fedarch/_GOVERNANCE_/BP-543-1.md

title, type, tags, status, created, notes

title	type	tags	status	created	notes
Cloudflare Tagged Resources — #BestPractices for #🎭︱bMAIT︱♾️︱Dev 💻 [.OCA] #devTEAM v5.42.7-r2	best-practices	cloudflare tagged-resources resource-tagging best-practices devteam bmait-dev imait-cloudflare responsibleagenticai hybridarchitecture w43d1	draft	2026-10-19	G3 FOLD by MC-BA-CCC-META (seat c8ef1e30, directive abed455d) — CORE6 Round 1 verdicts folded (4/6: 💻 PASS · 🛡️ PASS-WITH-FIXES · 🐳 CONDITIONAL PASS · 🚀 PASS-WITH-FIXES). Round 2 review REMOVED by @GTM 85249486. Surface = Cloudflare Resource Tagging (Tagged Resources Beta). Scope = devTEAM convention. date reconciled to MDT-wins (2026-10-19). NOT R-011 approved.

Cloudflare Tagged Resources — #BestPractices (bMAIT Dev)

v5.42.7-r2 · G3-FOLD output (CORE6 Round 1 closed at 4/6) · #LLMmodel: DeepSeek V4 Pro 0813 · ⛔ R-011 NOT charged [REF] GTM_2026-W42_7013 (reference-only, R-194 — CCC-ID = 🐳 lane) Directive: abed455d… (@GTM, 2026-10-19T05:13:17Z) · Channel: 🎭︱iMAIT︱🌐︱Cloudflare 2ee39e9f Draftsman/Folder: MC-BA-CCC-META (c8ef1e3080708fa9a0690cd344baeabe2fddc65d881ba1215cef4887efdda837) Inputs frozen: G0 v3 (018133f1) = 🐝 LEARN r2 (88d797ba…) · 🐳 vendor verify (029114a7, d49b957c…) · 🚀 R1 pre-review (5d788bd8) Audience: #🎭︱bMAIT︱♾️︱Dev 💻 [.OCA] #devTEAM contributors Corpus vintage: public-beta corpus read Apr 27–29 2026 (limits/overview) + Sep 15 2026 (resource-types) — ⚠️ "the API is stable, but behavior may change" (vendor overview); re-fetch before a v2 leg.

---

§0 — Purpose & one-line rule

Cloudflare Resource Tagging ("Tagged Resources (Beta)" in the dashboard) attaches custom key:value metadata to Cloudflare resources for organization, access control, and billing attribution — available on all plans, stored separately from the resources themselves.

The one-line rule: Pin one canonical byte form per key and value, get→merge→put for every edit, and never read a tag-store 500 as a broken resource.

---

§1 — Two tag surfaces (do NOT conflate)

"Tags" names two non-interchangeable Cloudflare features. This BP governs Surface B.

Axis	A — DNS-record tags + comments	B — Resource Tagging (this BP)
Scope	one DNS record	account-level + zone-level resources (incl. dns_record)
Shape	name:value per record	key → value per resource
Case	tag names NOT case-sensitive	keys AND values case-sensitive
Plan gate	Tag = Pro+ (Free: Comment only)	All plans
Limits	32 · 100 · 20 per record	256 · 1,024 · 10,000 per account
Write	per-record update	PUT replaces ALL · DELETE removes ALL · no PATCH
REF home	the comment field	⚠️ none documented (see §5)
Auth	zone-scoped token	AOTs (recommended, not exclusive — §3.1)

⚠️ The same DNS record can be addressed by both surfaces (dns_record is a B taggable type), and the docs never state the two stores interop. Do NOT assert they merge. Until verified empirically (needs account access), this BP scopes to Surface B only, and the W42 D1 BP governs Surface A.

---

§2 — Frozen vendor facts (tool-verified, two independent reads)

Two seats fetched the docs corpus first-hand (🐝 88d797ba… 4 pages + 🐳 d49b957c… 7 pages, HTTP 200), and independently reproduced every figure below.

2.1 Limits (beta)

Limit	Value	Error code
Max tags per account	10,000	—
Max tag key length	256 ch	1011
Max tag value length	1,024 ch	1012
Max tag filters per query	20	1010
Max OR values per filter	10	1013
Results per page	100 (fixed) — cursor pagination	—

Exceeding ⇒ 400 + code. No per-resource count limit is published — the only count cap is per-account.

2.2 Case sensitivity (load-bearing)

"Tag keys and values are case-sensitive. Environment, environment, ENVIRONMENT are three distinct keys."

⇒ Pin the canonical byte form. SEASON ≠ season ≠ Season. A typo forks a filter silently.

2.3 Key charset = UNICODE

Allowed: Unicode letters (any language) · Unicode digits · _ · . · -. Disallowed: empty, spaces, specials (@) ⇒ 400 + 1014. Note: values are NOT character-restricted the way keys are — the charset rules above apply to keys; values are free text up to 1,024 ch. ⚠️ Vendor self-inconsistency: the 1014 Resolution text says "letters, digits, _, ., -" while the normative validation table says Unicode. A rule reading "ASCII" is wrong.

2.4 Write semantics (the hazard is a PAIR)

GET / PUT / DELETE only — no PATCH. PUT replaces the entire tag set ⇒ edit = GET → merge → PUT. DELETE removes ALL tags — no single-tag delete (1015, "Invalid delete payload").

⚠️ The hazard is a PAIR, not one rule. PUT protects the "preserve existing tags" half; DELETE protects the "remove all" half. Single-tag removal is NOT DELETE — it is GET → omit the key → PUT the remaining set. DELETE wipes the ENTIRE tag set (vendor's own example: decommissioning a resource). ⇒ DELETE is human-gated — never routine automation. (Post-R1 fold: 🛡️ M-2 / 🚀 N-4 converged on this as a missing operating rule.)

2.5 500-not-404 (scoped)

GET …/tags?resource_type=…&resource_id=… on a never-tagged / non-existent resource → 500 (not 404). The list endpoints (/tags/resources, /tags/keys, /tags/values/{key}) return 200 + empty array ("expected, not an error"). ⇒ alerts must scope, not treat any 500 as breakage.

2.6 Filter grammar

tag=k (key-only) · tag=k=v · tag=k=a,b (OR, ≤10) · tag=!k · tag=k!=v · multiple tag= = AND (≤20). Separator is = not : (API error text still says : — outdated, code 1007). Discovery: /tags/keys · /tags/values/{key}?type=…. DELETE → 204.

2.7 Taggable inventory = 37 types (scope truth)

Zone-level (11): zone · dns_record · custom_hostname · custom_certificate · managed_client_certificate · load_balancer · healthcheck · worker_route · zone_ruleset · api_gateway_operation · access_application_policy. Account-level (26): account · access_application · access_group · account_ruleset · ai_gateway · alerting_policy · alerting_webhook · cloudflared_tunnel · d1_database · durable_object_namespace · gateway_list · gateway_rule · image · infrastructure_target · kv_namespace · load_balancer_monitor · load_balancer_pool · pages_project · queue · r2_bucket · resource_share · stream_live_input · stream_video · vectorize_index · worker · worker_version.

⇒ "v1 = Zones only" is a deliberate narrowing of 37 — this BP scopes v1 to Zones and says so explicitly (§4).

---

§3 — Auth & enablement (devTEAM must know)

3.1 Credentials = Account Owned Tokens (AOTs), recommended not exclusive — an account or user API token is permitted.

3.2 RBAC — create/update/delete tags requires Super Administrator, Workers Admin, or Tag Admin; token scope #com.cloudflare.api.account.tag.list.

3.3 Per-account enablement — 403 naming feature/gate ⇒ "Tagging is not enabled for this account." ⇒ "all plans" ≠ "already enabled". Pre-flight = GET …/tags/keys.

---

§4 — v1 scope (deliberately narrowed)

• Surface: B only (Resource Tagging).
• Resource types: v1 = Zones (zone type). The full 37-type inventory (§2.7) is stated so v1 is not misread as complete.
• System-of-record account: ⚠️ OPEN — owner to name the account that is the system of record (the screenshot's sidebar label begins Billing+cloudflare@…). This BP does not presume. ⚠️ GATE CONDITION: this BP is unactionable for #devTEAM until the account is named — the owner call must land BEFORE finalize (G5), not merely before the fold (G3).
• Worked example: the noQBO zone set (noqbo.club / noqbo.ai / noqbo.org).

---

§5 — Tag-key convention (v1)

Canonical (settled in v1): key names are pinned — UPPERCASE_SNAKE. Values are NOT canonicalized in v1 — every value form below is ⏳ OPEN (recommended-pending, owner call) and must not be read as settled (see §6 residuals; fixes 🐳 MF-2 / 🚀 G-2).

Key	Meaning	Value form (⏳ = OPEN)
OCA	owning .OCA / project slug	e.g. NOQBO — ⏳ §7.2
PURPOSE	resource role (single concern)	slug — ⏳ §6.2
REGISTRAR	registrar canonical slug	controlled vocabulary — ⏳ §6.3
SEASON	WeOwn season (§7.5)	005 — ⏳ §7.5 snapshot convention
STATUS	product lifecycle (§6.1)	controlled enum — ⏳ §6.1 (NOT an enum yet)
REF	provenance (§7.1)	GTM_2026-W…_NNNN — ⏳ §7.1

Observed-but-uncanonized (do NOT copy as enum): the screenshot's 5 keys (OCA PURPOSE REGISTRAR SEASON STATUS) are a usable spine; their values are not yet controlled (§6). Keys are pinned; values are proposed (not ruled) pending §6.1–6.3 / §7.2. Intake-only candidate keys for the (now-removed) Round 2 (§7.4) are NOT adopted in v1.

---

§6 — Residuals (deferred to owner — Round 2 REMOVED by @GTM 85249486, not resolved here)

6.1 STATUS is not an enum. Screenshot mixes NOT_IN_USE (slug) with LIVE (production) (free text). Grok must-fix #1/2. This BP recommends — does not rule — splitting ENV out of STATUS and defining STATUS as product lifecycle (not zone existence).

6.2 PURPOSE mixes role/product/vendor. Fluent Community Portal vs www (website) vs email (Proton Mail) conflate role, product, and mailhost. Separate role-slug from product/mailhost.

6.3 Pin one REGISTRAR byte form. Porkbun.com vs porkbun; UnstoppableDomains.com vs UD — fork filters. Recommend canonical slugs: PORKBUN, UNSTOPPABLEDOMAINS (mem/domain-registrars #1 = UD). ⚠️ These are RECOMMENDED, not normative — §5's REGISTRAR cell is ⏳ OPEN; this recommendation and §5's "controlled vocabulary" label are not yet reconciled (owner call; 🐳 N-2).

6.4 Surface-A limits must NOT leak onto B. (already handled by §1 fork.)

6.5 REF has no documented home at B. §7.1.

6.6 Filename subject slug. v5.42.7-r1 collides across five concurrent W42 D7 efforts (FLUX.3-Klein · YourStory Ch.3 · this · BURNEDOUT · gm/gn Top5). Always reference as "Cloudflare Tagged Resources v5.42.7-r1".

---

§7 — OPEN questions (owner call — Round 2 REMOVED by @GTM 85249486, not this seat's ruling)

1. Provenance at B: REF:-valued tag (this BP's §5 default), a comment field if one exists, or no REF — owner call.
2. Value enums: controlled vocabulary per key (STATUS, PURPOSE) vs free text.
3. Key-case byte form: UPPERCASE_SNAKE (§5 default) vs case-folded.
4. Additional candidate tags (intake only, NOT adopted in v1): ENV · OWNER · SERVICE/ROLE · IMPACT/CRITICALITY · LOCKED/PROTECTED · BACKUP · MIGRATION/HYBRID · EXPIRES. (🚀 flags DNS_MODE = per-record ⇒ belongs on Surface A, not here.)
5. Snapshot convention: SEASON: 005 → 006 at S005→S006 flip — date-added tag vs replace.
6. A/B store interop (§1) — empirically unverified; scope-or-verify.
7. Product-name fork: vendor = Resource Tagging; UI label = Tagged Resources (Beta) — owner naming ruling.
8. DELETE-all operating rule (§2.4): confirm the cadence/maintenance stance — DELETE (remove-all, decommissioning) is human-gated and never routine automation; single-tag removal is always GET→omit→PUT. This rule was restored at G3 fold (🛡️ M-2; 🐝 G0 v3 LEARN §5 carried five open questions with no DELETE-cadence item, so nothing was silently dropped).
9. Deferred R2 intake (G4 struck by @GTM 85249486): three operating rules the reviewers parked for the now-removed iMAIT-META Round 2 — recorded here, not silently dropped, and not ruled by this seat:
   • Single-writer rule (🛡️-1 ≡ 🚀-1): one writer per change window — PUT-only-new deletes unnamed tags, so two MAITs on one account clobber each other.
   • Account budget (🛡️-2 ≈ 🚀-2): cap 10,000 tags/account is the only count limit; dns_record is one of the 11 zone types — budget before v1 leaves Zones.
   • Value byte-case (🛡️-3 ≡ 🚀-3): values are case-sensitive — if §7.2 pins an enum, pin the byte-case too (prod ≠ PROD).

---

§8 — Worked example (from @GTM screenshot, vision-read by 3 seats)

3 Zones, filter name:noQBO (⚠️ this is the resource-name filter, not a tag — the tag box placeholder in the same shot reads env=prod; 🐳 N-1 / 🚀 N-2), all Zone type:

Zone	OCA	PURPOSE	REGISTRAR	SEASON	STATUS
noqbo.club	noQBO	Fluent Community Portal	Porkbun.com	005	NOT_IN_USE
noqbo.ai	noQBO	www (website)	UnstoppableDomains.com	005	NOT_IN_USE
noqbo.org	noQBO	email (Proton Mail)	UnstoppableDomains.com	005	LIVE (production)

⚠️ Vision read disclosed (§203) — the account's own API is the authority. org LIVE matches mail (MX→Proton), not a website; club/ai NOT_IN_USE matches "no address records," not "zone absent" (🚀 DNS, 5d788bd8). ⚠️ These values VIOLATE §5's own value form (noQBO · Fluent Community Portal · Porkbun.com · LIVE (production) vs §5's UPPERCASE_SLUG-no-spaces) — shown as-observed, do NOT copy as the canonical form (🐳 MF-3 / 🚀 G-3). §5 keeps values OPEN precisely because the live example does not yet conform.

---

§9 — Sources (all tool-verified, attributed)

#	Source	Seat
1	@GTM directive abed455d… + screenshot b80b90c3…png	@GTM
2	🐝 LEARN r2 RESEARCH/CLOUDFLARE_TAGGED_RESOURCES_BESTPRACTICES_LEARN_W42D7_FEDARCHBUZZ.md (88d797ba…)	🐝
3	🐳 vendor verify RESEARCH/CLOUDFLARE_RESOURCE_TAGGING_VENDOR_VERIFY_W42D7_SEAT1.md (d49b957c…, 7 pages HTTP 200)	🐳
4	🚀 R1 pre-review RESEARCH/CLOUDFLARE_TAGGED_RESOURCES_R1_PREVIEW_GROK_W42D7.md (550803ee…)	🚀
5	G0 v3 freeze posts 64e3c4de / d31eccad (v2) / 018133f1 (v3) · ⚠️ attribution caveat: d31eccad is signed by 09f629ac… (MC-BA-IMAIT-META-MIMO) and its p-tag targets the G1 drafter, not the text's author — for that event the content hash is the only valid identity anchor; cite v3 018133f1 as the frozen input (🐳 MF-5)	🐝
6	CCC-ID anchor GTM_2026-W42_7013 (🐳 lane, R-194)	🐳

---

§10 — Drift Gate (BP-497, house rule #128) — baseline for r-next

Metric	r1 (8980065c)	r2 (this fold)
Lines	199	computed at finalize — footer below
Words	1,735	↳
Characters	11,606	↳
SHA256	8980065cf2ec…cbb5	computed at finalize — footer below

r1 baseline is the measured footer of the r1 draft (pasted here per 🐳 MF-1 / 🚀 G-4 — so r2 has a measurable baseline). r2 is additive-only: r2 ≥ r1 measured canonical→canonical (content before the last <!-- CONTENT-HASH-BOUNDARY -->). The 8980065c pin is the review object; r2's pin is generated at fold finalize and recorded in the footer.

---

⛔ R-011 NOT charged (#127) · status DRAFT · G3-FOLD output (Round 1 closed 4/6 · Round 2 struck by @GTM) · system-of-record account = ⚠️ OPEN GATE (must land before release) · no tag created/changed/deleted · nothing pushed · no membership change · no CCC-ID minted from this seat (REFERENCE-ONLY, R-194).

✅ BP-075 CANONICAL HASH GENERATED [MC-BA-CCC-META G3 fold · bp075_hash.py v4.32.7-r1 --embed @ 2026-10-19 21:40 MDT · stage-only, never push · ⛔ R-011 NOT charged · not @GTM:ADMIN — no human stamped | #HITL by @yonks at 21:52 MDT on 19Oct2026]

Content-SHA256: 8726ff69c4752c095e7262dae1c68dea368a1ebfb9778360743da8610fa3c68d FEDARCH-CANARY: 8726ff69 CHARACTERS: 15597 WORDS: 2392 LINES: 210

♾️ WeOwnNet 🌐 [DUNA][.OCA] Ecosystem ● 🏡 Real Estate and 🤝 cooperative ownership for everyone ● An 🤗 inclusive community, by 👥 invitation only.