docs/READINESS.md

# Capability Builder 0.1.3 policy candidate — 2026-10-01 America/Los_Angeles

This revision adds the exact writer-supplied support, privacy and terms pages, authorized for publication by parent. Static GET/HEAD routing does not process drafts or call the rate binding. MCP behavior is unchanged apart from server version 0.1.3. Root description clarifies drafted capabilities are not executed. Public developerName is Business Scaffolde; author/operator remains Scaffolde LLC. Required listing URLs point to the approved paths. These new pages are not claimed live until the deployment owner verifies them. Prior 0.1.2 hosted evidence below remains historical; the new local policy-content and MCP regression tests are recorded separately.

The root LICENSE preserves the repository proprietary notice without granting new rights. Icon and first-party template attribution remain intact. This package does not claim publisher verification, host routing review or marketplace acceptance.

# Capability Builder 0.1.2 hosted candidate — 2026-10-01

Production endpoint https://capability-builder.scaffolde.ai/mcp is live according to the deployment owner; its retained HTTPS test evidence passes all 12 active checks, including exactly five positive and three negative service cases. Official MCP SDK 1.30.0 initialize/list/call passes. The hosted harness skips the stalled-upload probe; a separate incomplete chunked request timed out at the client after 15 seconds without a confirmed server 408. Production slow-upload behavior is not claimed verified. Proposed assistant review prompts remain untested through ChatGPT desktop/mobile or Codex routing. Marketplace submission remains blocked.

Deployment owner reports version 86444877, deployed bundle 14,269 bytes with SHA-256 b3a8b9b3d22ebe7336d0ac476fcf0ffc07906566057ffc0efcaca140d104dcbe. Hosted compatibility date is 2026-10-01. Local workerd used 2026-09-24 because its installed binary rejects newer dates. Source behavior is unchanged; hosted tests establish a separate production runtime result. No local tooling upgrade was performed. The bundle remains server version 0.1.2; the revised ZIP is a documentation/configuration candidate revision, not a new service code release.

Controls supplied by deployment owner: CPU 10 ms; required SERVICE_RATE_LIMITER, namespace 1001202610, 300 requests per 60 seconds, fixed service-only key. Workers.dev and previews disabled. Observability umbrella enabled, but logs.enabled=false, invocation_logs=false, persist=false, traces=false, issues=false, with no exports, tail or Logpush. The source never logs request bodies or derived draft content, saves drafts, calls models or fetches arbitrary URLs. Native rate counters contain a fixed service key, not client identifiers. Final deployment report confirms normal certificate-authority and hostname validation, TLS 1.2 and a *.scaffolde.ai certificate valid through December 29, 2026; no claim of zero provider metadata, restricted processing region or verified infrastructure retention is made. The production config reflects representable owner-reported settings; exports/tail/Logpush status is described here. Traces persist=true is inert while traces.enabled=false. No compatibility flags were selected.

The rate limit applies per Cloudflare location and is eventually consistent, not a global request or spending cap. Rejected/preflight/invalid requests can still invoke the Worker. Pai@scaffolde.ai’s Account owns the deployed Worker and scaffolde.ai zone. Seven preexisting production Workers showed no visible native rate binding, but namespace uniqueness across hidden/preview bindings is not proven. No 300+ request burst was performed: configured 300/60 limits are dashboard evidence, successful POSTs prove binding usability, and production 429 behavior is not yet exercised. Account billing/usage and shared-account effects are not established by this evidence. No paid upgrade is represented or authorized by this package. Missing/failed native binding returns 503 and rate rejection returns 429.

Earlier local evidence remains: 20 Node tests passed; actual local workerd passed 12 checks with one proxy-buffering probe skipped. Direct Node checks the 10-second timeout; a separate actual workerd harness checks body-reader cancellation. Official manifest schemas and local SDK interoperability passed. All evidence used synthetic data; no real user data was used.

Four tools individually declare readOnlyHint=true, destructiveHint=false, openWorldHint=false, idempotentHint=true and noauth. Fixed first-party public templates and explicit bounded drafts are their only data. Structural validation always separates structural_pass, needs_review and not_runtime_tested. No arbitrary shell, remote URL fetching, generated registration, thread control, runtime execution or deployment operation exists. Stable claim IDs and verbatim user goal are retained; cross-request revision continuity is assistant-managed. Escaped output remains untrusted review material, not executable instructions.

Support/privacy contact pai@scaffolde.ai, Scaffolde LLC and California registration are owner-confirmed. Parent owns business verification, publisher identity and final legal attestations. No residential address belongs in public materials. No legal URL, verified publisher or marketplace approval is invented.

Archive checks enforce a single portable root, no traversal/symlinks/private path literals, <=20 path segments, <=5000 files, <=100 MB compressed, <=100 MiB per file and <=512 MiB expanded. Listing lengths and exactly three unique starters <=128 characters are checked. Approved 512px first-party icon is bundled with attribution. Historical development and predeployment ZIPs remain unchanged.

Remaining gates: remaining account billing/usage facts; approved redistribution rights under proprietary license; publisher/business verification; approved privacy/terms/support URLs; domain verification; exactly eight assistant review cases through ChatGPT desktop/mobile and Codex; accessible real demo; tool/skill scans; final publication approval. The synthetic rehearsal transcript is not a marketplace video. A live tool endpoint is not evidence of successful capability runtime execution, host routing or marketplace acceptance.

Final publisher recheck still blocks uploads on verified developer identity. A prior owner-reported verification is not treated as confirmation for the currently inspected organization. Parent owns resolving that mismatch. Cloudflare NEL/report-to success_fraction=0 and max_age=604800 describe reporting policy and its lifetime, not server retention. Aggregate CPU/request/billing metrics remain platform features. Zone Bot Fight Mode was left unchanged; hosted tests received no challenge.