Record reviewed provider contract drift

[zackbart]

Summary

Record the 18 provider contract changes reviewed during the 0.20.0 release drift check:

• Cloudflare R2 adds the us jurisdiction across eight endpoints.
• Cloudflare KV adds namespace jurisdiction across four endpoints.
• Cloudflare Worker responses add observability and VPC identity fields.
• Cloudflare ruleset reads add origin-range metadata.
• Cloudflare per-zone settings change defaults and omit two WebMCP variants from OpenAPI while the rendered reference still lists them.
• Notion data-source queries add verification.does_not_equal.

The product gaps and provider ambiguity remain durable in #498, #499, #500, #501, #502, #503, and #504. This PR records the reviewed contracts only. It does not claim those follow-ups are implemented or close their issues.

Release verdict

Independent review found every change additive, passthrough-compatible, or limited to a new optional named-tool value with a raw API fallback. No existing request narrowed, no result path broke, and no safety classification changed. None blocks 0.20.0.

Verification

• npm run drift:check -- --specs --spec cloudflare=https://raw.githubusercontent.com/cloudflare/api-schemas/31bec32e87cde4854773d2a5edb405f00eb7a468/openapi.json --spec notion=https://developers.notion.com/openapi.json
  • Cloudflare: no drift across 49 touched endpoints
  • Notion: no drift across 14 touched endpoints
• Diff contains exactly 18 digest replacements and no other changes.

[zackbart]

APPROVE

Independent audit of commit 843e676 found no blocking issues.

• The diff contains exactly 18 contract digest replacements and no other file changes.
• An independent canonicalization and SHA-256 computation against Cloudflare OpenAPI snapshot 31bec32 reproduced the recorded ruleset GET and zone-setting GET/PATCH hashes exactly.
• The same independent computation against Notion's current official OpenAPI reproduced the data-source query hash exactly.
• Both the pinned-source drift run named in this PR and a fresh live-source drift run report zero findings across Cloudflare's 49 and Notion's 14 touched endpoints. Cloudflare main still resolves to 31bec32.
• Issues #498 through #504 are all open, have no closing PR attached, and collectively account for all 18 rows: eight R2, four KV, Worker list, Worker settings, ruleset read, two zone-setting operations, and Notion query.
• The manifest update does not close or claim to implement those issues. No safety classification changed.

GitHub would not accept a formal approval because the current authenticated account authored the PR, so this is submitted as a review comment with the verdict stated explicitly.

[zackbart]

APPROVE verdict for commit 843e676. GitHub does not permit this authenticated account to submit a formal approval on its own PR.

Verified:

• The diff changes only two drift manifests.
• It contains exactly 18 contract digest replacements: 17 Cloudflare and one Notion. No method, path, revision, deprecation flag, endpoint order, or other manifest data changed.
• Recomputing against Cloudflare OpenAPI commit 31bec32 and the current Notion OpenAPI reports zero findings across 49 and 14 touched endpoints.
• All eight R2 old digests match the previously reviewed Cloudflare snapshot. All eight new digests match the pinned current snapshot.
• The R2 structural deltas are exactly the addition of us to cf-r2-jurisdiction on all eight endpoints and to the bucket result enum on the four bucket-returning endpoints. No reviewed R2 delta was omitted or mis-recorded.
• Issues #498 through #504 remain open. The PR has no closing issue references, and neither its body nor commit message uses a closing keyword.

No blocking findings.

[zackbart]

Independent test at exact commit 843e676a0cd906357727195ca64f93845bf800b6 from a fresh detached worktree.

Verification passed:

• Package version remains 0.20.0.
• Pinned Cloudflare plus current Notion drift check passed:
  • Cloudflare: no drift across 49 touched endpoints at revision 4.0.0.
  • Notion: no drift across 14 touched endpoints at revision 1.0.0.
• npm run release:check passed:
  • 114 test files passed.
  • 2,705 tests passed and 40 skipped.
  • Production audit found 0 vulnerabilities.
  • The packaged deployment and Docker container smoke passed.
• Package contents are unaffected by this PR:
  • The diff changes only scripts/drift/cloudflare-endpoints.json and scripts/drift/notion-endpoints.json.
  • No package input path differs from the release commit.
  • The dry-run package contains 167 files and 551,533 bytes, matching the release package.
  • It contains no scripts/drift/ entries.

Blocker verdict: none. This PR is safe to merge before publishing 0.20.0.