Align cfctl verification with maildesk-cf preflight and drift states

[rogu3bear]

Context

maildesk-cf now has split preflight modes:

• bun run preflight:template: no secrets, public checkout health
• bun run preflight:production: private instance readiness before Cloudflare mutation

The template also defines readiness terms in docs/architecture/template-standard.md:

• template-ready
• instance-ready
• edge-ready
• mail-ready

Needed Change

Add cfctl verification output that maps cleanly onto those readiness states instead of returning one generic success/failure blob.

Drift Classes To Report

• missing resource
• wrong binding
• DNS/authentication drift
• Email Routing alias drift
• sender-domain drift
• policy/config drift
• optional live-send proof not requested

Acceptance Criteria

• cfctl maildesk-cf verify can distinguish edge readiness from mail readiness.
• Verification avoids broad live sends unless explicitly requested.
• Verification output is machine-readable enough for maildesk-cf docs/scripts to cite.
• Failure states give agents a concrete next action without exposing secret values.
• The implementation can consume the same desired-state/policy shape described in maildesk-cf docs.

References

• rogu3bear/maildesk-cf:docs/operations/preflight.md
• rogu3bear/maildesk-cf:docs/architecture/template-standard.md
• rogu3bear/maildesk-cf:docs/architecture/runtime-contract.md

[rogu3bear]

Additional readback evidence from trying to inventory the star-maildesk-cf primitive resources through cfctl wrangler:

• cfctl wrangler d1 list --json previews correctly but execution fails on the dev lane with Cloudflare API authentication error for /d1/database; likely missing token permission for this read.
• cfctl wrangler r2 bucket list --json fails because Wrangler reports Unknown argument: json for that command.
• cfctl wrangler queues list --json fails because Wrangler reports Unknown argument: json for that command.

Implication for maildesk-cf verify: cfctl should not depend on Wrangler JSON output for all primitive resource classes. It likely needs native/API-backed read paths or command-specific parsers for R2/Queue, plus an explicit permission check for D1 inventory.

Relevant local artifact examples were written under var/inventory/runtime/wrangler-wrangler-* during the readback attempt.

[rogu3bear]

More inventory evidence after switching readbacks to CF_TOKEN_LANE=global:

• cfctl list d1.database succeeds on global and shows 17 D1 databases; star-maildesk-cf-db is not present.
• cfctl list r2.bucket succeeds on global and shows 15 buckets; star-maildesk-cf-raw-mail is not present.
• cfctl list queue succeeds on global and shows 2 queues; star-maildesk-cf-jobs is not present.
• cfctl list worker.script succeeds on global and shows existing Workers; star-maildesk-cf and star-maildesk-cf-router are not present.

This confirms the private maildesk instance is still below edge-ready: local template/private config exists, but the Cloudflare resources have not been provisioned. The first-class cfctl maildesk-cf surface should be able to turn the desired-state file into those resources, then verify the same absence/presence drift classes.

[rogu3bear]

New evidence from maildesk-cf provisioning:\n\n- Created and verified D1/R2/Queue resources under the global lane.\n- Applied D1 schema through cfctl-wrapped Wrangler plan/ack. Wrangler reported 10 queries executed and 8 tables created on both star-maildesk-cf-db and star-maildesk-cf-preview-db.\n- Direct SQL verification via d1 execute SELECT name FROM sqlite_master confirms tables exist.\n- cfctl get d1.database still reported num_tables: 0 immediately after migration, so D1 inventory should not rely on that field as schema proof. Add a deeper verification path for table existence/migration state.\n- Wrangler deploy initially bound DB to preview_database_id when preview_database_id was present in top-level wrangler.toml output. The template has been changed to keep production Worker configs production-only. cfctl verification should detect accidental preview bindings before deploy.\n\nRelevant maildesk-cf commits: 138be83 in public template, eae7237 in private instance.

[rogu3bear]

Template alignment update from maildesk-cf commit 229b04f:

• docs/operations/production-rollout.md sharpens the readiness ladder.
• docs/operations/deliverability.md says verification should prefer config/provider readbacks and only use targeted live sends when needed.
• docs/architecture/outbound-identity.md adds outbound sender identity as a first-class proof dimension.

So maildesk-cf verify should report sender identity readiness separately from inbound Email Routing and Worker/storage readiness. The dedicated outbound verification follow-up is #17.

[rogu3bear]

Template update from maildesk-cf commit 29a28f4:

Production preflight now requires MAILDESK_API_TOKEN and validates outbound mode configuration:

• MAILDESK_OUTBOUND_MODE=disabled is allowed for inbound/authorization-only proof.
• MAILDESK_OUTBOUND_MODE=cloudflare_email_service requires sender-domain allowlist plus a Worker send_email binding named EMAIL.
• MAILDESK_OUTBOUND_MODE=resend requires sender-domain allowlist plus RESEND_API_KEY as a Worker secret.

So cfctl maildesk-cf verify should surface these as separate readiness dimensions: API auth, policy/binding state, inbound Email Routing, sender-provider readiness, and optional targeted live-send proof. A generic green check would hide too much here.

[rogu3bear]

Additional verification evidence from the horizontal receipt work in maildesk-cf commits 3b9b300 and 9aa1e3b:

• bun run verify:maildesk now separates edge_ready from mail_ready.
• edge_ready checks zone readback, Email Routing aliases, R2 policy hash, Worker bindings, and D1/Queue reachability.
• mail_ready additionally requires policy-checked inbound proof and sender-domain readiness.
• Inbound proof is no longer a bare boolean. The evidence now has to include the routed mailbox, route kind, forwarded operator recipients, default reply identity, raw R2 key, audit timestamp, and absence of forward errors.

Live private readback showed why cfctl needs a deeper D1/audit verifier:

• /readyz returned healthy for db_binding, raw_mail_binding, mail_jobs_binding, policy_config, outbound_sender, and db_query.
• cfctl get d1.database --name star-maildesk-cf-db reported num_tables: 0.
• A cfctl-wrapped wrangler d1 execute ... SELECT name, type FROM sqlite_master showed the expected tables do exist, including audit_events, messages, threads, alias_routes, identities, and operators.
• A cfctl-wrapped audit query showed 13 inbound_email_received events and one complete outbound reply audit chain: outbound_reply_requested, outbound_reply_authorized, outbound_reply_send_attempted, and outbound_reply_delivered.

Current private receipt state after adding strict inbound proof details:

• local_truth_ok: true
• edge_ready: true
• mail_ready: false
• proven inbound domains from audit: jkca.me, theauchshop.com
• remaining mail-ready gaps: missing inbound proof for the other held domains, plus mlexplorer.org sender-domain drift because Resend still reports it pending even though Cloudflare authoritative DNS answers for DKIM/SPF are present.

Implication for cfctl maildesk-cf verify: D1 verification needs schema/table readback and audit-event classification, not just database existence or /readyz binding health. It should emit the same distinction as the app receipt: edge-ready can be green while mail-ready remains red until inbound/audit and sender-domain proof are present.

[rogu3bear]

review and determine what's the smartest way ti provide @codex