[Madraka]

What

The standard release manifest's requiredScopes now names Workers Admin (workers-scripts.admin) instead of Workers Editor (workers-scripts.edit).

Installing a release creates the site Worker and the admin Worker. Since Cloudflare introduced granular Worker roles (changelog 2026-09-15), an Editor cannot create Workers. So a grant built from the old list could not install a release. The asset upload for the new site Worker answered 403 with an empty errors array, as the issue reports.

Changes

• scripts/release-bundle/standard.ts: workers-scripts.edit → workers-scripts.admin, with a comment.
• packages/cli/test/release-bundle.test.ts: a test that fails if the manifest goes back to .edit.
• packages/core-contracts/fixtures/{valid,invalid}/release-manifest/*.json (10 files): updated to match. The schema is unchanged, because ScopeId is only a pattern. No pnpm gen was needed and nothing generated changed.
• docs/rfcs/0046-release-bundles.md §3: a dated "Scopes" note with the consumer rule.

Old manifests (v0.9.0 and earlier)

Releases are immutable, so v0.9.0's manifest keeps workers-scripts.edit. The next release carries workers-scripts.admin. Consumers should treat the old manifests as follows:

• When comparing a grant with requiredScopes, treat workers-scripts.admin as covering workers-scripts.edit. A grant holding Admin satisfies old and new manifests alike.
• When building a grant from an older manifest, ask for workers-scripts.admin in place of workers-scripts.edit. A grant with only .edit cannot install a release.
• This is the only implied scope. Every other scope id is compared exactly.

No code in this repository compares scopes today. The shared verifier designed for #227 will expose this rule as a missingScopes helper.

Not changed

• RFC-0037's docs-site token ("Workers Scripts edit on this one Worker") updates an existing Worker, so Editor is enough there.
• No changeset: scripts/ is not published, and @cloudhal/core-contracts ships only dist, schemas and README.md, not its fixtures.

Tests

Not run locally, because the owner's machine is under load. CI is the test run for this PR. The tests that cover it:

• packages/cli/test/release-bundle.test.ts;
• the core-contracts fixture tests;
• the Rust fixture round trip (cargo test).

Closes #225

🤖 Generated with Claude Code