contextforge-org · lucarlig · Aug 21, 2026 · Aug 21, 2026 · Aug 21, 2026
diff --git a/_context/wiki/SUMMARY.md b/_context/wiki/SUMMARY.md
@@ -4,7 +4,7 @@
 
 # The Project
 
-- [What is ContextForge Data Plane?](project.md)
+- [What is the ContextForge External Dataplane?](project.md)
 - [Getting Started](getting-started.md)
 
 # Architecture

diff --git a/_context/wiki/architecture.md b/_context/wiki/architecture.md
@@ -184,7 +184,7 @@ Flow checkpoints — each must exist before the next dependency runs:
 
 | Checkpoint | Fact established | Next dependency |
 | --- | --- | --- |
-| Listener | Request reached Rust dataplane over TCP/TLS. | Metrics, tracing, nested routing. |
+| Listener | Request reached the ContextForge external dataplane over TCP/TLS. | Metrics, tracing, nested routing. |
 | Path extraction | Inner path matched `/servers/{virtual_host_id}/mcp`. | MCP handlers can resolve a `VirtualHost`. |
 | Claims validation | Bearer token accepted; `ContextForgeClaims` exists. | Config lookup can use `claims.sub`. |
 | User config lookup | `UserConfig` exists for the authenticated subject. | Virtual host check can run. |
@@ -234,7 +234,7 @@ Changing a load-bearing choice requires updating more than one file:
 
 | Change | Required follow-through |
 | --- | --- |
-| Downstream MCP version | Coordinate with control plane; update protocol tests and examples; keep legacy traffic on control-plane routes. |
+| Downstream MCP version | Coordinate with the ContextForge control plane and built-in dataplane; update the `2026-07-28`/`2025-11-25` compatibility matrix, protocol tests, examples, and front-door routing. The ContextForge built-in dataplane handles both stateful and stateless traffic; the ContextForge external dataplane handles both supported Streamable HTTP versions statelessly. |
 | Backend namespace / prefix contract | Update merge logic, split logic, tests, docs, and control-plane integration if client-facing surface moves. |
 | Session state moves external | Update `SessionManager`, cleanup behavior, load-balancing docs, and failure-mode tests. |
 | Config transport changes | Keep `UserConfigStore` as the boundary; update adapter tests. |

diff --git a/_context/wiki/config.md b/_context/wiki/config.md
@@ -212,7 +212,7 @@ Start lightweight dependencies:
 docker compose -f docker/docker-compose-local.yaml up -d redis gateway-one gateway-two
 ```
 
-Register payload-marker configuration before starting the data plane:
+Register payload-marker configuration before starting the ContextForge external dataplane:
 
 ```bash
 docker compose -f docker/docker-compose-local.yaml exec -T redis \
@@ -395,7 +395,7 @@ cargo run --release --bin contextforge-data-plane -- \
 
 ## Known Telemetry Gaps
 
-Tracked upstream, not yet implemented in the dataplane:
+Tracked upstream, not yet implemented in the ContextForge external dataplane:
 
 | Gap | Issue |
 | --- | --- |

diff --git a/_context/wiki/deployment.md b/_context/wiki/deployment.md
@@ -7,7 +7,7 @@
 
 ## Checklist
 
-1. Front door routes only `/contextforge-rs` to the dataplane.
+1. Front door routes only `/contextforge-rs` to the ContextForge external dataplane.
 2. JWT verification key/secret matches the control plane's signing material; clients use control-plane API tokens whose `sub` matches the published user-config key.
 3. Redis reachable; TLS/mTLS across trust zones; write access restricted to the control plane; `DATAPLANE_PUBLISHER=true` on the control plane.
 4. Upstream connection mode matches backend URL schemes.
@@ -23,8 +23,9 @@
 ## nginx Front-Door Routing
 
 Reference `docker/nginx.conf` split:
-- `location ^~ /contextforge-rs` → proxies to the gateway.
-- All other traffic (UI, management, SSE, legacy MCP) → control-plane.
+- `location ^~ /contextforge-rs` → proxies to the ContextForge external dataplane.
+- UI and management traffic → ContextForge control plane.
+- Other MCP routes, including stateful and legacy/SSE compatibility routes → ContextForge built-in dataplane.
 - Upstream retries on `error timeout http_502/503/504`: 2 tries, 10-second window. Non-idempotent MCP `POST` bodies are not re-sent after they reached an upstream — only connection-stage failures retry.
 
 ## Session Affinity And Failover

diff --git a/_context/wiki/getting-started.md b/_context/wiki/getting-started.md
@@ -4,7 +4,7 @@
 
 ```bash
 make docker-prod    # build contextforge-data-plane:latest from docker/Dockerfile
-make compose-up    # start nginx, control-plane, redis, postgres, dataplane, fast_time_server
+make compose-up    # start nginx, Python control/built-in components, Redis, Postgres, external dataplane, fast_time_server
 ```
 
 Wait for `register_fast_time` to finish, then allow ~60s config propagation:
@@ -20,14 +20,16 @@ docker compose -f docker/docker-compose.yml logs -f register_fast_time
 | Bearer token | `GET http://localhost:8080/contextforge-rs/admin/tokens/admin@example.com` |
 | fast_time_server virtual host id | `b8e3f1a2c4d5e6f7a1b2c3d4e5f6a7b8` |
 
-> **Critical**: `/contextforge-rs` prefix → dataplane. Without it → control-plane (you'll get `{"detail":"..."}` from mcpgateway, not a dataplane response).
+> **Critical**: `/contextforge-rs` prefix → ContextForge external dataplane.
+> Without it, MCP routes reach the ContextForge built-in dataplane (you'll get
+> `{"detail":"..."}` from mcpgateway, not an external-dataplane response).
 
 Teardown: `make compose-down` (stops containers; volumes kept).
 
 ## cf-integration Harness (full end-to-end)
 
 ```bash
-scripts/cf-integration.sh up        # checkout control-plane, pull dataplane image, start full stack
+scripts/cf-integration.sh up        # checkout Python control/built-in repo, pull external-dataplane image, start full stack
 scripts/cf-integration.sh probe     # smoke: 401 check → initialize → tools/list → tools/call
 scripts/cf-integration.sh test-all  # all lanes: live-mcp, live-rbac, live-protocol
 scripts/cf-integration.sh down

diff --git a/_context/wiki/index.md b/_context/wiki/index.md
@@ -1,4 +1,4 @@
-# ContextForge Data Plane — Wiki
+# ContextForge External Dataplane — Wiki
 
 This wiki captures durable project context and working preferences.
 Check this index at the start of a task to decide whether deeper context is needed,
@@ -16,19 +16,19 @@ then follow only the links that are relevant.
 | [mcp-capability-allocation.md](mcp-capability-allocation.md) | Tentative ContextForge 2.0 target topology, ownership, state model, Phase 1-4 roadmap, and Phase 3 flows |
 | [failure-modes.md](failure-modes.md) | HTTP/MCP/routing/backend/plugin failure table — exact HTTP codes and JSON-RPC errors |
 | [config.md](config.md) | Key CLI flags, JWT claims, UserConfig shape, plugin config, telemetry debugging, startup validation, local observability stack |
-| [deployment.md](deployment.md) | Deployment checklist, health endpoint caveat, nginx routing, TLS choices, session affinity, Redis availability, image pinning |
-| [security.md](security.md) | Trust boundaries, control-plane/dataplane authentication split, Origin/Host validation, transport security, secrets handling |
-| [performance.md](performance.md) | Dataplane-only load testing (Goose), full-stack Locust runs, benchmark settings, control-plane baseline |
+| [deployment.md](deployment.md) | External-dataplane deployment checklist, health endpoint caveat, nginx routing, TLS choices, session affinity, Redis availability, image pinning |
+| [security.md](security.md) | Trust boundaries among the control plane, built-in dataplane, and external dataplane; Origin/Host validation; transport security; secrets handling |
+| [performance.md](performance.md) | External-dataplane-only load testing (Goose), full-stack Locust runs, benchmark settings, built-in-dataplane baseline |
 | [testing.md](testing.md) | Workspace checks, in-repo integration tests, full-stack harness lanes, settings, and control-plane baseline |
 
 ## Quick orientation
 
-- **Repo**: `contextforge-data-plane` — the Rust dataplane for ContextForge.
-- **Core invariant**: this crate is pure routing logic. No IAM, UI, or metrics storage.
-- **Protocol target**: MCP `2026-07-28` over Streamable HTTP. Legacy SSE paths are being removed.
+- **Repo**: `contextforge-data-plane` — the Rust ContextForge external dataplane.
+- **Core invariant**: the ContextForge external dataplane is pure routing logic. No IAM, UI, or metrics storage.
+- **Protocol target**: the ContextForge external dataplane supports MCP `2026-07-28` and `2025-11-25` over Streamable HTTP. Both use stateless request handling; `initialize` remains supported but does not establish external-dataplane session state. Legacy SSE paths are being removed from the external dataplane.
 - **Status convention**: project, architecture, routing, and operations pages
   describe the current implementation. The page under **Upcoming** describes
   the tentative ContextForge 2.0 target and migration roadmap.
 - **Architecture context**: [architecture.md](architecture.md) — read before touching the hot path. Full wiki index above.
 - **Validation gate**: `cargo fmt` + `cargo clippy` + `cargo nextest` + `cargo deny` must be clean; CI also runs `cargo shear`. See [preferences.md](preferences.md) for by-change-type requirements.
-- **System topology**: `client → nginx → [dataplane | control-plane]`; config flows from control-plane via `dataplane_publisher.py` → Redis → dataplane. See [project.md § System topology](project.md#system-topology).
+- **System topology**: `client → nginx → [ContextForge built-in dataplane | ContextForge external dataplane | ContextForge control plane]`; external-dataplane config flows from the control plane via `dataplane_publisher.py` → Redis → external dataplane. See [project.md § System topology](project.md#system-topology).