# OPS006-LAB1 — Edge-delivery layer evidence

Everything is local and synthetic. No Cloudflare account, DNS zone, credential, public hostname, WAF probing, R2 bucket, or network egress is used.

For each case produce eight states:
`edge_entry_state`, `waf_decision_state`, `cache_decision_state`, `origin_path_state`, `r2_delivery_state`, `compatibility_state`, `evidence_boundary_state`, and `recovery_decision_state`.

Rules:
1. Proxied edge entry is routing evidence, not application correctness.
2. A WAF block is a WAF-layer fact unless separate origin evidence exists.
3. HIT/MISS/STALE/BYPASS are cache observations; they do not prove correctness or authorization.
4. Origin conclusions require route/origin evidence.
5. R2 Custom Domain public delivery is separate from private-object authorization.
6. R2 capability support must come from the supplied compatibility snapshot.
7. Keep direct observation, inference, and unknowns separate.
8. The transfer case must be solved from its own header/cache/route/capability facts.

Run `python -B run_checks.py` for learner-visible structural checks. Hidden acceptance lives outside learner paths.