[zzwong]

Summary

Add the cloudflare_clef provider type to report-identity suites, with explicit clef or clef-flash selection. cr benchmark run resolves the configured Cloudflare account and credential store while sharing the identity prompt, System One codec, execution runner and replay.

Cloudflare can truncate long state without a completeness receipt. Runs require --allow-unverified-context and record context_status: unverified; explicit truncation signals fail. A parsed choice does not establish complete input consumption.

Includes shared execution and credential and replay contract fixes. The unshipped infer-clef command is removed without an alias. Live review behavior is unchanged.

Validation

• Full tests, lint, module tidy and build passed. Provider, command and replay regressions use injected transports and local fixtures.
• Compiled CLI checks cover direct and saved candidates, empty inputs, whole-budget rejection, missing acknowledgement and invalid selectors without provider calls. They verify fixed routes, Bearer provenance, unverified context, retained originals, independent replay and private artifacts.
• Tests cover both selectors, account and candidate validation, explicit truncation, usage metadata and response bounds. Shared contract tests cover selected-store credentials and complete fixture-size boundaries.

Live Cloudflare smoke remains pending because no scoped credential is configured. The preserved local evidence does not establish complete-context model quality.

[zzwong]

The unverified-context acknowledgement and pending Cloudflare smoke are documented accurately. Credential and retention corrections are tracked in #719.