned whole-host self-hosted Access application, with an empty initial policy set, ownership-absence checks, returned-ID verification, and separate operator-group policy creation.
• Noninteractive macOS Keychain operations in terminal and unattended sessions. Failure to suppress interaction stops credential access; process-wide interaction state is serialized and preserved.
• Explicit private-preview, private-activate, and private-history commands for a fresh private-file runtime when platform custody cannot provide routine access. Activation preserves the old runtime, carries eligible scoped credentials privately, and selects the new location only after preparation and source-drift checks. It does not inherit old plans, standing grants, approvals, or authenticated proof. Existing restrictive admission rules are shown for explicit re-admission with a fresh approval. The new authority claims no cryptographic continuity with the old one. Other software running as the same OS user can access the private-file credentials and signing authority.
• Site asset fingerprints derived from final JavaScript bytes after the WASM-reference rewrite. Local and live checks verify actual asset bytes, manifest filenames, and the JavaScript-to-WASM reference. Site-relative reproducibility hashes remain distinct from cfctl's repository-relative deployment artifact digest.
• SSR response policies admit the exact framework nonce alongside the hydration-script hash, and live verification checks every emitted inline script.
• Site SSR scripts are admitted by the exact response nonce, while non-SSR responses retain the strict hash-based fallback. HTML verification checks each executable inline script against its actual admitted bytes or response nonce; it rejects wrong nonces, changed hash-bound bodies, and additional unadmitted scripts.
• A documented source-only publication lane that leaves the signed prebuilt release requirements intact.

The exact source below passed the complete native verification gate and independent review. Local browser checks covered Chrome and WebKit interactions and the site’s emitted HTML and security headers. These checks do not establish installation or live Cloudflare deployment.

Installation and compatibility

Use a clean Git checkout of the exact accepted release tag and follow the repository prerequisites in CONTRIBUTING.md. The repository pins the Rust toolchain and supporting proof tools.

./bootstrap.sh
cfctl version --json
cfctl doctor --json
cfctl agents doctor --json

Bootstrap runs the canonical local verification gate before installing from source, checks that the installed binary reports the checkout's exact commit, and synchronizes the managed agent integration unless explicitly skipped. It does not sign or notarize a public binary. A source archive alone does not satisfy bootstrap's Git-checkout identity requirement.

This release uses the cfctl v2 CLI contract, which is a clean break from the archived shell runtime. Use cfctl commands, cfctl <command> --help, cfctl resolve, and cfctl guide to discover supported commands. Structured output uses ResultEnvelopeV2. Backend scripts and the archived runtime are not supported public fallbacks.

Credentials remain account-pinned and enter through the supported protected import paths. A Cloudflare write still requires its governed call/plan/approval/run/status lifecycle. Installing source, activating a local runtime, or publishing these notes does not deploy a Worker, register a domain, enable public OAuth, or prove delivery of mail.

Prebuilt binaries remain a separate release lane

cargo xtask assemble produces unsigned local qualification artifacts. Public prebuilt v1.3.0 artifacts retain the requirements for reviewed trust roots, reproducible build provenance, SBOM and checksum verification, cosign verification, and Developer ID signing and Apple notarization of the macOS binaries. cargo xtask release and cargo xtask publish retain those checks. Nothing in this source-only release authorizes publishing unsigned binaries or substituting local build success for signed-artifact verification.

---

Source: exact commit 23a7bb3e4067. Changes: v1.2.1 to this exact source.

cfctl v1.2.1

Patch release. The headline is a fix for agent skill installation that was
silently affecting every machine still carrying the superseded cloudflare
skill, plus a governance correction to how API-token update reports itself.

Agent skill installation could not migrate

If your machine still had the superseded contract-2 cloudflare skill,
cfctl agents install refused with "has local drift; use cfctl agents sync
to replace it" — and agents sync skipped the agent entirely, because it only
touches agents that already have a managed skill. The two commands deadlocked,
and the advice pointed at the one that could not help. Machines in that state
were being served the older catalog-search-first doctrine instead of the
current resolve-first instructions.

Removability now depends on the frozen hash rather than the install mode: a
byte-exact match is the artifact cfctl itself wrote, so treating it as your
local drift was wrong. Anything that is not a byte-exact match is still
refused, and a file cfctl did not write is never deleted.

Migration also no longer follows symlinks. Where the skill directory is a
symlink into a shared tool tree, cfctl leaves the shared copy alone and
installs beside it rather than reaching outside the agent home it manages.

cfctl agents sync now names the agents it passed over instead of reporting
"synchronized" for work it did not do.

API-token update says why it is blocked

account-api-tokens-update-token and user-api-tokens-update-token were
blocked with the generic reason "operation contract incomplete: risk/effect/
cost missing", which told agents that supplying those fields would unlock
them. It would not — token mutation is reserved to the inventory-bound keys
workflow so every permission change is resolved against a fresh live
inventory. They now carry a blocked by design: reason that says so, and a
test pins that a future classifier cannot silently promote them.

KV namespace deletion

Deleting an empty KV namespace is available as a reviewed compensation with a
live emptiness proof bound into the plan. Arbitrary namespace deletion stays
blocked: Cloudflare does not document whether deleting a populated namespace
bills its contained key deletions, so its cost is unbounded.

Internal: drift gates

Several things that were kept true by hand are now kept true by the build.
Intra-workspace version pins are checked by equality (Cargo alone accepts a
stale pin, because the bumped crate still satisfies it), the QUICKSTART
download path must match the release, and every cfctl example in a tracked
file or in the managed agent instructions is validated against the real command
tree and the real parser — subcommands at full depth, and flags. These caught
no existing drift; they close the gaps before one appears.

Install

Releases are unsigned by operator decision; integrity is checksum-based. Verify
every download against SHA256SUMS. Each binary is reproducible from the
tagged source and carries an SPDX SBOM.

curl -fsSLO https://github.com/rogu3bear/cfctl/releases/download/v1.2.1/cfctl-aarch64-apple-darwin
curl -fsSLO https://github.com/rogu3bear/cfctl/releases/download/v1.2.1/SHA256SUMS
shasum -a 256 --check --ignore-missing SHA256SUMS
install -m 0755 cfctl-aarch64-apple-darwin ~/.local/bin/cfctl

cfctl v1.2.0

Unsigned release; integrity is by checksum. Verify against SHA256SUMS before use.

New governed capabilities

This release closes the largest structural gap the prior audit surfaced: teardown and lifecycle operations that were catalogued but not executable, so deletes had to route around cfctl.

• DNS record delete — the lifecycle is now governed create → update → patch → delete, with deletion verified by a not-found readback. Blocked previously because Cloudflare's OpenAPI under-declares the delete response envelope; cfctl pins it to the observed live shape (#91).
• Queue consumer create and update — the delete side was already governed; both directions now are, accepting the worker and http_pull variants with returned-id verification and reviewed-delete compensation (#92).
• Worker script delete — governed with a new verification strategy that reads the script's /settings sub-path for a 404 (the script's own GET returns the raw module body). cfctl never passes Cloudflare's force bypass, so in-use refusals (queue consumers, Durable Objects) stay active as a second guard (#93).
• Access application create — governed with curated verification over name and type, the fields present across all 13 polymorphic application types. Access update stays blocked by design: the union has no honest universal field to verify against (#94).

Documented, still blocked

Three capabilities were investigated and left honestly blocked, each with its root cause recorded in the operator runbook's Known Limitations:

• Access application create is governed in the catalog but currently fails at plan storage, because the redaction guard matches secret field names that appear as legitimate config keys in its large schema (#95).
• KV namespace delete stays blocked: an empty-namespace emptiness proof would bound its cost, but that requires overriding the fail-closed cost block on a destructive op — deferred to its own reviewed change (#96).
• Token update stays reserved to the governed keys workflow by doctrine, not promoted as a generic capability (#97).

Verification

cargo xtask verify exit 0. Each shipped capability was live-proven end to end against a real account with full cleanup: DNS create→delete, a complete queue-consumer lifecycle, and a Worker deploy→governed-delete cycle.

cfctl v1.1.2

Unsigned release; integrity is by checksum. Verify against SHA256SUMS before use.

Changes

• Worker script secret put now succeeds. Cloudflare answers a successful put with 201 Created, while its OpenAPI declares only 200. The derived contract pinned 200, so every real put crossed the boundary, created the secret, and then failed as an unknown outcome requiring rectification — the secret existed and cfctl could not confirm it. A second defect in the same path made the verifier report failure while all eight of its sub-checks passed, because the apply status was echoed as a value rather than compared. Statuses are now reported as accepted=<bool>, and the pin covers the statuses Cloudflare actually returns — 202 is still refused (#89).

Found by exercising the capability against a real account rather than trusting its tests; the fixtures asserted the documented status, not the sent one.

Verification

cargo xtask verify exit 0. Live-proven end to end: scratch Worker deployed through governed wrangler.deploy, secret put verified, three secrets deleted with not-found verification, and a sentinel value planted in each put confirmed absent from every plan, evidence file, and envelope.

cfctl v1.1.1

Unsigned release; integrity is by checksum. Verify against SHA256SUMS before use.

Changes

• keys mint fails fast on contradictory arguments — --user with --zone, or a malformed --zone, previously cost a live permission-inventory request and then reported an inventory failure instead of the actual problem. Scope resolution now runs before any network I/O, so these fail closed with the accurate message and performed: false (#87).
• Documentation trimmed 26% and corrected. docs/upstream-schema-gaps.md keeps its argument, asks, and reproduce script rather than 840 lines of regenerable enumeration; the README is rebuilt as a front door, leading with what cfctl is for and stating the blocked-capability posture plainly instead of burying it. Two docs still claimed minting binds account scope only — superseded by zone-scoped minting in 1.1.0 (#85, #86).

No public command surface changed since 1.1.0.

Verification

cargo xtask verify exit 0 — fmt, clippy, full-workspace tests, cargo-deny, full-history secret scan. The argument-ordering fix was found by exercising the --user mint lane against a live account, and is verified in the released binary itself.

cfctl v1.1.0

Unsigned release; integrity is by checksum. Verify against SHA256SUMS before use.

Changes

• plans cancel — new public verb. An approved plan is standing permission to mutate; until now its only exits were consumption or lazy 24-hour expiry. Cancellation retires that authority immediately, mirroring standing-authority revocation: monotonic (a cancelled plan can never be approved, run, or resumed), idempotent, effective even on drifted content, and journaled as the terminal Closed checkpoint so the transaction hash chain stays coherent (#83).
• Fresh governed state from ./cfctl — the repo wrapper now builds through the host cargo gate but runs the CLI outside it, so plan and authority status can never be served from a build result cache (#83).
• Pre-push policy is discoverable — documented in tracked CONTRIBUTING.md, and cargo xtask verify reports an unregistered or stale-pinned hook with the exact registration line (#82).
• Authority listings show their scope — zone_id and bound_resources are asserted output surface, closing the gap class that produced #80 (#82).
• Contract-debt posture stated — docs/v2-architecture.md names the ~84% blocked-mutation ratio as the gate holding, measured by catalog coverage (#83).

Plans stored by earlier versions are unaffected: cancelled_at is additive and outside the reviewed content hash.

Verification

cargo xtask verify exit 0 — fmt, clippy, full-workspace tests, cargo-deny, full-history secret scan. plans cancel live-proven: approve → cancel → run refused with retirement guidance; first production use retired a stale approved plan that lazy expiry had left live-looking on disk.

cfctl v1.0.2

Unsigned release; integrity is by checksum. Verify against SHA256SUMS before use.

Changes

• Pre-push gate — cargo xtask verify now runs before every push and refuses on failure. Remote CI is intentionally absent, so nothing previously caught a gate that was never run (#78).
• Zone-scoped standing authority — cfctl keys policy create --zone pins one zone that children may bind alongside the account, so zone-scoped minting can run unattended. Child mints are now checked against the authority's allowed resources; that check did not previously exist, so an authority pinned to one account could admit a child bound elsewhere (#79, #80).
• Wrangler deploy cwd pinning — deploy and deployment-status subprocesses run from the reviewed config's directory. Wrangler resolves dotenv credentials relative to its working directory, so a plan reviewed against one config could otherwise publish with a token discovered from wherever cfctl was invoked (#77).
• keys mint --zone documented — the capability shipped in 1.0.1 but the runbook still described mint as account-only, so it went unused (#79).
• Repairs — two clippy::expect_used violations that had made main red, and identical oneOf schema branches being counted twice in the request builder (#76).

Standing authorities approved before this release keep their exact content hash and continue to validate; the zone bound is additive.

Verification

cargo xtask verify: exit 0 — fmt, clippy, full-workspace tests, cargo-deny, and full-history secret scan.

Live-proven against a real zone: zone-scoped mint through plan → approve → run, the minted token reading its pinned zone and refused on another, an unattended mint under a zone-bounded authority, and an out-of-bounds zone refused before mutation. All test credentials revoked with live verification.

cfctl v1.0.1

Documentation-focused follow-up to v1.0.0. No behavioral changes to the CLI.

Changed since v1.0.0

• Documentation corpus trimmed 25%; README rebuilt around a mermaid diagram of the governed loop (intent → resolve → call → plan → approve → run → verify → evidence) and the architecture doc around a crate/boundary graph.
• Install docs now teach the real paths for unsigned releases: direct download + SHA256SUMS verification, the release's Homebrew formula, or source build.
• Runbook documents the exit-code contract (0 success; 1 failure envelope with next_step; 2 usage error).

Platforms

cfctl-aarch64-apple-darwin, cfctl-x86_64-apple-darwin, cfctl-aarch64-unknown-linux-musl, cfctl-x86_64-unknown-linux-musl, plus the Homebrew formula (cfctl.rb).

Integrity

Artifacts are unsigned (open-source CLI, checksum-based integrity): verify against SHA256SUMS; every binary is reproducible from the tagged source (double-built, hash-compared) with SPDX SBOMs and commit-bound provenance.json.

cfctl v1.0.0

First packaged release of cfctl — the governed, local-first Cloudflare control plane.

Highlights

• Catalog-driven capabilities ingested from Cloudflare's official OpenAPI schema; cfctl resolve turns natural-language intent into a deterministic capability match.
• Every mutation is a hash-bound plan: call → plans approve --yes → plans run, with operation-specific verification, durable journals, and redacted evidence.
• Scoped token workflows (keys permissions|mint|rotate|revoke|policy), standing authorities with bounded TTL/rate ceilings, and fail-closed secret sinks (--value-out, mode 0600).
• Reproducible builds: each platform built twice and hash-compared; SPDX SBOMs via cargo-auditable + Syft; provenance.json binds the exact git commit and tree.

Platforms

cfctl-aarch64-apple-darwin, cfctl-x86_64-apple-darwin, cfctl-aarch64-unknown-linux-musl, cfctl-x86_64-unknown-linux-musl, plus the Homebrew formula (cfctl.rb).

Integrity

Artifacts are unsigned — this is an open-source CLI released with checksum-based integrity: verify downloads against SHA256SUMS, and reproduce any binary from the tagged source (cargo xtask assemble double-builds and hash-compares). SPDX SBOMs enumerate the full dependency graph. The identity-verifying Linux installer is intentionally not shipped for this release; install by direct download + checksum, Homebrew formula, or cargo install --path crates/cfctl-cli --locked from source.