Reference architecture overview

Status

Current

Reviewed

October 1, 2026

Cadence

Review each quarter

This site is the operating source of truth for MNPPI policy. Coding agents and humans default to these published standards before inventing toolchain, mail, deploy, or bootstrap behavior.

The Git home is the private org-standards repository. This site is the published form of those standards. It covers stack defaults, merge and deploy rules, operations, and governance.

If you are starting a Worker project, read this map before you pick a framework or wire CI. Vite-ready Workers with a Worker entry use the cf CLI and cloudflare.config.ts standard. Assets-only Astro stays on labeled transitional Wrangler.

Public scope

This site publishes reusable decisions and controls. It does not publish secret locations, host inventories, live incidents, or private exception records.

For agents

This site is the operating source of truth. Default to these standards before inventing. Prefer Markdown. Start at /llms.txt, use each page’s /index.md, or load /llms-full.txt. This static site does not negotiate Accept: text/markdown on HTML URLs. For repository bootstrap, follow Coding agents and Cloud Agent bootstrap. Repos that send transactional, ops, or notify HTML email must use @mnppi/email-layout and BRAND_PRESETS. CID-embed logos by default; remote logoUrl is fallback only. Cloudflare Email Sending only.

Sections

ArchitectureProfiles, stack defaults, and platform adoption.

Deliverycf CLI for Worker-entry apps. GitHub merges. Cloudflare deploys.

OperationsRunner isolation, metrics with owners, recovery.

GovernanceReviews, exceptions, and rule retirement.

Default delivery path

Stage	System	Required result
Pull request	GitHub Actions	Repository checks pass on the designated runner.
Merge	GitHub rulesets	Failed or missing required checks block the merge.
Production build	Cloudflare Workers Builds	Cloudflare builds the merged default branch.
Production deploy	Cloudflare	Cloudflare deploys only after its build passes.

Open a PR. Enable squash auto-merge. CI runs. GitHub merges when required checks pass. Workers Builds ships the commit.

No default branch requires a second approver. GitHub squash auto-merge proceeds when required checks pass.

How to use this reference

1. Follow the adoption checklist.
2. Select an application profile.
3. Apply the delivery and operations rules for that profile.

If a project cannot follow a required control, use the exception process.