Agent Native docs v1.0.0Showcase
Uppercut Labs / Agent Native

UAN-008 Cloudflare Worker sidecar evidence

Scope

E04 is a separate Worker sidecar for E01's static Astro catalog. The exporter copies E01's canonical public album data, shared capability contract, and sidecar diagnostics into an isolated Worker fixture. Browser and Worker bind the same definition, schema, lookup function, and data; parity tests verify contract identity and input/output schemas. A SHA-256 revision is derived from JSON-serialized ordered album records, and the E01 test recomputes it. Wrangler configuration is checked against the shared revision.

The Worker delegates HTTP/OpenAPI and MCP to package adapters. It uses Web Request/Response APIs, bounded adapter bodies/deadlines, explicit SIDECAR_HOST and ALLOWED_ORIGIN configuration, Host and browser-Origin checks, and exact ACAO for the configured origin for browser health/HTTP diagnostics. Cross-origin browser MCP is not claimed; the official MCP client fixture sends no browser Origin. It exposes only the public-read album capability.

Verification

Run npm run example:e04 from the repository root. The exporter installs the standalone fixture, runs 9 diagnostic/config/contract tests, then runs Wrangler locally on workerd. Local requests exercise matching catalog health, OpenAPI, an HTTP invocation, exact-origin ACAO/preflight, denied Origin and Host, and an official MCP SDK client discovery/call. The client records negotiated MCP protocol 2025-11-25. The HTTP and MCP success paths are real local workerd exchanges; the sidecar origin, missing same-origin route, missing binding, and revision mismatch classifier cases are simulated/unit requests.

The same command runs Wrangler deploy --dry-run --outdir .worker-bundle. It scans all emitted JS files for Node builtin import/require specifiers and verifies the Wrangler config does not enable nodejs_compat. The dry-run builds and inspects only; it does not deploy. Operators can start local workerd with npx wrangler dev --local. A later, separately approved release would use npx wrangler deploy only after setting the actual host/origin/revision values and Cloudflare account; no live deployment was performed.

E01's before-state fixture and integrated site both build as Astro static output with no server adapter. Its generated album page carries the shared revision. Browser sidecar diagnostics refresh after Astro ClientRouter navigation and Window pageshow, deduplicate installation, and probe the same-origin /mcp path only when same-origin routing is explicitly configured.

Limits

Evidence is local workerd execution. No Cloudflare production deploy, account provisioning, paid resource, DNS change, custom host, real browser, or production CORS behavior was performed or verified. The fixture's SIDECAR_HOST, ALLOWED_ORIGIN, and public Astro environment values are local examples and must be replaced for an operator's hosts. A sidecar URL does not create a same-origin /mcp route. Cross-origin browser MCP is not claimed; the official MCP SDK fixture is server-side and sends no browser Origin.

The SHA-256 revision is exposed in the static page and Worker health response. It is checked from ordered public album JSON in tests rather than computed dynamically in browser runtime. These diagnostic tests are simulated; the HTTP and MCP exchange against local workerd is real.

The Astro 7.3.5 transitive http-cache-semantics@4.2.0 advisory and release gate documented in UAN-007 evidence remain unresolved. Astro is not bundled in the core tarball, but Astro consumers may install the affected dependency.

References

View source on GitHubRaw Markdown