fedarch/_GOVERNANCE_/BP-543-1.md

---
title: "Cloudflare Tagged Resources — #BestPractices for #🎭︱bMAIT︱♾️︱Dev 💻 [.OCA] #devTEAM v5.42.7-r2"
type: best-practices
tags: [cloudflare, tagged-resources, resource-tagging, best-practices, devteam, bmait-dev, imait-cloudflare, responsibleagenticai, hybridarchitecture, w43d1]
status: draft
created: 2026-10-19
notes: "G3 FOLD by MC-BA-CCC-META (seat c8ef1e30, directive abed455d) — CORE6 Round 1 verdicts folded (4/6: 💻 PASS · 🛡️ PASS-WITH-FIXES · 🐳 CONDITIONAL PASS · 🚀 PASS-WITH-FIXES). Round 2 review REMOVED by @GTM 85249486. Surface = Cloudflare Resource Tagging (Tagged Resources Beta). Scope = devTEAM convention. date reconciled to MDT-wins (2026-10-19). NOT R-011 approved."
---

# Cloudflare Tagged Resources — #BestPractices (bMAIT Dev)

> **v5.42.7-r2** · G3-FOLD output (CORE6 Round 1 closed at 4/6) · #LLMmodel: **DeepSeek V4 Pro 0813** · ⛔ R-011 NOT charged
> **[REF] `GTM_2026-W42_7013`** (reference-only, R-194 — CCC-ID = 🐳 lane)
> **Directive:** `abed455d…` (@GTM, 2026-10-19T05:13:17Z) · **Channel:** 🎭︱iMAIT︱🌐︱Cloudflare `2ee39e9f`
> **Draftsman/Folder:** MC-BA-CCC-META (`c8ef1e3080708fa9a0690cd344baeabe2fddc65d881ba1215cef4887efdda837`)
> **Inputs frozen:** G0 v3 (`018133f1`) = 🐝 LEARN r2 (`88d797ba…`) · 🐳 vendor verify (`029114a7`, `d49b957c…`) · 🚀 R1 pre-review (`5d788bd8`)
> **Audience:** #🎭︱bMAIT︱♾️︱Dev 💻 [.OCA] #devTEAM contributors
> **Corpus vintage:** public-beta corpus read Apr 27–29 2026 (limits/overview) + Sep 15 2026 (resource-types) — ⚠️ *"the API is stable, but behavior may change"* (vendor overview); re-fetch before a v2 leg.

---

## §0 — Purpose & one-line rule

Cloudflare **Resource Tagging** ("Tagged Resources (Beta)" in the dashboard) attaches custom `key:value` metadata to Cloudflare resources for **organization, access control, and billing attribution** — available on **all plans**, stored **separately from the resources themselves**.

**The one-line rule:** *Pin one canonical byte form per key and value, get→merge→put for every edit, and never read a tag-store `500` as a broken resource.*

---

## §1 — Two tag surfaces (do NOT conflate)

"Tags" names **two non-interchangeable Cloudflare features**. This BP governs **Surface B**.

| Axis | **A — DNS-record tags + comments** | **B — Resource Tagging (this BP)** |
|:--|:--|:--|
| Scope | one DNS **record** | account-level + zone-level **resources** (incl. `dns_record`) |
| Shape | `name`:`value` per record | `key` → `value` per resource |
| **Case** | tag **names NOT case-sensitive** | **keys AND values case-sensitive** |
| Plan gate | Tag = **Pro+** (Free: Comment only) | **All plans** |
| Limits | 32 · 100 · 20 per record | 256 · 1,024 · 10,000 per account |
| Write | per-record update | **`PUT` replaces ALL** · `DELETE` removes ALL · no `PATCH` |
| REF home | the `comment` field | ⚠️ **none documented** (see §5) |
| Auth | zone-scoped token | **AOTs** (recommended, not exclusive — §3.1) |

⚠️ **The same DNS record can be addressed by both surfaces** (`dns_record` is a B taggable type), and the docs **never state the two stores interop**. **Do NOT assert they merge.** Until verified empirically (needs account access), this BP scopes to Surface B only, and the W42 D1 BP governs Surface A.

---

## §2 — Frozen vendor facts (tool-verified, two independent reads)

Two seats fetched the docs corpus first-hand (🐝 `88d797ba…` 4 pages + 🐳 `d49b957c…` 7 pages, HTTP 200), and independently reproduced every figure below.

### 2.1 Limits (beta)

| Limit | Value | Error code |
|:--|:--|:--|
| Max tags per account | **10,000** | — |
| Max tag key length | **256** ch | `1011` |
| Max tag value length | **1,024** ch | `1012` |
| Max tag filters per query | **20** | `1010` |
| Max OR values per filter | **10** | `1013` |
| Results per page | **100 (fixed)** — cursor pagination | — |

Exceeding ⇒ **400** + code. **No per-resource count limit** is published — the only count cap is per-account.

### 2.2 Case sensitivity (load-bearing)

> *"Tag keys **and** values are case-sensitive. `Environment`, `environment`, `ENVIRONMENT` are three distinct keys."*

⇒ **Pin the canonical byte form.** `SEASON` ≠ `season` ≠ `Season`. A typo forks a filter silently.

### 2.3 Key charset = UNICODE

Allowed: **Unicode letters (any language)** · Unicode digits · `_` · `.` · `-`. Disallowed: empty, spaces, specials (`@`) ⇒ 400 + `1014`. Note: **values are NOT character-restricted** the way keys are — the charset rules above apply to *keys*; values are free text up to 1,024 ch.
⚠️ Vendor self-inconsistency: the `1014` Resolution text says "letters, digits, `_`, `.`, `-`" while the normative validation table says **Unicode**. A rule reading "ASCII" is wrong.

### 2.4 Write semantics (the hazard is a PAIR)

`GET` / `PUT` / `DELETE` only — **no `PATCH`**. **`PUT` replaces the entire tag set** ⇒ edit = `GET` → merge → `PUT`. **`DELETE` removes ALL tags** — no single-tag delete (`1015`, "Invalid delete payload").

> ⚠️ **The hazard is a PAIR, not one rule.** `PUT` protects the "preserve existing tags" half; `DELETE` protects the "remove all" half. **Single-tag removal is NOT `DELETE` — it is `GET` → omit the key → `PUT` the remaining set.** `DELETE` wipes the ENTIRE tag set (vendor's own example: decommissioning a resource). ⇒ **`DELETE` is human-gated — never routine automation.** (Post-R1 fold: 🛡️ M-2 / 🚀 N-4 converged on this as a missing operating rule.)

### 2.5 500-not-404 (scoped)

`GET …/tags?resource_type=…&resource_id=…` on a never-tagged / non-existent resource → **500** (not 404). The **list** endpoints (`/tags/resources`, `/tags/keys`, `/tags/values/{key}`) return **200 + empty array** ("expected, not an error"). ⇒ alerts must scope, not treat any 500 as breakage.

### 2.6 Filter grammar

`tag=k` (key-only) · `tag=k=v` · `tag=k=a,b` (OR, ≤10) · `tag=!k` · `tag=k!=v` · multiple `tag=` = AND (≤20). Separator is **`=` not `:`** (API error text still says `:` — outdated, code `1007`). Discovery: `/tags/keys` · `/tags/values/{key}?type=…`. `DELETE` → 204.

### 2.7 Taggable inventory = 37 types (scope truth)

**Zone-level (11):** `zone` · `dns_record` · `custom_hostname` · `custom_certificate` · `managed_client_certificate` · `load_balancer` · `healthcheck` · `worker_route` · `zone_ruleset` · `api_gateway_operation` · `access_application_policy`.
**Account-level (26):** `account` · `access_application` · `access_group` · `account_ruleset` · `ai_gateway` · `alerting_policy` · `alerting_webhook` · `cloudflared_tunnel` · `d1_database` · `durable_object_namespace` · `gateway_list` · `gateway_rule` · `image` · `infrastructure_target` · `kv_namespace` · `load_balancer_monitor` · `load_balancer_pool` · `pages_project` · `queue` · `r2_bucket` · `resource_share` · `stream_live_input` · `stream_video` · `vectorize_index` · `worker` · `worker_version`.

⇒ **"v1 = Zones only" is a deliberate narrowing of 37** — this BP scopes v1 to Zones and says so explicitly (§4).

---

## §3 — Auth & enablement (devTEAM must know)

**3.1** Credentials = **Account Owned Tokens (AOTs), recommended not exclusive** — an account **or user** API token is permitted.

**3.2 RBAC** — create/update/delete tags requires **Super Administrator**, **Workers Admin**, or **Tag Admin**; token scope `#com.cloudflare.api.account.tag.list`.

**3.3 Per-account enablement** — 403 naming *feature*/*gate* ⇒ "Tagging is not enabled for this account." ⇒ **"all plans" ≠ "already enabled"**. Pre-flight = `GET …/tags/keys`.

---

## §4 — v1 scope (deliberately narrowed)

- **Surface:** B only (Resource Tagging).
- **Resource types:** v1 = **Zones** (`zone` type). The full 37-type inventory (§2.7) is stated so v1 is not misread as complete.
- **System-of-record account:** ⚠️ **OPEN — owner to name** the account that is the system of record (the screenshot's sidebar label begins `Billing+cloudflare@…`). This BP does not presume. **⚠️ GATE CONDITION: this BP is unactionable for #devTEAM until the account is named — the owner call must land BEFORE finalize (G5), not merely before the fold (G3).**
- **Worked example:** the `noQBO` zone set (`noqbo.club` / `noqbo.ai` / `noqbo.org`).

---

## §5 — Tag-key convention (v1)

**Canonical (settled in v1):** key *names* are pinned — **UPPERCASE_SNAKE**. **Values are NOT canonicalized in v1** — every value form below is **⏳ OPEN (recommended-pending, owner call)** and must not be read as settled (see §6 residuals; fixes 🐳 MF-2 / 🚀 G-2).

| Key | Meaning | Value form (⏳ = OPEN) |
|:--|:--|:--|
| `OCA` | owning .OCA / project slug | e.g. `NOQBO` — ⏳ §7.2 |
| `PURPOSE` | resource role (single concern) | slug — ⏳ §6.2 |
| `REGISTRAR` | registrar canonical slug | controlled vocabulary — ⏳ §6.3 |
| `SEASON` | WeOwn season (§7.5) | `005` — ⏳ §7.5 snapshot convention |
| `STATUS` | product **lifecycle** (§6.1) | controlled enum — ⏳ §6.1 (NOT an enum yet) |
| `REF` | provenance (§7.1) | `GTM_2026-W…_NNNN` — ⏳ §7.1 |

**Observed-but-uncanonized (do NOT copy as enum):** the screenshot's 5 keys (`OCA` `PURPOSE` `REGISTRAR` `SEASON` `STATUS`) are a usable spine; their **values** are not yet controlled (§6). Keys are **pinned**; values are **proposed** (not ruled) pending §6.1–6.3 / §7.2. Intake-only candidate keys for the (now-removed) Round 2 (§7.4) are NOT adopted in v1.

---

## §6 — Residuals (deferred to owner — Round 2 REMOVED by @GTM `85249486`, not resolved here)

**6.1 `STATUS` is not an enum.** Screenshot mixes `NOT_IN_USE` (slug) with `LIVE (production)` (free text). **Grok must-fix #1/2.** This BP recommends — does not rule — splitting ENV out of STATUS and defining STATUS as product lifecycle (not zone existence).

**6.2 `PURPOSE` mixes role/product/vendor.** `Fluent Community Portal` vs `www (website)` vs `email (Proton Mail)` conflate role, product, and mailhost. Separate role-slug from product/mailhost.

**6.3 Pin one `REGISTRAR` byte form.** `Porkbun.com` vs `porkbun`; `UnstoppableDomains.com` vs `UD` — fork filters. Recommend canonical slugs: `PORKBUN`, `UNSTOPPABLEDOMAINS` (mem/domain-registrars #1 = UD). ⚠️ **These are RECOMMENDED, not normative** — §5's `REGISTRAR` cell is ⏳ OPEN; this recommendation and §5's "controlled vocabulary" label are not yet reconciled (owner call; 🐳 N-2).

**6.4 Surface-A limits must NOT leak onto B.** (already handled by §1 fork.)

**6.5 `REF` has no documented home at B.** §7.1.

**6.6 Filename subject slug.** `v5.42.7-r1` collides across five concurrent W42 D7 efforts (FLUX.3-Klein · YourStory Ch.3 · this · BURNEDOUT · gm/gn Top5). Always reference as **"Cloudflare Tagged Resources v5.42.7-r1"**.

---

## §7 — OPEN questions (owner call — Round 2 REMOVED by @GTM `85249486`, not this seat's ruling)

1. **Provenance at B:** `REF:`-valued tag (this BP's §5 default), a comment field if one exists, or no REF — owner call.
2. **Value enums:** controlled vocabulary per key (`STATUS`, `PURPOSE`) vs free text.
3. **Key-case byte form:** UPPERCASE_SNAKE (§5 default) vs case-folded.
4. **Additional candidate tags (intake only, NOT adopted in v1):** `ENV` · `OWNER` · `SERVICE`/`ROLE` · `IMPACT`/`CRITICALITY` · `LOCKED`/`PROTECTED` · `BACKUP` · `MIGRATION`/`HYBRID` · `EXPIRES`. (🚀 flags `DNS_MODE` = per-record ⇒ belongs on Surface A, not here.)
5. **Snapshot convention:** `SEASON: 005` → `006` at S005→S006 flip — date-added tag vs replace.
6. **A/B store interop** (§1) — empirically unverified; scope-or-verify.
7. **Product-name fork:** vendor = **Resource Tagging**; UI label = **Tagged Resources (Beta)** — owner naming ruling.
8. **`DELETE`-all operating rule (§2.4):** confirm the cadence/maintenance stance — `DELETE` (remove-all, decommissioning) is human-gated and never routine automation; single-tag removal is always `GET`→omit→`PUT`. This rule was restored at G3 fold (🛡️ M-2; 🐝 G0 v3 LEARN §5 carried five open questions with no `DELETE`-cadence item, so nothing was silently dropped).
9. **Deferred R2 intake (G4 struck by @GTM `85249486`):** three operating rules the reviewers parked for the now-removed iMAIT-META Round 2 — **recorded here, not silently dropped, and not ruled by this seat:**
   - **Single-writer rule** (🛡️-1 ≡ 🚀-1): one writer per change window — `PUT`-only-new deletes unnamed tags, so two MAITs on one account clobber each other.
   - **Account budget** (🛡️-2 ≈ 🚀-2): cap 10,000 tags/account is the only count limit; `dns_record` is one of the 11 zone types — budget before v1 leaves Zones.
   - **Value byte-case** (🛡️-3 ≡ 🚀-3): values are case-sensitive — if §7.2 pins an enum, pin the byte-case too (`prod` ≠ `PROD`).

---

## §8 — Worked example (from @GTM screenshot, vision-read by 3 seats)

3 Zones, filter **`name:noQBO`** (⚠️ this is the **resource-name filter**, not a tag — the tag box placeholder in the same shot reads `env=prod`; 🐳 N-1 / 🚀 N-2), all `Zone` type:

| Zone | OCA | PURPOSE | REGISTRAR | SEASON | STATUS |
|:--|:--|:--|:--|:--|:--|
| `noqbo.club` | `noQBO` | `Fluent Community Portal` | `Porkbun.com` | `005` | `NOT_IN_USE` |
| `noqbo.ai` | `noQBO` | `www (website)` | `UnstoppableDomains.com` | `005` | `NOT_IN_USE` |
| `noqbo.org` | `noQBO` | `email (Proton Mail)` | `UnstoppableDomains.com` | `005` | `LIVE (production)` |

⚠️ Vision read disclosed (§203) — the account's own API is the authority. `org` LIVE matches mail (MX→Proton), not a website; `club`/`ai` `NOT_IN_USE` matches "no address records," not "zone absent" (🚀 DNS, `5d788bd8`).
⚠️ **These values VIOLATE §5's own value form** (`noQBO` · `Fluent Community Portal` · `Porkbun.com` · `LIVE (production)` vs §5's `UPPERCASE_SLUG`-no-spaces) **— shown as-observed, do NOT copy as the canonical form** (🐳 MF-3 / 🚀 G-3). §5 keeps values OPEN precisely because the live example does not yet conform.

---

## §9 — Sources (all tool-verified, attributed)

| # | Source | Seat |
|:-:|:--|:--|
| 1 | @GTM directive `abed455d…` + screenshot `b80b90c3…png` | @GTM |
| 2 | 🐝 LEARN r2 `RESEARCH/CLOUDFLARE_TAGGED_RESOURCES_BESTPRACTICES_LEARN_W42D7_FEDARCHBUZZ.md` (`88d797ba…`) | 🐝 |
| 3 | 🐳 vendor verify `RESEARCH/CLOUDFLARE_RESOURCE_TAGGING_VENDOR_VERIFY_W42D7_SEAT1.md` (`d49b957c…`, 7 pages HTTP 200) | 🐳 |
| 4 | 🚀 R1 pre-review `RESEARCH/CLOUDFLARE_TAGGED_RESOURCES_R1_PREVIEW_GROK_W42D7.md` (`550803ee…`) | 🚀 |
| 5 | G0 v3 freeze posts `64e3c4de` / `d31eccad` (v2) / `018133f1` (v3) · ⚠️ attribution caveat: `d31eccad` is signed by `09f629ac…` (MC-BA-IMAIT-META-MIMO) and its `p`-tag targets the G1 drafter, not the text's author — for that event the **content hash is the only valid identity anchor**; cite v3 `018133f1` as the frozen input (🐳 MF-5) | 🐝 |
| 6 | CCC-ID anchor `GTM_2026-W42_7013` (🐳 lane, R-194) | 🐳 |

---

## §10 — Drift Gate (BP-497, house rule #128) — baseline for r-next

| Metric | r1 (`8980065c`) | r2 (this fold) |
|:--|:--|:--|
| Lines | 199 | computed at finalize — footer below |
| Words | 1,735 | ↳ |
| Characters | 11,606 | ↳ |
| SHA256 | `8980065cf2ec…cbb5` | computed at finalize — footer below |

*r1 baseline is the measured footer of the r1 draft (pasted here per 🐳 MF-1 / 🚀 G-4 — so r2 has a measurable baseline). r2 is additive-only: **r2 ≥ r1** measured canonical→canonical (content before the last `<!-- CONTENT-HASH-BOUNDARY -->`). The `8980065c` pin is the review object; r2's pin is generated at fold finalize and recorded in the footer.*

---

⛔ **R-011 NOT charged (#127)** · status DRAFT · G3-FOLD output (Round 1 closed 4/6 · Round 2 struck by @GTM) · system-of-record account = ⚠️ OPEN GATE (must land before release) · no tag created/changed/deleted · nothing pushed · no membership change · no CCC-ID minted from this seat (REFERENCE-ONLY, R-194).
<!-- CONTENT-HASH-BOUNDARY -->
### ✅ BP-075 CANONICAL HASH GENERATED [MC-BA-CCC-META G3 fold · bp075_hash.py v4.32.7-r1 --embed @ 2026-10-19 21:40 MDT · stage-only, never push · ⛔ R-011 NOT charged · not @GTM:ADMIN — no human stamped | #HITL by @yonks at 21:52 MDT on 19Oct2026]
Content-SHA256: 8726ff69c4752c095e7262dae1c68dea368a1ebfb9778360743da8610fa3c68d
FEDARCH-CANARY: 8726ff69
CHARACTERS: 15597
WORDS: 2392
LINES: 210

**♾️ WeOwnNet 🌐 [DUNA][.OCA] Ecosystem** ● 🏡 Real Estate and 🤝 cooperative ownership for everyone ● An 🤗 inclusive community, *by 👥 invitation only*.