Developer Platform Wave — Completion Summary (d1–d7)

Reading guide

A Wave 3 delivery report for MCP, CLI, SDK, docs, examples, and CI—not a public release announcement.

The report separates executed local evidence from registry publication, staging, and real-user validation that remain open.

Status: IMPLEMENTED + VERIFIED_WITHIN_SCOPE — every claim below cites executed evidence from this wave; the residual register (§4) is intentionally long because honest NOT_VERIFIED items are part of the deliverable, not an embarrassment to hide.

Base: merge 9e390d8 (d7 task worktree), integrating all seven wave tasks. Companion docs: developer-platform-gap.md (phase-0 baseline), version-policy.md, release-artifacts.md, interface-contract-matrix.md, known-limitations.md, ci-coverage.md, CHANGELOG.md.

1. Integrated tasks

task	scope	land state
d1 contract-stabilization	naming policy, createWorkerConfig() Worker presets (web+server), contract matrix, stale-doc sweep	merged (53e5d8c + 040a67f + 1238720/1b22603/01ec539d chain)
d2 cli-platform	@yetdapay/cli auth/project/license/integration commands, credential store, vendored npm pack	merged (b9d9114)
d3 mcp-remote	be-cloudflare integration-surface port + migration 018, 10 gateway read tools, mcp CI job, tests	merged (da8c90e)
d4 mcp-local	@yetdapay/mcp stdio server (CLI-verdict parity) + 3 agent skills	merged (5765427 via 4183a41)
d5 docs-site	VitePress site under docs/ (~55 pages, nav+sidebar, pnpm build)	merged (2e5501a via bb3ea35)
d5b proto-drift-fix	donation donor_name/message → optional + server default (both backends + proto)	merged (d5f70a3 via d7c92f1)
d6 examples-e2e	4 runnable scenarios + run-all.sh harness, lockfiles, fixtures	merged (1eacd4f via 043ca86)
d7 release-candidate	version policy, CHANGELOG, pack artifacts, consolidated CI, README, this doc	this commit

2. Deliverables per interface

MCP

• Local protect MCP — tools/devpay-mcp/ (@yetdapay/mcp 0.1.0): stdio JSON-RPC → yp --json, verdicts verbatim, workspace containment, no-shell spawns, plan-sha approval binding. Tarball: 3 files after d7 files fix.
• Local Rust MCP — mcp/ (yetdapay-mcp 0.1.0): 10 yetdapay_* tools, pure HTTP adapter to Axum be/, exec-free by design.
• Remote gateway — mcp/gateway/worker.js (yetdapay-mcp-gateway 0.1.0): 20 tools = 10 configure/validate + 10 seller-scope/public reads added in d3; Bearer passthrough; streamable HTTP, no SSE.
• Skills — skills/yetdapay-{protect,license,verify} added in d4 (yetdapay-install predates the wave → 4 total).

CLI (@yetdapay/cli 0.2.0)

• Protect workflow (init/doctor/plan/review/apply/verify) unchanged in behavior; platform commands added in d2: auth login/status, project list/inspect, license status/verify, integration check (both backends since d3).
• Packaging: npm pack → 72-file tarball with vendored toolkit + license-server; install-by-tarball path designed, private-by-design.

SDK

• @yetdapay/license-web / -server / -nuxt 0.1.0 — pack-verified (11/17/9 files), file:-installable today, Worker pairing via createWorkerConfig() (d1).
• @yetdapay/sdk 0.1.0 — copy-in source bundle (core.ts + Vue/React buttons); be-cloudflare endpoints exist since d3.

Docs

• VitePress site rooted at docs/ (~55 pages: getting-started, licensing, protection, payments, sdk, cli, mcp, api, examples, operations). pnpm build green (see §3).
• Product docs updated: version-policy.md, release-artifacts.md, developer-platform-completion.md (this file), CHANGELOG.md, root README.md.

Examples (examples/run-all.sh)

• A cli-protect — init→doctor→plan→review→apply→verify on a temp copy; asserts APPLIED + EQUIVALENT + evidence record. Node-only.
• B agent-mcp — MCP stdio driver exercising protect tools. Node-only.
• C license-server — @yetdapay/license-server + license-web client flow on file: installs. Node-only.
• D donation-site — seeded Axum be/ + real sdk/core.ts calls
  • nuxt3-site SSR of hosted /h/<public_id> links. Needs cargo build + npm install (network).

3. Test totals (executed evidence)

suite	result	where it runs
sdk/license/{web,server,nuxt} unit	96 pass (30/51/15) — re-run on this worktree	node --test per package
tools/devpay-mcp protocol+CLI tests	6/6 pass — re-run on this worktree	node --test (CI: yp-mcp job)
tools/yp e2e	6 cases	node --test (CI: product-suites)
mcp/ Rust server	14 #[test] cases	cargo test (CI: mcp job)
mcp/gateway tests	10 node --test cases (mock upstream)	CI: mcp job
be-cloudflare integration suite	48 checks post-d5b (d3 evidence was 47; 44 check( sites + loops)	tests/run-integration.sh + wrangler dev
durable authority E2E	55 assertions (PAY/LIC/USE/REC/INBOX/OUTBOX)	tests/run-durable.sh (CI: product-suites)
SDK↔Worker contract	10 checks	sdk-worker-contract.test.mjs via e2e-worker.sh (CI: product-suites, d7)
auto-protection suites	8 suites incl. analyzer 61/61	*/tests/run.mjs (CI: product-suites)
auto-protection red-team artifacts	13 checks	CI: security-regression
docs build	exit 0 on this worktree	pnpm build in docs/ (CI: docs-site job, d7)
examples smoke	A–C Node-only legs in CI; D kept with honest timeout note	examples/run-all.sh (CI: examples job, d7)

4. Remaining NOT_VERIFIED / BLOCKED register

item	label	why
Gateway SSE / streaming transport	NOT_IMPLEMENTED	gateway serves POST/JSON streamable HTTP only; no SSE endpoint exists
React license SDK adapter (@yetdapay/license-react or equivalent)	NOT_IMPLEMENTED	sdk/react/ holds commerce buttons only; no license adapter for React/Next
Hosted execution	DESIGNED	requirements doc only (hosted-execution-requirements.md); no runtime
Wire contract v2	DESIGNED/deferred	aud/tenant_id claims, error-code convergence — recorded in matrix §5; no negotiation mechanism exists today (v1 is implicit)
Real PG payment	NOT_CONNECTED (charter)	sandbox donations only; no real capture — never claim otherwise
Email delivery	NOT_IMPLEMENTED (charter)	mock adapter only; no provider integrated
Deploy secrets / production deploy	BLOCKED (charter-gated)	no wrangler deploy/secrets work without explicit user authorization
Deployed-backend round-trips (@yetdapay/sdk, gateway seller reads)	NOT_VERIFIED	all executed evidence is loopback wrangler dev / seeded sqlite
npm publish / install-from-registry	NOT_VERIFIED	packages unpublished by design; file:/tgz pattern documented instead
Installed-binary smoke of yp tarball on clean machine	NOT_VERIFIED	pack contents verified; install+run not executed this wave
Seller-ops spec on Axum CI	NOT_VERIFIED (in CI)	spec self-skips on be/ (durable APIs absent) — executed only against wrangler dev locally
Multi-instance D1 contention at scale	NOT_VERIFIED	2-instance dedup held exactly-1; loser surfaced 500 not clean 409 (F-04)

5. Release recommendation

Technical readiness for a pre-1.0 developer-platform drop (packs + docs + examples + CI consolidated): YES, with the §4 register attached to any release note. Nothing in this wave authorizes publishing to a registry, deploying, or claiming real payments/email — those remain PM/user-gated per the charter.