{"service":"trustfortress-resource-library","updated":"2026-08-01","baseUrl":"https://lib.trustfortress.ai","decision":{"selected":"Custom Cloudflare knowledgebase stack","summary":"R2 is the artifact store, D1 is now the live exact catalog, Workers AI answers source-grounded questions, and Vectorize/Queues/AI Gateway remain planned retrieval upgrades.","rationale":["The library needs exact source locators, archive reassembly instructions, Git/R2 provenance, and stale-object handling; those require a custom catalog instead of only a managed search widget.","D1 is the current machine-readable catalog surface for object keys, sizes, hashes, and source refs; R2 remains the source for bytes.","Vector retrieval, Queues, and AI Gateway should enhance recall, indexing, and auditability without replacing manifest-backed provenance."]},"live":{"worker":"trustfortress-resource-library","domain":"lib.trustfortress.ai","r2Bucket":"trustfortress-resource-library","d1Binding":"CATALOG","d1Database":"trustfortress-library-index","workersAiBinding":"AI","publicCollectionCount":11,"emailGatedCollectionCount":12,"totalCollectionCount":23,"catalog":"D1-backed /api/catalog with R2-listing fallback","sync":"6-hour cron plus protected manual /api/reindex","routes":["GET /api/list","GET /api/catalog","GET /api/search","GET /api/ai-search","POST /api/ask","POST /mcp (Model Context Protocol; JSON-RPC 2.0)","GET /api/claims","POST /api/reindex (requires REINDEX_TOKEN)","GET /api/capabilities","GET /api/openapi.json","GET /objects/<encoded-key>","GET /browse/<encoded-prefix>","GET /health","GET /internal/api/catalog (authenticated 20-collection view)","POST /internal/mcp (authenticated read-only MCP view)"],"protectedAliases":{"authentication":"Cloudflare Access identity or service-token assertion; credentials stay server-side.","cache":"private, no-store","catalog":"/internal/api/catalog","ask":"/internal/library/api/ask","mcp":"/internal/mcp","code":"/api/code/{repo}/{head}/{path}"},"note":"POST /internal/api/ask is the human-only engineering assistant (requireCentillionAuth). Machine Library ask clients must use POST /internal/library/api/ask."},"plannedResources":[{"product":"AI Gateway","name":"trustfortress-library","purpose":"Model logs, caching, rate limiting, feedback, and future provider fallback for answer generation.","status":"wired, opt-in — set AI_GATEWAY_ID to enable caching + analytics + fallback"},{"product":"Vectorize","name":"trustfortress-library-vectors","purpose":"Semantic retrieval over chunk embeddings with metadata filters for repo, collection, date, source type, and evidence family.","status":"planned"},{"product":"Queues","name":"trustfortress-library-index","purpose":"Async indexing and reindex jobs so upload/listing traffic does not wait on extraction or embeddings.","status":"planned"},{"product":"Cron Triggers","name":"trustfortress-resource-library scheduled sync","purpose":"Periodic reconciliation of R2 manifests, Git locators, stale vectors, and source freshness.","status":"live R2-to-D1 refresh"},{"product":"M2MTF MCP server","name":"m2mtf-resource-library (/mcp)","purpose":"Live machine-to-machine TrustFortress MCP endpoint (JSON-RPC 2.0 over HTTP). Public clients can search public material; email-gated IP requires the unified Cloudflare Access identity. See docs/resource-library/MCP.md.","status":"live"},{"product":"AI Search","name":"trustfortress-library-search","purpose":"Managed semantic search (AutoRAG) over R2 — semantic recall via the ai_search MCP tool + GET /api/ai-search. Provisioned with wrangler ai-search.","status":"bound (AI_SEARCH binding); ai_search tool + /api/ai-search active"}],"dataFlow":["GitHub workflow or local agent publishes locator manifest and R2 objects.","The Worker lists R2 prefixes and refreshes D1 through scheduled sync or protected manual reindex.","D1 serves /api/catalog as the exact machine catalog, with R2 listing as a fallback if D1 is unavailable.","Search and ask routes run deterministic collection/manifest lookup first.","Workers AI generates answers from retrieved source excerpts and falls back to ranked search when inference is unavailable.","Vectorize, Queues, and AI Gateway are planned upgrades for semantic recall, async indexing, and answer audit logs."],"developerExperience":{"workbench":"https://lib.trustfortress.ai/#api","openapi":"https://lib.trustfortress.ai/api/openapi.json","capabilities":"https://lib.trustfortress.ai/api/capabilities","examples":[{"name":"Ask with sources (public)","method":"POST","path":"/api/ask","body":{"question":"Where is the Data Center Stakeholder FAQ?","prefix":""}},{"name":"Ask with sources (machine / Access service identity)","method":"POST","path":"/internal/library/api/ask","body":{"question":"Where is the Data Center Stakeholder FAQ?","prefix":""},"note":"Use Cloudflare Access service JWT. Do not call /internal/api/ask from machines; that route is human-only."},{"name":"Search public FAQ","method":"GET","path":"/api/search?q=data%20center%20faq&prefix=cubie-tf%2Fpublic-materials%2F2026-07-05%2F"},{"name":"Machine catalog","method":"GET","path":"/api/catalog"},{"name":"List one collection","method":"GET","path":"/api/list?prefix=cubie-tf%2Fpublic-materials%2F2026-07-05%2F"}]},"references":{"aiGateway":"https://developers.cloudflare.com/ai-gateway/","aiGatewayWorkersAi":"https://developers.cloudflare.com/ai-gateway/usage/providers/workersai/","aiSearch":"https://developers.cloudflare.com/ai-search/","vectorize":"https://developers.cloudflare.com/vectorize/","ragTutorial":"https://developers.cloudflare.com/workers-ai/guides/tutorials/build-a-retrieval-augmented-generation-ai/","queues":"https://developers.cloudflare.com/queues/","cronTriggers":"https://developers.cloudflare.com/workers/configuration/cron-triggers/"},"centralizedCubRegistry":{"authoritativeUi":"https://registry.trustfortress.ai/registry","publicApi":"https://lib.trustfortress.ai/api/cubs","mcpTools":["get_cub","search_cubs","list_cubs","get_registry_meta"],"transport":"Shared authoritative packet-tracer D1 binding; optional registry Worker RPC binding remains configured","dataPolicy":"Public projection includes reproduction paths, hashes, execution anchors, and proof-status notes; internal operational fields remain private."}}