The harness, in its own words.

Start

What the harness is, and the path from an empty directory to a venture in production.

• Quickstart Install the CLI, scaffold a venture with one module, run it locally and hit it with curl. Every command verified in a real run on 2026-10-18. docs-local/QUICKSTART.md
• Architecture What the harness is and the principles behind it: the crate map, the module contract, the ports, migrations, deployment and the security rules. docs/ARCHITECTURE.md
• Venture guide The ordered path from fz init to a production API on your own domain, with every step that needs a human called out. docs/VENTURE-GUIDE.md
• Module authoring Build a complete module from an empty directory to green CI: the trait, a migration, routes, config, events, conformance and a surface. docs/MODULE-AUTHORING.md
• Compile in, or sidecar Why a module is compiled into the venture's Worker almost always, and what running it as a sidecar costs when the source must stay with its owner. docs/MOUNTING.md
• Declared tables Declare tables in the manifest and get migrations, CRUD routes and a published contract without writing a module crate. docs/TABLES.md

Operate

Releasing, recovering, rotating keys, and moving data and tenants.

• Releasing How the cratefield-* crates reach crates.io: the release pipeline, the one-time owner setup, the prerelease flow and what still runs by hand. docs/RELEASING.md
• Rollback and recovery Migrations are forward-only, so this is the written answer to every undo: a failed migration, a wrong one, a whole tenant, the code. docs/ROLLBACK.md
• Key rotation The runbook for rotating a data key versus re-wrapping after a master-key rotation, with rollback, cadence and the token signing ring. docs/KEY-ROTATION.md
• Secrets design Envelope encryption for secrets: the key hierarchy, cipher and nonce policy, context binding, operations and the threat model. docs/SECRETS-DESIGN.md
• Portability The move off Cloudflare onto the native runtime and Postgres: what is built for a single venture today, and what the multi-tenant layer still lacks. docs/PORTABILITY.md
• Moving data to Postgres The rehearsal runbook for fz data export and fz data import, from standing up the target to the cutover. docs/DATA-MOVE.md
• Promoting off D1 The written path for a venture nearing the 10 GB D1 cap: when to promote, the move, cutover and rollback. No promotion has been run yet. docs/TENANT-PROMOTION.md
• Tenant onboarding Adding and removing a tenant on the native runtime, each path ending in a state, or an absence, you can verify. docs/TENANT-ONBOARDING.md
• Tenant routing How one database per tenant becomes something a request cannot get around: tenant identity, resolution, the pool registry and TenantConn. docs/TENANT-ROUTING.md
• Tenant extensions Where a venture's own schema lives when the shared modules do not provide it, and what an extension may and may not do. docs/TENANT-EXTENSIONS.md
• Boot-time reconciliation The order, locking, atomicity and failure behaviour of bringing every tenant database up to date on each boot of the native runtime. docs/RECONCILIATION.md
• Two migration streams What measurably happens when a sidecar module and its host apply migrations from two repositories to one D1 database. docs/MIGRATION-STREAMS.md
• Upgrading Every source-breaking change in cratefield-core since 0.5.0, one section per minor, so what the compiler will say is known before the requirement moves. docs/UPGRADING.md
• Deploying auth One branded auth instance per app and never a shared service: what an instance is, and what standing one up involves. docs/auth/DEPLOYING.md
• Running an auth instance The runbook for adding one, self-hosted or managed: its domain, D1, secrets, passkey relying party, sender and branding. docs/auth/MANAGED-INSTANCES.md
• Meta app review The runbook for Meta app review under the per-instance model, where every auth instance is its own Meta app. docs/auth/META-APP-REVIEW.md
• Migrating a userbase Moving existing users into auth-core without making them reset: an export, a dry run, a report you keep, and the key that keeps a legacy verifier working. docs/auth/MIGRATING.md
• Importing Supabase, step 1 fz import supabase inspect reads a project read-only and writes the migration report, classifying every object automatic, needs work, or a blocker. docs/import/supabase.md

Modules and features

The ports and modules a venture composes, one document each.

• Payments The Payments port and its Stripe adapter: hosted checkout so card data never reaches the harness, the money flows and webhooks. docs/PAYMENTS.md
• Notifications One notify() call fanned out to push, an in-app inbox and email under per-category preferences, with wiring and client guides. docs/NOTIFICATIONS.md
• Push environment Every environment variable the push adapters read, for APNs, FCM and Web Push. Generated from the code. docs/PUSH-ENV.md
• Live push proofs The runbook for the push transports CI cannot prove, because they need a vendor account, a physical phone or a real browser: the setup, the exact command, and the output that counts as evidence. docs/PUSH-LIVE-PROOFS.md
• Realtime The Realtime port: rooms of WebSocket clients, where the port owns the sockets and the module owns the protocol. docs/REALTIME.md
• MCP server fz-mcp, a Model Context Protocol server over fz --json, so an agent drives the venture CLI with no second surface to drift. docs/MCP.md
• UI surface The markup contract a module's declared surface renders to: field rendering, styling, UiSpec, admin pages and the cf.js embed. docs/UI.md
• Account dashboard The cratefield-dashboard module: what it shows about each venture, what it deliberately leaves out, and the half that is not built. docs/DASHBOARD.md
• Classifier The Classifier port: typed, calibrated answers to "which of these is it", with the adapter behind it chosen by the venture. docs/CLASSIFIER.md
• Classifier routing Measure agreement first, then route to a cheap classifier only the questions it answers the same way as the expensive one. docs/CLASSIFIER-ROUTING.md
• Telemetry Consent-first, aggregate usage counts from clients, validated against a closed grammar and kept in the venture's own database. docs/TELEMETRY.md
• The login service One branded auth instance per app, on the app's own domain: six ways in — passkeys, Google, Apple, Meta, password, magic link — all resolving to the same session, run self-hosted or managed. docs/auth/README.md
• Auth service The login service built on the harness: six login methods resolving to one session, how it fits, and what was validated first. docs/auth/ARCHITECTURE.md
• Actors The Actors port: calls for one (kind, key) run one at a time and its writes apply all-or-nothing, with an alarm when one stops making progress. docs/ACTORS.md
• Custom hostnames A venture serves its customers on their own hostname, and the module that owns the domain never learns the request left through a vendor. docs/CUSTOM-HOSTNAMES.md
• Device authorization The OAuth 2.0 device grant for a client with no browser and no keyboard: a CLI, a TV, a terminal over SSH. docs/DEVICE-AUTH.md
• TextModel The TextModel port answers prose; its sibling answers a value, conforming to a schema or erroring, never half-parsed. docs/TEXT-MODEL.md
• Usage metering A durable allowance counter answered race-free from the database, in the same statement that spends it. docs/USAGE-METERING.md
• Passkey PRF The WebAuthn prf extension as a user-held key for sealed data: the bytes never leave the client, and the server keeps a salt and a flag. docs/auth/PASSKEYS-PRF.md
• Enterprise SSO One organization’s own OpenID Connect provider, and the email domains that route a sign-in to it. docs/auth/SSO.md
• @cratefield/auth The framework-neutral TypeScript client for an auth-core issuer: Web-standard APIs only, on Workers-style runtimes and Node 20+. docs/auth/WEB-APPS.md

Security and compliance

What is protected, what is stored, and what is and is not claimed.

• Security policy Assets and entry points, the controls that ship, the dependency policy, and how to report a vulnerability. docs/SECURITY.md
• Privacy What the harness stores, where and for how long: the data map, signed links, subject access and erasure. docs/PRIVACY.md
• Card data Card details go straight to Stripe and never reach a Worker, a database or a log, and the two guardrails that keep it that way. docs/CARD-DATA.md
• SOC 2 mapping Each Trust Services Criteria point the repository addresses, the mechanism and the evidence path, with gaps marked as gaps. Not an attestation. docs/SOC2-MAPPING.md

Reference

Generated tables, the numbers, and every recorded decision.

• Error taxonomy Every problem slug the harness can emit, as RFC 9457 problem documents. Generated from the code and checked for drift. docs/ERRORS.md
• Compatibility The HARNESS_API contract version and the core range each module and adapter supports. Generated from the manifests. docs/COMPATIBILITY.md
• Benchmarks The published numbers, the rules they follow, and what has not been measured, with the same prominence. docs/BENCHMARKS.md
• Performance programme The gate a performance change has to pass, a published number showing the cost it removes, and the four steps in order. docs/PERFORMANCE.md
• Artifact cache The build key that addresses a compiled artifact by its module set, what it excludes, and why sharing one artifact is safe. docs/ARTIFACT-CACHE.md
• Build cost What compiling a venture measurably costs, cold and warm: one more module on a warm build is about five seconds, and the time goes to post-processing, not cargo. docs/BUILD-COST.md
• Supabase migration report The JSON document fz import supabase inspect --json writes and the later importer steps read. The Rust types are the definition. docs/import/supabase-report.md
• Supabase report, worked example A real migration report from a fixture project: the schema above, with every field filled in. docs/import/supabase-report.sample.md
• Decision records Every architecture decision, numbered and never edited after acceptance, and how each one amends or supersedes another. docs/adr/README.md

38 decision records, listed in full →

The mirror

Diagrams are rendered to SVG when the pages are built, so a page fetches nothing to draw them.