Govern Every AI Change Before Production.

These are deployable Cloudflare Ruleset Engine definitions for the intended API contract. Keep them disabled until the origin publishes the named routes, validates bearer credentials at the application layer, and returns non-cacheable responses.

(http.host eq "api.codecr.org" and
 starts_with(http.request.uri.path, "/v1/telemetry/") and
 (
  not (http.request.method in {"POST" "OPTIONS"}) or
  http.request.headers.truncated or
  (
   http.request.method eq "POST" and
   (
    http.request.body.size eq 0 or
    http.request.body.size gt 1048576 or
    not any(http.request.headers["content-type"][*] contains "application/json") or
    not any(starts_with(http.request.headers["authorization"][*], "Bearer "))
   )
  )
 ))

Expression:
(http.host eq "api.codecr.org" and
 http.request.method eq "POST" and
 http.request.uri.path in {
  "/v1/pilots/vpc-sandbox/provision"
  "/v1/pilots/microvm-test-cluster/deploy"
 })

Rate limit:
{
  "characteristics": ["cf.colo.id", "ip.src"],
  "period": 600,
  "requests_per_period": 3,
  "mitigation_timeout": 3600,
  "requests_to_origin": true
}

Control boundary: a WAF can validate request shape and frequency; it cannot prove bearer-token authenticity or provisioning authorization. Those decisions remain mandatory at the API origin.

The website may prepare a local pilot manifest without email. The two-message sequence activates only after an optional, unbundled consent request is confirmed through a signed single-use link; provider credentials and consent records remain server-side.

POST /v1/pilots/email-consent
Idempotency-Key: consent_<preflight_id>_2026-09-05.v4

{
  "schema_version": "1.0",
  "event": "pilot.email_consent.requested",
  "preflight_id": "pilot_01J...",
  "recipient": {
    "email": "vp.engineering@example.com",
    "locale": "en-DE"
  },
  "consent": {
    "purpose": "vpc_sandbox_two_message_onboarding",
    "notice_version": "2026-09-05.v4",
    "affirmative_action": true,
    "double_opt_in": true,
    "captured_at": "2026-09-05T18:00:00Z",
    "source_url": "https://codecr.org/#evaluation"
  },
  "pilot": {
    "deployment_topology": "VPC Peering",
    "identity_provider": "Okta",
    "repository_scope": "3–10 non-production repositories",
    "policy_assignment": "P0 security baseline"
  }
}

{
  "message_key": "pilot_<id>_email_1",
  "provider": "resend",
  "to": [{"email": "verified@example.com"}],
  "from": {
    "email": "onboarding@codecr.org",
    "name": "codecr Enterprise Operations"
  },
  "template": "vpc-boundary-confirmation",
  "template_version": "2026-09-05.v1",
  "variables": {
    "preflight_id": "pilot_01J...",
    "deployment_topology": "VPC Peering",
    "preference_url": "https://codecr.org/email/preferences/<token>"
  },
  "headers": {
    "List-Unsubscribe": "<https://codecr.org/email/unsubscribe/<token>>",
    "List-Unsubscribe-Post": "List-Unsubscribe=One-Click"
  },
  "metadata": {
    "preflight_ref": "pilot_01J...",
    "consent_ref": "consent_01J..."
  }
}

{
  "schema_version": "1.0",
  "provider": "resend",
  "provider_event_id": "evt_opaque",
  "provider_message_id": "msg_opaque",
  "event": "delivered | bounced | complained | unsubscribed",
  "occurred_at": "2026-09-05T18:05:00Z",
  "recipient_ref": "recipient_opaque",
  "preflight_id": "pilot_01J...",
  "signature_verified": true
}

Legal boundary: this control design supports consent evidence, withdrawal, identification, and suppression; it is not a substitute for counsel’s review of codecr’s role, lawful basis, notices, retention, jurisdictions, or whether a message is transactional or commercial.

Bind Cloudflare HTTP analytics, Security Events, DNS and certificate state, plus distributed synthetic probes to a single release-tagged dashboard. Every alert must include hostname, path class, colo, release commit, rule ID, request count, and a link to the rollback record.