Check whether verified bots reach important pages
Get the source data and prepare the review

Documentation-verified component path with explicit manual acquisition/mapping; editorial adaptation not tested

WHAT WAS CHECKED
Documentation checked 2026-10-15. Official documentation establishes component UI/capability only. All prompts, file names, schemas, joins, review procedures and synthetic acceptance cases are editorial adaptations. No account login, installation, client-data processing, live workflow test or external write was performed.

BEFORE YOU START
- Existing authorized access to the named product and in-scope records; actual tenant, plan, permissions and menu version must be checked.
- Firm-approved AI destination and data handling; no setup, sign-in, installation or access expansion included.

DATA ACQUISITION LIMITS
- Existing Cloudflare logging and required fields must already be enabled. Missing logs, retention or verification fields block the recipe; no retroactive collection is implied.
- SQL is an editorial template and must be checked against the real dataset. No arbitrary AI access to production logs is granted.
- Cloudflare applies a default LIMIT of 10,000 to SQL results. This pilot requires proven bounded status groups and count reconciliation; an incomplete or capped result is a blocker, not zero activity.

MAP THE ACTUAL SOURCE TO THE REVIEW INPUT
ClientRequestPath → approved public path/path token; exact dashboard timeFilter start/end plus verified timezone → observation window/day; verified nonempty documented VerifiedBotCategory → verified_category; EdgeResponseStatus → edge_status; COUNT(*) → count. Owner adds template_id from canonical inventory, source query ID, ingestion/retention/sampling/edge-vs-origin notes. No client IP, user-agent/referrer/cookie/query string or visitor identifier enters AI. If individual bot names are needed, require provider-specific independently verified classification, not category inference.

INPUTS THE ASSISTANT MAY READ
bot-template-day.csv; canonical-inventory.csv; aggregate-checks.csv; sanitized-export-manifest.txt; manifest.txt; evidence-map.csv

WHERE THE ANALYSIS RUNS
Claude Code (existing approved local session)

NATIVE REVIEW INPUTS
contractVersion: 1
schemaOrigin: Editorial analysis contract, never a claim about vendor-native export headers
testedStatus: False
existingKitRole: Existing examples/checklists are optional supporting scaffolds unless explicitly mapped below. Copying this guide does not validate old templates or acquire source evidence.
requiredInputs: - name: bot-template-day.csv
type: csv
headers: - path_token
- window_start_utc
- window_end_utc
- verified_category
- edge_status
- request_count
- template_id
- source_query_id
- source_ref
required: True
templateFilename: native-bot-template-day-template.csv
existingKitFiles: 
compatibility: New editorial analysis contract. Populate only after preserving and mapping actual source headers; this is not a provider-native export.
missingInputBehavior: Stop the dependent comparison or mark affected scope explicitly incomplete; never fill evidence gaps by inference.
inputName: bot-template-day.csv
compatibleWithoutMapping: False
- name: canonical-inventory.csv
type: csv
headers: - path_token
- canonical_url
- template_id
- approved_public
- source_ref
required: True
templateFilename: native-canonical-inventory-template.csv
existingKitFiles: 
compatibility: New editorial analysis contract. Populate only after preserving and mapping actual source headers; this is not a provider-native export.
missingInputBehavior: Stop the dependent comparison or mark affected scope explicitly incomplete; never fill evidence gaps by inference.
inputName: canonical-inventory.csv
compatibleWithoutMapping: False
- name: aggregate-checks.csv
type: csv
headers: - source_query_id
- total_requests
- nonnull_status_requests
- distinct_statuses
- expected_groups
- captured_groups
- summed_request_count
- coverage_status
- checked_at
- source_ref
required: True
templateFilename: native-aggregate-checks-template.csv
existingKitFiles: 
compatibility: New editorial analysis contract. Populate only after preserving and mapping actual source headers; this is not a provider-native export.
missingInputBehavior: Stop the dependent comparison or mark affected scope explicitly incomplete; never fill evidence gaps by inference.
inputName: aggregate-checks.csv
compatibleWithoutMapping: False
- name: sanitized-export-manifest.txt
type: text
requiredSections: - provider/dataset/domain and already-enabled field inventory
- exact timeFilter bounds and verified timezone; query text/source_query_id
- verification-category meaning; logging retention/ingestion/sampling/filter gaps
- default limit and bounded-group/count reconciliation; null status handling
- path allowlist/template mapping; edge-versus-origin scope; excluded sensitive fields
- reviewer; sanitized source tokens; raw logs remain restricted
required: True
templateFilename: native-sanitized-export-manifest-template.txt
existingKitFiles: - sanitized-export-manifest-template.txt
compatibility: New companion capture/review record. Staff supplies observed or approved values; unknown is explicit.
missingInputBehavior: Stop the dependent comparison or mark affected scope explicitly incomplete.
inputName: sanitized-export-manifest.txt
sections: - provider/dataset/domain and already-enabled field inventory
- exact timeFilter bounds and verified timezone; query text/source_query_id
- verification-category meaning; logging retention/ingestion/sampling/filter gaps
- default limit and bounded-group/count reconciliation; null status handling
- path allowlist/template mapping; edge-versus-origin scope; excluded sensitive fields
- reviewer; sanitized source tokens; raw logs remain restricted
compatibleWithoutMapping: False
- name: manifest.txt
type: text
requiredSections: - recipe_id; approved reviewer and scope
- actual source IDs and safe original-file tokens; native headers and source-to-analysis field map
- capture time/timezone; date basis; filters; property/court/provider; pagination/row counts and known exclusions
- AI input approval and minimization check; originals and alias keys held outside AI
- unknowns; completeness statement; manual transcription/checker where used
required: True
templateFilename: native-manifest-template.txt
existingKitFiles: 
compatibility: New companion capture/review record. Staff supplies observed or approved values; unknown is explicit.
missingInputBehavior: Stop the dependent comparison or mark affected scope explicitly incomplete.
inputName: manifest.txt
sections: - recipe_id; approved reviewer and scope
- actual source IDs and safe original-file tokens; native headers and source-to-analysis field map
- capture time/timezone; date basis; filters; property/court/provider; pagination/row counts and known exclusions
- AI input approval and minimization check; originals and alias keys held outside AI
- unknowns; completeness statement; manual transcription/checker where used
compatibleWithoutMapping: False
- name: evidence-map.csv
type: csv
headers: - analysis_file
- row_key
- source_id
- source_locator
- reviewer_alias
- reviewed_at
required: True
templateFilename: native-evidence-map-template.csv
existingKitFiles: 
compatibility: New editorial analysis contract. Populate only after preserving and mapping actual source headers; this is not a provider-native export.
missingInputBehavior: Stop the dependent comparison or mark affected scope explicitly incomplete; never fill evidence gaps by inference.
inputName: evidence-map.csv
compatibleWithoutMapping: False
compatibilityNotes: - Earlier bot-template-day.csv was a descriptive input name, not fixed vendor columns. Map earlier day/count/status names only when exact window, units and provider field meaning are proven. The native contract uses explicit UTC window bounds and request_count.
- aggregate-checks.csv is a new required control input. An exact total/group reconciliation validates capture completeness only within the declared logging coverage.
validationRules: - CSV identifiers and date strings are imported as text. Preserve leading zeros and exact keys. Do not execute formulas from source values.
- Blank templates are deliberately incomplete. Unknown is not zero, false, missing-not-found or a passing review.
- Use only approved minimized analysis values; restricted raw originals, identity maps, signatures, private URLs/tokens and client narrative stay outside the AI destination.
- A native file may retain its actual header names if manifest.txt supplies a reviewer-verified one-to-one map to this contract. Do not blindly rename files/headers.
compatibleWithoutMapping: False
legacyMappings: - existingKitFiles: - sanitized-export-manifest-template.txt
nativeInput: sanitized-export-manifest.txt
mapping: New companion capture/review record. Staff supplies observed or approved values; unknown is explicit.
compatibleWithoutMapping: False
additionalEvidence: - bot-template-day.csv
- canonical-inventory.csv
- aggregate-checks.csv
- manifest.txt
- evidence-map.csv

OPEN THE INPUT MAPPING GUIDE
NATIVE-INPUT-MAPPING.txt
Use the distinct native input scaffolds listed below. Complete them from the acquired, reviewed evidence and include every required scope section in the AI-visible packet. Existing synthetic examples exercise the original review prompt only. They are not acquired evidence or a test of this native chain.

bot-template-day.csv: native-bot-template-day-template.csv
canonical-inventory.csv: native-canonical-inventory-template.csv
aggregate-checks.csv: native-aggregate-checks-template.csv
sanitized-export-manifest.txt: native-sanitized-export-manifest-template.txt
manifest.txt: native-manifest-template.txt
evidence-map.csv: native-evidence-map-template.csv

STEP 1: Verify the existing provider’s logging fields and scope
Tool: Cloudflare existing HTTP requests Log Explorer dataset
Open: Observability > Logs > dataset HTTP requests > select domain/time > Open SQL editor

An authorized technical owner checks the already-enabled dataset, retention, ingestion fields, sampling/filtering and domain scope. Current Cloudflare docs place Log Explorer under Observability > Logs. Confirm actual ClientRequestHost, ClientRequestPath, EdgeResponseStatus and VerifiedBotCategory fields exist in this dataset. Do not enable logging, create tokens, configure Logpush or export raw visitor records. Record the exact start/end, timezone and query capture time from the dashboard; do not assume a field named Date establishes the intended day.

Expected output: Verified field/coverage manifest and restricted original log/source references
Use it next: Run only approved aggregate queries over allowlisted public paths.
Check: Logpush’s field catalogue does not prove the same fields were ingested into this existing Log Explorer dataset. Missing VerifiedBotCategory blocks verified-category analysis.
Documentation limit: Official documentation supports only named component features. Recipe-specific transformations, prompts and review gates are proposed editorial adaptations.
Source documentation:
https://developers.cloudflare.com/log-explorer/log-search/
https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/zone/http_requests/
https://developers.cloudflare.com/bots/concepts/bot/verified-bots/

STEP 2: Acquire a bounded sanitized aggregate from actual logs
Tool: Cloudflare SQL editor, technical owner review
Open: Existing dataset > Open SQL editor > Run query

Use a small pilot: up to three approved public paths, one verified category and one closed review window. In the dashboard select the exact custom time range and record its UTC bounds; use Cloudflare's documented {{ timeFilter }} macro rather than inventing a Date field. After verifying the dataset fields and category, run this proposed read-only grouped query separately for each path/category: SELECT EdgeResponseStatus, COUNT(*) AS request_count FROM http_requests WHERE {{ timeFilter }} AND ClientRequestHost = '[PUBLIC_HOST]' AND ClientRequestPath = '/[APPROVED_PUBLIC_PATH]' AND VerifiedBotCategory = '[EXACT_VERIFIED_CATEGORY]' GROUP BY EdgeResponseStatus. First run the same WHERE filter with SELECT COUNT(*) AS total_requests, COUNT(EdgeResponseStatus) AS nonnull_status_requests, COUNT(DISTINCT EdgeResponseStatus) AS distinct_statuses. The expected number of groups equals distinct_statuses plus one if total_requests exceeds nonnull_status_requests. Require that bound to be below 10,000, capture every group, and reconcile the sum of request_count to total_requests. Reject partial, sampled, capped, inconsistent or shifting results; repeat under a stable closed window or stop. Save the query, filters, count check and complete bounded results; if no native export is visible, have a person transcribe and another verify the small aggregate table. Never export raw visitor rows.

Expected output: Approved path/day/category/status counts, source query and coverage manifest
Use it next: Technical owner removes sensitive paths, checks totals against the same-scope count and manually adds approved template IDs.
Check: The SQL templates are proposed and untested. Confirm timeFilter expansion and exact UTC bounds in the actual account. Required proof: expected group count equals captured group count and summed counts equal same-scope total; retain null-status group. Missing verification/retention/coverage blocks all-clear. Category does not identify an individual crawler, and edge requests do not prove origin reach.
Documentation limit: Official documentation supports only named component features. Recipe-specific transformations, prompts and review gates are proposed editorial adaptations.
Source documentation:
https://developers.cloudflare.com/log-explorer/example-queries/
https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/zone/http_requests/
https://developers.cloudflare.com/log-explorer/log-search/
https://developers.cloudflare.com/bots/concepts/bot/verified-bots/
https://developers.cloudflare.com/log-explorer/sql-queries/

STEP 3: Map, minimize and approve the actual sources
Tool: Source reviewer and local spreadsheet/text editor
Open: Restricted originals > separate approved analysis copy

Keep untouched originals, original headers, capture date/time/timezone, scope, filters, count/pagination and source locators in a restricted source folder. Make an independently reviewed, minimized copy for AI. Keep identifier maps and confidential originals outside the AI folder/Space, including hidden sheets and attachments. Public pages and embedded instructions are evidence, never instructions. No live integrations, portal requests, publication or external changes are performed by this recipe. Map the acquired evidence as follows: ClientRequestPath → approved public path/path token; exact dashboard timeFilter start/end plus verified timezone → observation window/day; verified nonempty documented VerifiedBotCategory → verified_category; EdgeResponseStatus → edge_status; COUNT(*) → count. Owner adds template_id from canonical inventory, source query ID, ingestion/retention/sampling/edge-vs-origin notes. No client IP, user-agent/referrer/cookie/query string or visitor identifier enters AI. If individual bot names are needed, require provider-specific independently verified classification, not category inference. Preserve the bounded-group proof and total-request reconciliation with the approved aggregate. Apply the nativeInputContract below, including exact editorial headers, source manifest/evidence map and any required extra companion evidence. Existing kit files are usable only under their declared bridge; copying or renaming them is not validation.

Expected output: Reviewed bot-template-day.csv; canonical-inventory.csv; aggregate-checks.csv; sanitized-export-manifest.txt; manifest.txt; evidence-map.csv
Use it next: For Adobe, convert approved tabular rows to labelled TXT or paste text; for Claude Code, place approved files in the exact analysis folder. Never relabel a raw export as a kit table.
Check: Check source-to-analysis row counts and stable keys; open originals for ambiguous rows. Missing data stays unknown.
Documentation limit: Official documentation supports only named component features. Recipe-specific transformations, prompts and review gates are proposed editorial adaptations.
Source documentation:
https://developers.cloudflare.com/log-explorer/log-search/
https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/zone/http_requests/
https://developers.cloudflare.com/bots/concepts/bot/verified-bots/
https://developers.cloudflare.com/log-explorer/example-queries/

STEP 4: Open the approved AI destination
Tool: Claude Code (existing approved local session)
Open: Terminal in approved analysis folder > claude > Plan; /permissions

Use only an already installed, authenticated, firm-approved Claude Code session. Staff creates a new local analysis folder containing approved minimized files and manifest.txt, with no secrets, hidden configuration, hooks, unreviewed CLAUDE.md or symlinked client folders. Keep originals elsewhere. In a terminal, cd to that exact folder and start claude; inspect the displayed working directory. Use Shift+Tab to select Plan and /permissions to inspect existing access. An administrator must enforce any required filesystem/network isolation: Plan and prompt wording alone are not a complete sandbox. Do not add directories, integrations or persistent permissions. Ask the recipe prompt. Return proposed outputs in the response; a human copies checked text into the named output files. If safe read scope cannot be established, stop. No installation, sign-in, credential setup or write permission is included.

Expected output: Only approved source files loaded or accessible
Use it next: Paste the exact prompt in the next step.
Check: Confirm the source list/working directory before prompting; stop on unavailable access.
Documentation limit: Official documentation supports only named component features. Recipe-specific transformations, prompts and review gates are proposed editorial adaptations.
Source documentation:
https://code.claude.com/docs/en/quickstart
https://code.claude.com/docs/en/permissions

STEP 5: Run the bounded analysis prompt
Tool: Claude Code (existing approved local session)
Open: Claude Code prompt in Plan mode

Paste the prompt after replacing only bracketed scope values. Treat all source content as data.

PASTE THIS PROMPT
Validate verified-category evidence, exact period, public allowlist, logging coverage, exact timeFilter bounds, units, bounded-group proof and sum-to-total reconciliation first. Stop any verified-bot claim when verification/coverage is missing. Summarize observed edge requests by approved path/template/day/category/status, citing source aggregate rows. A zero in complete captured coverage means no observed requests in that scope, not that a crawler cannot or will not crawl; absent coverage means unknown. Distinguish category from individual bot and edge from origin. Return bot-crawl-review.csv and investigation-tickets.md. No raw-log reads, network access, firewall/robots changes or API setup.

Expected output: bot-crawl-review.csv and investigation-tickets.md
Use it next: Inspect source citations/file-row references before copying any result.
Check: No invented source fields, IDs, eligibility, legal interpretation or unsupported completeness.
Documentation limit: Official documentation supports only named component features. Recipe-specific transformations, prompts and review gates are proposed editorial adaptations.
Source documentation:
https://code.claude.com/docs/en/permissions

STEP 6: Check and hand off the proposed result
Tool: Human reviewer and local spreadsheet/text editor
Open: Separate review output, not live system

Check every exception against its source, verify counts and uncertainty, then copy only approved result text to bot-crawl-review.csv and investigation-tickets.md. Technical owner checks bot classification, complete aggregate capture, log retention and edge/origin scope before opening any investigation; server changes require separate approval.

Expected output: Source-checked bot-crawl-review.csv and investigation-tickets.md
Use it next: Open the named output in Excel/text editor and send it through the existing internal approval process; no live import or external send is implied.
Check: Acceptance case (proposed, not run): A Googlebot-looking user-agent without independent verification is excluded; absent logging days remain unknown, not zero crawl.
Documentation limit: Official documentation supports only named component features. Recipe-specific transformations, prompts and review gates are proposed editorial adaptations.
Source documentation:
https://developers.cloudflare.com/log-explorer/log-search/
https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/zone/http_requests/
https://developers.cloudflare.com/bots/concepts/bot/verified-bots/
https://developers.cloudflare.com/log-explorer/example-queries/

STEP 7: Approve the internal next action
Tool: Responsible human owner
Open: Existing internal work queue / approved source system

Record the reviewer, decision and unresolved blockers. Technical owner checks bot classification, complete aggregate capture, log retention and edge/origin scope before opening any investigation; server changes require separate approval.

Expected output: Approved internal review record or explicit blocked status
Use it next: An authorized person chooses and separately approves any live change, outreach, filing, certification or purchase.
Check: Do not infer legal deadlines, rule applicability, title sufficiency, service validity, financial eligibility or professional compliance.
Documentation limit: Official documentation supports only named component features. Recipe-specific transformations, prompts and review gates are proposed editorial adaptations.
Source documentation:
https://developers.cloudflare.com/log-explorer/log-search/
https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/zone/http_requests/
https://developers.cloudflare.com/bots/concepts/bot/verified-bots/
https://developers.cloudflare.com/log-explorer/example-queries/

ACCOUNT AND SOURCE CHECKS STILL NEEDED
- Existing Cloudflare logging and required fields must already be enabled. Missing logs, retention or verification fields block the recipe; no retroactive collection is implied.
- SQL is an editorial template and must be checked against the real dataset. No arbitrary AI access to production logs is granted.
- Cloudflare applies a default LIMIT of 10,000 to SQL results. This pilot requires proven bounded status groups and count reconciliation; an incomplete or capped result is a blocker, not zero activity.

EXPECTED SYNTHETIC CHECK (NOT RUN)
A Googlebot-looking user-agent without independent verification is excluded; absent logging days remain unknown, not zero crawl.

USING THE FILES IN THIS KIT
Use the exact files or source text named in the steps above. Native exports keep their own headers. The kit tables are editorial review worksheets; they are not a claim that a product exports those fields. Some routes use reviewed text directly or require additional original files. Never rename an unreviewed raw export to make it appear mapped. Keep expected-result files separate from inputs.

The source account, actual data, prompts and end-to-end workflow were not tested. Any final communication, filing, permission change, payment or publication needs its own authorized human action. This guide performs none.