{
  "$schema": "https://services.datasourceapi.com/schema/standards-response.schema.json",
  "version": "1.0.0",
  "effectiveDate": "2026-09-03",
  "rules": [
    {
      "id": "CCA-UI-001",
      "category": "ui",
      "title": "Use CCA UI Profile v2",
      "requirement": "New public services MUST use CCA UI Profile v2: pinned GOV.UK Frontend 6.4.0 CSS and ES module plus fonts from govuk.prodcdn.com; palette #1d70b8, #003078, #00703c, #d4351c, #f47738, #ffdd00, #0b0c0c, #505a5f, #b1b4b6, and #f3f2f1; stable v6 header, footer, container and grid; GDS Transport; responsive behavior at 641/640/768 boundaries; visible focus; skip links; semantic landmarks; reduced motion; and aria-hidden decorative SVG. A page MUST NOT mix GOV.UK Frontend and NYC Core.",
      "level": "must",
      "automated": true,
      "references": [
        "https://frontend.design-system.service.gov.uk/"
      ]
    },
    {
      "id": "CCA-UI-002",
      "category": "ui",
      "title": "Deliver accessible no-JavaScript content",
      "requirement": "Core public content MUST be server-rendered and usable without JavaScript. Pages MUST include semantic landmarks, a skip link, visible keyboard focus, labeled controls, accessible error summaries linked to field errors, status or live regions for meaningful asynchronous changes, useful loading, empty, and error states, and layouts usable at narrow widths and high zoom. Custom dialogs MUST trap focus, restore it on close, support Escape where safe, and MUST NOT fall back to alert, confirm, or prompt.",
      "level": "must",
      "automated": false,
      "references": [
        "https://www.w3.org/TR/WCAG22/"
      ]
    },
    {
      "id": "CCA-UI-003",
      "category": "ui",
      "title": "Load executable assets only from approved hosts",
      "requirement": "Executable CSS, JavaScript, fonts, and related frontend assets MUST be self-hosted, hosted on cdn.coopalliance.org, or hosted on a subdomain ending .prodcdn.com. The apex prodcdn.com host is not allowed. Asset versions MUST be pinned.",
      "level": "must",
      "automated": true,
      "references": []
    },
    {
      "id": "CCA-BIND-003",
      "category": "service-bindings",
      "title": "Never silently fall back from a binding to public HTTPS",
      "requirement": "A missing or failed service binding MUST produce an explicit failure or documented independent degradation. Internal calls MUST NOT silently fall back to the public HTTPS hostname. Service-binding and RPC callees MUST authenticate and authorize independently.",
      "level": "must",
      "automated": false,
      "references": [
        "https://developers.cloudflare.com/workers/runtime-apis/bindings/service-bindings/"
      ]
    },
    {
      "id": "CCA-UI-004",
      "category": "ui",
      "title": "Migrate legacy fleet pages without mixing frameworks",
      "requirement": "NYC Core 1.0 with the legacy #004CBE shell is Legacy UI Profile v1 and MAY remain only during migration. New services MUST NOT introduce Profile v1. Migration maps the legacy container, grid, cards, tables, badges, header, footer, skip link, and controls to their GOV.UK Frontend v6 equivalents in one release; pages MUST never load both frameworks.",
      "level": "must",
      "automated": true,
      "references": [
        "https://frontend.design-system.service.gov.uk/"
      ]
    },
    {
      "id": "CCA-MANIFEST-001",
      "category": "manifest",
      "title": "Publish one validated service manifest",
      "requirement": "Each catalog entry MUST come from one version-controlled manifest validated by JSON Schema. The manifest MUST distinguish APIs, viewers, tile services, and private services and MUST NOT contain secrets, account identifiers, internal hostnames, administrative routes, or PII.",
      "level": "must",
      "automated": true,
      "references": [
        "https://json-schema.org/draft/2020-12/json-schema-core"
      ]
    },
    {
      "id": "CCA-OAS-001",
      "category": "openapi",
      "title": "Publish a complete OpenAPI 3.1 contract",
      "requirement": "Every public API MUST publish an OpenAPI 3.1 document with title, version, description, canonical HTTPS servers, contact, license, tags, stable globally unique operationId values, parameter and request schemas, every success and error response schema, and realistic examples.",
      "level": "must",
      "automated": true,
      "references": [
        "https://spec.openapis.org/oas/v3.1.1.html"
      ]
    },
    {
      "id": "CCA-OAS-002",
      "category": "openapi",
      "title": "Prevent specification and runtime drift",
      "requirement": "CI MUST validate OpenAPI syntax and fleet rules. Contract tests SHOULD exercise documented routes, status codes, content types, and representative schemas against the runtime so undeclared or stale behavior fails review.",
      "level": "must",
      "automated": true,
      "references": [
        "https://spec.openapis.org/oas/v3.1.1.html"
      ]
    },
    {
      "id": "CCA-DATA-001",
      "category": "data-semantics",
      "title": "Use the fleet response envelope",
      "requirement": "Successful collection and lookup responses SHOULD use the existing fleet envelope consistently, with data plus meta fields for provenance, freshness, cache state, request or trace identity when safe, and upstream status. meta.sources MUST list the sources that actually contributed to that response, never a static superset. Status or source-query failures MUST remain explicit errors or unknown states and MUST NOT be converted to a zero count. Do not report stale or partial upstream data as unqualified success.",
      "level": "should",
      "automated": false,
      "references": []
    },
    {
      "id": "CCA-PIPE-011",
      "category": "pipeline",
      "title": "Use durable execution for required work",
      "requirement": "ExecutionContext.waitUntil is best effort and MUST be used only for disposable post-response work. Required, retryable, or state-changing background work MUST use Queues or Workflows with explicit retry policy, dead-letter handling, idempotency, and reconciliation.",
      "level": "must",
      "automated": false,
      "references": [
        "https://developers.cloudflare.com/queues/",
        "https://developers.cloudflare.com/workflows/"
      ]
    },
    {
      "id": "CCA-DATA-002",
      "category": "data-semantics",
      "title": "Describe provenance and freshness",
      "requirement": "Every data-bearing response or linked metadata resource MUST identify its source, observed or released timestamp where known, refresh cadence, and whether the result is live, cached, stale, partial, or unavailable.",
      "level": "must",
      "automated": false,
      "references": []
    },
    {
      "id": "CCA-QUERY-001",
      "category": "query",
      "title": "Use consistent collection controls",
      "requirement": "Collection APIs MUST document deterministic pagination, stable sort, filters, search syntax, and sparse-field selection where supported. Keyset cursors are preferred and SHOULD replace deep OFFSET pagination for changing or large datasets; offset pagination MAY be used for bounded stable collections.",
      "level": "must",
      "automated": false,
      "references": []
    },
    {
      "id": "CCA-ERROR-001",
      "category": "errors",
      "title": "Provide RFC 9457-compatible problems",
      "requirement": "New APIs MUST provide application/problem+json errors with type, title, status, detail, and instance. Existing fleet envelopes MAY retain their current error member to avoid breaking clients, but SHOULD embed or content-negotiate an RFC 9457-compatible problem and MUST preserve correct HTTP status semantics.",
      "level": "must",
      "automated": true,
      "references": [
        "https://www.rfc-editor.org/rfc/rfc9457"
      ]
    },
    {
      "id": "CCA-HTTP-001",
      "category": "http",
      "title": "Implement HTTP caching correctly",
      "requirement": "Cacheable GET and HEAD resources MUST publish explicit Cache-Control and a validator such as ETag or Last-Modified, honor conditional requests, and use Vary when representation selection changes the response. Unsafe or private responses MUST NOT be publicly cached.",
      "level": "must",
      "automated": true,
      "references": [
        "https://www.rfc-editor.org/rfc/rfc9111"
      ]
    },
    {
      "id": "CCA-HTTP-002",
      "category": "http",
      "title": "Define CORS intentionally",
      "requirement": "Public machine-readable metadata and openly reusable APIs SHOULD allow wildcard read CORS. Credentialed, private, administrative, or browser-sensitive endpoints MUST use an explicit Origin policy and MUST validate Origin independently of CORS headers.",
      "level": "must",
      "automated": true,
      "references": [
        "https://fetch.spec.whatwg.org/#http-cors-protocol"
      ]
    },
    {
      "id": "CCA-HTTP-003",
      "category": "http",
      "title": "Expose rate-limit state",
      "requirement": "Rate-limited APIs MUST document their quota model and return actionable limit, remaining, reset or retry information using current standard fields where practical. A 429 response MUST include Retry-After when the retry time is known.",
      "level": "must",
      "automated": false,
      "references": [
        "https://www.rfc-editor.org/rfc/rfc6585"
      ]
    },
    {
      "id": "CCA-AUTH-001",
      "category": "security",
      "title": "Separate public, authenticated, and administrative surfaces",
      "requirement": "Public read routes, user-authenticated routes, ingestion routes, and administrative routes MUST be separate and documented with explicit security schemes. Administrative endpoints and internal hostnames MUST NOT appear in the public service catalog.",
      "level": "must",
      "automated": true,
      "references": []
    },
    {
      "id": "CCA-AUTH-002",
      "category": "security",
      "title": "Enforce trust boundaries at every Worker",
      "requirement": "High-risk services MUST separate public, administrative, audit, PII, and immutable-evidence responsibilities into explicit Worker and resource trust boundaries. Every service-binding callee MUST authorize the request itself because Cloudflare Access identity and policy context do not automatically propagate through service bindings.",
      "level": "must",
      "automated": false,
      "references": [
        "https://developers.cloudflare.com/workers/runtime-apis/bindings/service-bindings/"
      ]
    },
    {
      "id": "CCA-AUTH-003",
      "category": "security",
      "title": "Use least-privilege entrypoints",
      "requirement": "Browser and administrative routes MUST be protected by Cloudflare Access plus application RBAC. Read and mutation entrypoints SHOULD use separate least-privilege bindings or RPC capabilities. Caller-supplied identity headers are untrusted audit labels and MUST NOT authorize a request.",
      "level": "must",
      "automated": false,
      "references": [
        "https://developers.cloudflare.com/cloudflare-one/access-controls/"
      ]
    },
    {
      "id": "CCA-LIFE-001",
      "category": "lifecycle",
      "title": "Version and deprecate predictably",
      "requirement": "Breaking API changes MUST use a new major route or negotiated version. Deprecated operations MUST be marked in OpenAPI, documented with a replacement, and return Deprecation and Sunset information before removal with a proportionate migration period.",
      "level": "must",
      "automated": false,
      "references": [
        "https://www.rfc-editor.org/rfc/rfc9745",
        "https://www.rfc-editor.org/rfc/rfc8594"
      ]
    },
    {
      "id": "CCA-DISC-001",
      "category": "discovery",
      "title": "Publish API discovery",
      "requirement": "Public API publishers MUST participate in the RFC 9727 catalog and SHOULD advertise discovery from relevant root and detail responses with RFC 8631 service-desc, service-doc, service-meta, and status Link relations.",
      "level": "must",
      "automated": true,
      "references": [
        "https://www.rfc-editor.org/rfc/rfc9727",
        "https://www.rfc-editor.org/rfc/rfc8631"
      ]
    },
    {
      "id": "CCA-AGENT-001",
      "category": "agents",
      "title": "Publish agent-readable documentation",
      "requirement": "Public services SHOULD provide concise llms.txt discovery and clean Markdown documentation linked to the authoritative OpenAPI and status resources. Agent-facing claims MUST not exceed actual schema, example, freshness, or operation coverage.",
      "level": "should",
      "automated": true,
      "references": [
        "https://llmstxt.org/"
      ]
    },
    {
      "id": "CCA-AGENT-002",
      "category": "agents",
      "title": "Describe multi-service workflows with Arazzo",
      "requirement": "Common repeatable workflows that call one or more public APIs SHOULD be published as Arazzo documents using stable operation references and explicit inputs, success criteria, outputs, and failure handling.",
      "level": "should",
      "automated": true,
      "references": [
        "https://spec.openapis.org/arazzo/latest.html"
      ]
    },
    {
      "id": "CCA-AGENT-003",
      "category": "agents",
      "title": "Use overlays for non-breaking enrichment",
      "requirement": "Agent-facing descriptions, examples, classifications, and corrections SHOULD be distributed as OpenAPI Overlay documents when upstream specifications cannot be changed immediately. Overlays MUST identify their target and MUST NOT conceal runtime drift.",
      "level": "should",
      "automated": true,
      "references": [
        "https://spec.openapis.org/overlay/latest.html"
      ]
    },
    {
      "id": "CCA-BIND-001",
      "category": "service-bindings",
      "title": "Document service bindings safely",
      "requirement": "Services supporting Cloudflare service bindings SHOULD document the public-safe contract, request envelope, authentication responsibility, compatibility expectations, and local-test strategy without publishing account IDs, private hostnames, credentials, or secret binding configuration.",
      "level": "should",
      "automated": false,
      "references": [
        "https://developers.cloudflare.com/workers/runtime-apis/bindings/service-bindings/"
      ]
    },
    {
      "id": "CCA-PRIV-001",
      "category": "privacy",
      "title": "Classify and minimize sensitive data",
      "requirement": "Each service MUST classify its data as public, restricted, confidential, or PII-bearing; collect and return only fields needed for the documented purpose; define retention; redact logs; and require a privacy and security review before exposing person-level or licensed data.",
      "level": "must",
      "automated": false,
      "references": [
        "https://www.nist.gov/privacy-framework"
      ]
    },
    {
      "id": "CCA-OBS-001",
      "category": "observability",
      "title": "Provide structured service health and telemetry",
      "requirement": "Services MUST expose safe health metadata and emit structured logs and traces with request correlation, latency, status, cache outcome, and upstream state. Logs MUST exclude secrets and unnecessary personal data. Alerts SHOULD cover freshness and coverage, not only process uptime.",
      "level": "must",
      "automated": false,
      "references": [
        "https://developers.cloudflare.com/workers/observability/"
      ]
    },
    {
      "id": "CCA-D1-001",
      "category": "database-safety",
      "title": "Keep D1 bounded and rebuildable",
      "requirement": "D1 MUST contain only bounded, rebuildable metadata, identity records, pointers, and indexes. Immutable raw bytes, large fact tables, documents, and unbounded history MUST live in R2. R2 SQL or any other beta feature MUST NOT be required for public request correctness.",
      "level": "must",
      "automated": false,
      "references": [
        "https://developers.cloudflare.com/d1/platform/limits/",
        "https://developers.cloudflare.com/d1/observability/metrics-analytics/"
      ]
    },
    {
      "id": "CCA-D1-002",
      "category": "database-safety",
      "title": "Design deterministic D1 sharding before ingest",
      "requirement": "Every D1-backed design MUST choose and document a deterministic shard key before ingest, maintain a versioned shard map, and prove that every shard can be rebuilt from immutable R2 manifests. CI and design review MUST reject an unsharded schema whose modeled corpus plus index growth can exceed the 7.5 GB admission ceiling.",
      "level": "must",
      "automated": false,
      "references": [
        "https://developers.cloudflare.com/d1/platform/limits/"
      ]
    },
    {
      "id": "CCA-D1-003",
      "category": "database-safety",
      "title": "Enforce D1 capacity gates",
      "requirement": "Each D1 shard MUST begin rollover and provision its successor by 7.0 GB, stop write admission when projected post-write or peak usage could exceed 7.5 GB, and target 5.0 GB or less after rebalancing. Systems MUST reserve at least 2.5 GB under the non-increasable 10 GB hard cap. Batches, index builds, copy or rebuild migrations, VACUUM, and rollback reserve MUST be included in the peak estimate and MUST NOT run when projected peak usage exceeds 7.5 GB.",
      "level": "must",
      "automated": true,
      "references": [
        "https://developers.cloudflare.com/d1/platform/limits/"
      ]
    },
    {
      "id": "CCA-D1-004",
      "category": "database-safety",
      "title": "Fail closed before D1 capacity exhaustion",
      "requirement": "Ingest MUST estimate projected post-write and peak bytes before writes, enforce documented row, batch, and transaction bounds, checkpoint progress, and stop or queue work when admission would cross the 7.5 GB gate. It MUST reject earlier when migration, index, VACUUM, or rollback reserve requires space and fail closed rather than relying on the platform to reject an oversized database.",
      "level": "must",
      "automated": true,
      "references": [
        "https://developers.cloudflare.com/d1/platform/limits/"
      ]
    },
    {
      "id": "CCA-D1-005",
      "category": "database-safety",
      "title": "Observe every D1 shard",
      "requirement": "Status and telemetry MUST expose each shard's platform-reported databaseSizeBytes, percentage of the 10 GB cap, recent growth rate, projected exhaustion date, threshold state, and last verified timestamp. Alerting MUST trigger before 7.0 GB. Account-wide storage and Worker binding limits MUST be reported separately and MUST NOT be treated as increasing the 10 GB per-database hard cap or changing D1's single-threaded execution model.",
      "level": "must",
      "automated": true,
      "references": [
        "https://developers.cloudflare.com/d1/platform/limits/",
        "https://developers.cloudflare.com/d1/observability/metrics-analytics/"
      ]
    },
    {
      "id": "CCA-PIPE-001",
      "category": "pipeline",
      "title": "Archive immutable source bytes before indexing",
      "requirement": "External data pipelines MUST archive verified immutable source bytes in R2 before parsing or indexing. Pipeline Workers MUST use scoped Worker administration APIs and service bindings and MUST NOT hold direct D1 or R2 account credentials.",
      "level": "must",
      "automated": false,
      "references": [
        "https://developers.cloudflare.com/r2/"
      ]
    },
    {
      "id": "CCA-PIPE-002",
      "category": "pipeline",
      "title": "Download and discover sources defensively",
      "requirement": "Downloads MUST use a temporary .part path, incremental SHA, declared and actual size checks, response framing and magic-byte validation, bot or challenge detection, and atomic rename only after verification. Discovery MUST fail closed and MUST NOT guess source URLs. Download caps and multipart sizes are source-specific implementation values, not fleet constants.",
      "level": "must",
      "automated": false,
      "references": []
    },
    {
      "id": "CCA-PIPE-003",
      "category": "pipeline",
      "title": "Verify immutable object publication",
      "requirement": "Multipart completion MUST verify the remote SHA and size. An existing immutable key with conflicting bytes MUST stop the pipeline and MUST never be overwritten. Archive extraction MUST reject path traversal, absolute paths, symlinks, duplicate names, excessive expansion or compression ratio, encrypted entries, truncation, CRC failures, and unsafe ZIP64 structures.",
      "level": "must",
      "automated": true,
      "references": []
    },
    {
      "id": "CCA-PIPE-004",
      "category": "pipeline",
      "title": "Normalize deterministically",
      "requirement": "Source adapters MUST separate discovery metadata from bounded record iteration. Shared normalizers MUST be centralized and versioned. Canonical JSON, stable ordering, and deterministic duplicate-winner rules MUST make equivalent inputs produce byte-identical artifacts and shard assignments.",
      "level": "must",
      "automated": true,
      "references": []
    },
    {
      "id": "CCA-PIPE-005",
      "category": "pipeline",
      "title": "Bound and partition durable pipeline work",
      "requirement": "D1-facing writes MUST default to batches of no more than 500 rows unless a documented load test supports another bound. Durable state MUST partition work by release, source, shard, and batch. Queue and Workflow messages MUST contain immutable pointers and identity metadata only, never large mutable payloads. Lease durations are implementation-specific, not universal constants.",
      "level": "must",
      "automated": false,
      "references": [
        "https://developers.cloudflare.com/queues/",
        "https://developers.cloudflare.com/workflows/"
      ]
    },
    {
      "id": "CCA-PIPE-006",
      "category": "pipeline",
      "title": "Reconcile exactly before promotion",
      "requirement": "Promotion MUST require exact expected shard and record-count reconciliation. Ledger, checkpoint, lease, and compare-and-swap state MUST make replay idempotent and reject stale ownership tokens. Pipelines MUST reject zero-result releases, modeled corpus mismatches, unsafe object paths, and ambiguous corrections rather than promoting partial data.",
      "level": "must",
      "automated": true,
      "references": []
    },
    {
      "id": "CCA-PIPE-007",
      "category": "pipeline",
      "title": "Bind releases to complete provenance manifests",
      "requirement": "Every promotable release MUST have a canonical provenance manifest binding discovered URLs, validators, content length, source SHA, schema and normalization versions, shards, expected and actual counts, and immutable object keys. Secret configuration SHOULD support NAME_FILE indirection, and logs MUST redact secret values and sensitive source parameters.",
      "level": "must",
      "automated": true,
      "references": []
    },
    {
      "id": "CCA-PIPE-008",
      "category": "pipeline",
      "title": "Test pipeline faults, replay, and promotion",
      "requirement": "End-to-end tests MUST cover interrupted and malformed downloads, archive attacks, multipart retries and conflicts, duplicate deliveries, lease expiry and stale tokens, checkpoint replay, count or shard mismatch, failed promotion, and successful atomic promotion from archived source through serving indexes.",
      "level": "must",
      "automated": false,
      "references": []
    },
    {
      "id": "CCA-PIPE-010",
      "category": "pipeline",
      "title": "Allocate production-scale ingest test memory explicitly",
      "requirement": "Test and rehearsal processes that exercise production-scale or full-corpus ingestion MUST run in a documented runner profile with more than 28 GB of memory allocated and MUST record the profile in CI or the runbook. This requirement is not applicable to bounded unit, contract, and small deterministic fixture tests.",
      "level": "must",
      "automated": false,
      "references": []
    },
    {
      "id": "CCA-PIPE-009",
      "category": "pipeline",
      "title": "Coordinate cross-resource writes with sagas",
      "requirement": "Workflows spanning D1, R2, queues, or append-only audit stores MUST use a saga or transactional outbox with durable commit markers, deterministic work IDs, content-addressed staging, a D1 delivery ledger, enqueue-after-staging, leases with owner tokens, conditional terminal writes, dead-letter handling, reconciliation, and idempotent replay.",
      "level": "must",
      "automated": false,
      "references": []
    },
    {
      "id": "CCA-DATA-003",
      "category": "data-semantics",
      "title": "Preserve immutable evidence and independent quality dimensions",
      "requirement": "Evidence-bearing systems MUST preserve immutable captures and hashes plus support and contradiction relationships, exact quotes or spans or pages, and source authority. Confidence, verification state, and publication state MUST remain orthogonal. Publication eligibility MUST be continuously derived from current evidence and policy, not stored as an unexamined permanent flag.",
      "level": "must",
      "automated": false,
      "references": []
    },
    {
      "id": "CCA-DATA-004",
      "category": "data-semantics",
      "title": "Version and reconcile projections",
      "requirement": "Derived projections MUST expose their source revision and freshness. Rebuilders MUST track dirty generations, compare the generation before clearing dirty state, and leave newer work pending when concurrent changes arrive.",
      "level": "must",
      "automated": false,
      "references": []
    },
    {
      "id": "CCA-ID-001",
      "category": "identity",
      "title": "Encode only immutable namespaces in stable IDs",
      "requirement": "Stable identifiers MAY encode only a prefix registered in the fleet namespace registry that denotes an immutable namespace or record kind. They MUST NOT encode a mutable classification, status, ownership role, geography, or lifecycle value. Prefix allocation MUST be reviewed for collision before use.",
      "level": "must",
      "automated": true,
      "references": []
    },
    {
      "id": "CCA-ID-002",
      "category": "identity",
      "title": "Model legal-entity classifications and relations temporally",
      "requirement": "Legal entities MUST use the neutral ecgc namespace with canonical syntax ecgc-[0-9a-z]{12}. corp, npo, fund, sub, and gov prefixes are prohibited for legal-entity identity because corporation, nonprofit, fund, and government are temporal provenanced classifications, while subsidiary_of is a temporal relationship rather than an entity type.",
      "level": "must",
      "automated": true,
      "references": []
    },
    {
      "id": "CCA-ID-003",
      "category": "identity",
      "title": "Make identity edges auditable",
      "requirement": "Identity and relationship edges MUST use surrogate edge IDs, enforce uniqueness for active equivalent edges, retain audited reassignment history, and normalize identifiers by scheme-specific rules rather than generic separator stripping. Alias resolution MUST return ambiguity explicitly and MUST NOT select an unordered first match. Redirect and alias tables MUST be explicit, cycle-checked, tombstone-aware, and immutable in audit history.",
      "level": "must",
      "automated": false,
      "references": []
    },
    {
      "id": "CCA-ID-005",
      "category": "identity",
      "title": "Govern canonical legal-entity minting",
      "requirement": "cca-entities is the sole minting authority for ecgc-[0-9a-z]{12} legal-entity IDs unless one atomic global allocator is designated. IDs MUST use Web Crypto with a lowercase base36 custom alphabet, be immutable and non-reusable, and mint by retrying actual INSERT uniqueness conflicts rather than SELECT-then-INSERT. Consumers MUST validate syntax only and otherwise treat IDs as opaque. Legacy e###-*, noncanonical ecgc-*, enty-*, and entm-* identifiers MUST migrate through audited aliases and immutable cycle-checked redirects.",
      "level": "must",
      "automated": false,
      "references": []
    },
    {
      "id": "CCA-DATA-005",
      "category": "data-semantics",
      "title": "Publish source use restrictions",
      "requirement": "Source registries and provenance manifests MUST record license, redistribution rights, solicitation restrictions, and other use constraints and surface applicable restrictions in APIs and public UI. Classification labels are descriptive metadata and MUST NOT be presented as legal determinations.",
      "level": "must",
      "automated": false,
      "references": []
    },
    {
      "id": "CCA-SUPPLY-001",
      "category": "supply-chain",
      "title": "Inventory vendored references",
      "requirement": "Every vendored schema, template, rule, or reference artifact MUST have an inventory entry containing its source URL, retrieval timestamp, byte size, SHA-256 digest, and applicable LICENSE or NOTICE material.",
      "level": "must",
      "automated": false,
      "references": []
    },
    {
      "id": "CCA-HIST-001",
      "category": "history",
      "title": "Serve snapshot history from indexed metadata",
      "requirement": "Snapshot and release history MUST be served from bounded indexed metadata. Public request paths MUST NOT enumerate R2 with LIST to reconstruct history at request time.",
      "level": "must",
      "automated": false,
      "references": [
        "https://developers.cloudflare.com/r2/api/workers/workers-api-reference/"
      ]
    },
    {
      "id": "CCA-BIND-002",
      "category": "service-bindings",
      "title": "Keep service enrichments independent",
      "requirement": "Service-binding enrichments MUST degrade independently so one unavailable enrichment does not corrupt the owned core record. Enrichment responses MUST retain their source ownership and MUST NOT be persisted or republished as data owned by the calling service.",
      "level": "must",
      "automated": false,
      "references": []
    },
    {
      "id": "CCA-PRIV-002",
      "category": "privacy",
      "title": "Treat event-log allowlists as privacy controls",
      "requirement": "Event-log field allowlists are privacy and exfiltration tripwires, not ownership registries or authority boundaries. Ownership and authorization MUST be modeled separately, while event payload schemas default-deny unreviewed fields.",
      "level": "must",
      "automated": false,
      "references": []
    },
    {
      "id": "CCA-ID-004",
      "category": "identity",
      "title": "Preserve identity through organizational change",
      "requirement": "Mergers and acquisitions MUST retain both stable IDs and add effective-dated predecessor and successor relationships. Spin-offs MUST receive new IDs. Identifiers MUST NOT transfer or redirect implicitly; every reassignment or alias requires explicit provenance, effective dates, and immutable audit.",
      "level": "must",
      "automated": false,
      "references": []
    },
    {
      "id": "CCA-ROUTE-001",
      "category": "routing",
      "title": "Generate contracts and policies from a typed route registry",
      "requirement": "Services SHOULD define routes in one declarative typed registry that generates or validates the runtime router, OpenAPI operations, cache policy, rate-limit policy, CORS policy, and authorization classification. Duplicate hand-maintained route and contract lists SHOULD be rejected in review.",
      "level": "should",
      "automated": false,
      "references": []
    },
    {
      "id": "CCA-OBS-002",
      "category": "observability",
      "title": "Separate liveness, readiness, and deep status",
      "requirement": "Services MUST distinguish process liveness, request-serving readiness, and deeper dependency, coverage, and freshness status. Lightweight liveness MUST NOT perform expensive upstream checks; deep status SHOULD report bounded safe diagnostics and partial or stale dependencies.",
      "level": "must",
      "automated": false,
      "references": []
    },
    {
      "id": "CCA-DEPLOY-001",
      "category": "deployment",
      "title": "Deploy data and service changes safely",
      "requirement": "Stateful deployments MUST serialize classify, expand, apply, verify, activate, and contract phases; use globally unique migration identifiers; rehearse against representative backups; define queue drain and resume; follow declared dependency order; deploy compatible service-binding callees before callers; require dry-run and smoke checks; roll out gradually; and run post-deploy acceptance. Rollback plans MUST state that reverting Worker code does not undo a D1 migration.",
      "level": "must",
      "automated": false,
      "references": []
    },
    {
      "id": "CCA-WORKER-001",
      "category": "workers",
      "title": "Use current safe Worker configuration",
      "requirement": "Worker services MUST use wrangler.jsonc, a reviewed current compatibility date, nodejs_compat where dependencies require it, observability with deliberate sampling, generated Env types for bindings, static assets configuration when serving files, and no hardcoded secrets. Internal HTTP APIs SHOULD use Hono and Zod with bounded UTF-8 JSON and explicit status and request IDs. Public APIs MUST use /api/v1, explicit caching and CORS, OpenAPI, and configured Workers Static Assets when serving a UI.",
      "level": "must",
      "automated": true,
      "references": [
        "https://developers.cloudflare.com/workers/best-practices/workers-best-practices/"
      ]
    },
    {
      "id": "CCA-TEST-001",
      "category": "conformance",
      "title": "Test and score conformance honestly",
      "requirement": "CI MUST validate schemas, unique operationId values, examples, response contracts, CORS, caching, error status and media types, discovery links, strict missing-route behavior, privacy boundaries, and representative runtime parity. Published scores MUST identify the rule version, evidence date, automated coverage, warnings, and blockers.",
      "level": "must",
      "automated": true,
      "references": []
    }
  ],
  "count": 59,
  "categories": [
    "agents",
    "conformance",
    "data-semantics",
    "database-safety",
    "deployment",
    "discovery",
    "errors",
    "history",
    "http",
    "identity",
    "lifecycle",
    "manifest",
    "observability",
    "openapi",
    "pipeline",
    "privacy",
    "query",
    "routing",
    "security",
    "service-bindings",
    "supply-chain",
    "ui",
    "workers"
  ],
  "artifacts": {
    "schema": "https://services.datasourceapi.com/schema/standards.schema.json",
    "serviceManifestSchema": "https://services.datasourceapi.com/schema/services.schema.json",
    "d1CapacitySchema": "https://services.datasourceapi.com/schema/d1-capacity.schema.json",
    "namespaceRegistry": "https://services.datasourceapi.com/api/v1/standards/namespaces",
    "namespaceSchema": "https://services.datasourceapi.com/schema/namespaces.schema.json",
    "spectralRuleset": "https://services.datasourceapi.com/standards/openapi.spectral.yaml",
    "arazzo": "https://services.datasourceapi.com/standards/arazzo.yaml",
    "openapiOverlay": "https://services.datasourceapi.com/standards/agent-enrichment.overlay.yaml"
  }
}