Publish production and Cloudflare execution plan

Turn the accepted customer-owned, provider-neutral direction into evidence-gated production semantics, Cloudflare, FolioMCP, and agent-policy work.

Define the transactional outbox and recipient ledger targets, fault and conformance evidence, commercial data boundary, and disposition of every post-v0.1 draft.

Closes #83

Relates to #81

Signed-off-by: Yusuke Hayashi <yusuke8h@gmail.com>

Author: yhay81

README.md

@@ -1,17 +1,18 @@
 # HayaSend
 
-Resend-compatible, AWS-native email infrastructure that runs in your own AWS
-account.
+Customer-owned safety and reliability infrastructure for transactional email.
+AWS works today; a provider-neutral core and Cloudflare proof are next.
 
 > **Project status: early alpha.** The API and data model will change before
 > v1. Do not use it for critical production traffic yet.
 
-HayaSend provides the developer experience of a modern email API while Amazon
-SES handles delivery. Email metadata and infrastructure stay under your AWS
-account, and HayaSend never logs message bodies.
+HayaSend provides the developer experience of a modern email API while the
+delivery provider and data plane stay in your cloud account. Amazon SES is the
+implemented provider today. HayaSend never logs message bodies.
 
 [Project site](https://haya-inc.github.io/hayasend/) ·
 [Compatibility](docs/compatibility.md) ·
+[Execution plan](docs/execution-plan.md) ·
 [Support](SUPPORT.md)
 
 ## What works today

ROADMAP.md

@@ -1,8 +1,10 @@
 # Roadmap
 
 The roadmap is ordered by user risk, not by feature count.
+The evidence gates, adapter contract, and current draft disposition are in the
+[production semantics and Cloudflare proof](docs/execution-plan.md) plan.
 
-## v0.1 — Transactional foundation
+## Release gate — AWS beta
 
 - [x] Resend-compatible single and batch send endpoints
 - [x] official Resend Node SDK contract test
@@ -15,42 +17,57 @@ The roadmap is ordered by user risk, not by feature count.
 - [x] EventBridge Scheduler for long schedules
 - [x] presigned S3 attachment uploads beyond the API Gateway payload limit
 - [ ] first successful deployment integration run in a dedicated AWS test
-  account (OIDC deploy/test/delete workflow is ready)
+      account (OIDC deploy/test/delete workflow is ready)
 - [x] bootstrap-key storage in Secrets Manager
+- [ ] protected-main merge, exact-main CodeQL, signed release, provenance, and
+      live project site
 
-## v0.2 — Receive and forward
-
-- [x] SES Mail Manager ingress endpoint and traffic policies
-- [x] encrypted S3 raw-message storage with configurable expiry
-- [x] `email.received` webhook and temporary attachment URLs
-- [x] deterministic receipt duplicate suppression
-- [x] explicit received-message forwarding through the official Node SDK
-- [ ] alias routing and catch-all rules
-- [ ] automatic forwarding that rewrites sender headers safely
-- [ ] loop detection and ARC preservation
-
-## v0.3 — Developer workflow
-
-- [x] hardened local container quickstart
-- [x] signed, multi-platform container and SBOM release automation
-- [ ] first signed public release
-- [x] local preview inbox
-- template versions using React Email
-- [x] `hayasend init`, `doctor`, and end-to-end `test`
-- `hayasend deploy` and migration commands
-- OpenTelemetry exports and operational dashboard
-- Python, Go, and direct HTTP contract tests
-
-## v1 — Supported operations
-
-- stable compatibility contract and upgrade policy
-- multi-account and multi-region management
-- SSO, audit exports, and configurable retention
-- backup, restore, disaster-recovery, and load-test evidence
-- published community and commercial support levels
-
-## Later
-
-Contacts, broadcasts, journeys, and marketing automation are intentionally
-deferred. They require consent, unsubscribe, suppression, abuse, and regional
-compliance controls that should not be rushed.
+No post-v0.1 draft merges into the frozen release candidate.
+
+## Now — Production semantics
+
+- versioned provider capability and compatibility contract
+- transactional outbox with automatic reconciliation
+- immutable recipient, attempt, and provider-event ledger
+- deterministic aggregates under duplicate and out-of-order events
+- permanent/retryable provider failure classification
+- fault-injection and per-adapter conformance reports
+- safe deploy, doctor, upgrade, rollback, and recovery evidence
+- scoped credentials, cost/rate controls, and content-private operations
+
+## Next — Cloudflare and FolioMCP proof
+
+- Workers runtime using the same public API
+- D1 metadata/outbox, R2 payloads, and Queues/DLQ
+- Cloudflare Email Sending transport and recipient event normalization
+- capability-aware 50-recipient and 5 MiB validation
+- plan-first deploy, doctor, upgrade, rollback, and cost evidence
+- identical shared conformance and fault-injection suite
+- provider switch without application-code changes
+- controlled non-critical FolioMCP dogfood
+
+Cloudflare Email Sending is currently Beta. HayaSend will keep that status
+visible until both Cloudflare's service status and HayaSend's evidence justify
+changing it.
+
+## Then — Agent-safe policy
+
+- actor, application, agent, and intent identity
+- draft, send, and external-send permission separation
+- recipient/domain allowlists and deny rules
+- hourly/daily send and cost budgets
+- approval gates for sensitive, external, attachment, and high-volume sends
+- sandbox sink, preview, kill switch, and immutable audit
+- MCP only as an interface over enforced policy
+
+## Parked until the proof is complete
+
+- inbound alias routing, automatic forwarding, and ARC preservation
+- more language SDK gates beyond the shared provider conformance work
+- visual template-product expansion
+- contacts, broadcasts, journeys, and marketing automation
+- managed multi-tenant content data plane
+- SMS, push, chat, or a general notification workflow builder
+
+The existing AWS receiving implementation remains supported, but it does not
+set the order of new work.

SUPPORT.md

@@ -22,8 +22,9 @@ delivery:
 - fixed-scope architecture, deployment, and migration engagements;
 - Resend or legacy SES forwarder migration;
 - DNS, SPF, DKIM, DMARC, bounce, and complaint readiness reviews;
-- security hardening and AWS account reviews;
+- security hardening and AWS or Cloudflare account reviews;
 - upgrades, monitoring, incident response, and response-time commitments;
+- provider migration, conformance review, and failure drills;
 - multi-account, regulated-environment, and private-roadmap work.
 
 Commercial terms cover services and warranties, not access to the

docs/commercial.md

@@ -5,8 +5,9 @@
 The self-hosted transactional path remains Apache-2.0:
 
 - API and SDK compatibility;
-- AWS deployment templates;
-- SES transport and event normalization;
+- customer-owned AWS and Cloudflare deployment targets;
+- open provider capability contracts, adapters, and conformance tests;
+- provider transport and recipient-event normalization;
 - queues, retries, idempotency, and webhooks;
 - hosted templates, React Email interoperability, template-as-code
   reconciliation, safe version publishing, and bounded restore-to-draft
@@ -30,14 +31,28 @@ source restrictions:
 - monitoring, incident response, backups, and upgrades;
 - template migration, review workflows, and retention-policy design;
 - multi-account fleet management;
+- provider migration, conformance certification, and failure drills;
 - compliance evidence and support commitments;
 - a future hosted control plane that never needs to inspect message content.
 
+## Management-plane data boundary
+
+An optional Haya service may receive deployment identity, software and adapter
+version, capability digest, health, counts, durations, aggregate cost, and
+opaque incident references. By default it must not receive sender or recipient
+addresses, subjects, bodies, attachments, provider credentials, raw provider
+events, or signed URLs.
+
+Deploy, doctor, upgrade, rollback, recovery, provider adapters, conformance,
+and security fixes remain part of the open data plane. Paid value comes from
+operating fleets and accepting support accountability, not from withholding a
+safe standalone product.
+
 ## Product principles
 
 1. Do not put a critical security fix behind a paid plan.
 2. Do not create an unusable “community edition”.
-3. Keep customer email data in the customer's AWS account by default.
+3. Keep customer email data in the customer's cloud account by default.
 4. Publish compatibility and support limits precisely.
 5. Price accountability, convenience, and operational expertise.