Memory
CLOUDFLARE-OS REFERENCE BASELINE + STATE SNAPSHOT (captured Sep 4, 2026, ~1pm BST, via Perplexity from github.com/cloudflare/cloudflare-os @ main, HEAD commit 87273523). PURPOSE: give DocuClear a sphere-resident reference for the OS layer (per decision 5d0286c4: Cloudflare OS = the customer/agent work environment). DOCS INGESTED into project:cloudflare-os (9 files, raw.githubusercontent main branch): AGENTS.md (d5b03693, 38k chars), README.md (5d519f2b, 20k), docs/ai-gateway-billing.md (fef09d19), docs/blueprints.md (63e222f3 — pinned-SHA URL, refs/heads/main failed extraction), docs/integration-testing.md (8f5952cf), docs/oauth-signin.md (981c7e04), docs/observers.md (e93b18f8, 57k — the big one), docs/public-server.md (e71e59fc), docs/sharing.md (a66f86f9). Images dir skipped (no text value). WHERE THINGS ARE (merged last ~3 days, Sep 1–4): 1. GIT WORKTREES (#384, kentonv, merged Sep 3) — the headline. An agent mounts a Git repo at a commit and reads/edits/greps/diffs/commits — ENTIRELY JS/TS in a Durable Object: no containers, no bash, no git CLI. Worktree appears as a gadget-without-app and as a named env binding. GitHub gatekeeper exposes commits to the Overseer, shallow/lazy pulls, and can push commits + open PRs. The PR itself was authored by kentonv's OS agent. DOCUCLEAR RELEVANCE: high — this is upstream's answer to versioned working state (cf. context-git assignment in 2d09d82b) and to agents producing auditable code artifacts (evidence centre pattern). 2. GATEKEEPER-KIT (@gadgets/gatekeeper-kit) — new shared library of provider-independent gatekeeper primitives: connect-flow handshake, observer strategies (private/ACL/tracked-set/open) + ObservationGate, CredentialCoordinator/Source (identity fence, skew-aware refresh), ActionJournal (staged→pending, two-tier), defineActions, generation-keyed KvTtlCache, cursors, simulation substrate (#392 landed Layer 1 + design doc; #430 usability fixes; #432 preview-OAuth helper; #438 pending-action file storage). DOCUCLEAR RELEVANCE: candidate rebase target for the ambient sphere gatekeeper (4b8031cf) — our custom gatekeeper hand-rolls exactly these pieces; upstream is converging them into a kit. Also confirms our architecture bet: observers + approval queues + simulation are upstream's canonical gatekeeper shape too. 3. OBSERVER VERIFICATION (#380, merged Sep 3) — authorizeCollaborator() is now the single gate; adding a binding restarts live sessions so collaborators are re-verified (abort DO to revoke RPC caps). 4. EVALS (#360/#361/#362, merged Sep 3) — reusable Workshop agent session, local trajectory evals, functional eval scenarios + CI reporting; eval model catalog typed against SUGGESTED_MODELS. Upstream now has an eval harness culture — matches our evidence standard. 5. MCP PORTAL (#397, merged Sep 3) — release-manifest shortNames folded to legal install slugs (gatekeeper-mcp-portal deploys at /gatekeeper/mcpportal); zero-input gatekeepers (mcp-portal incl.) are now SINGLETON/install-once. RELEVANCE: we just deployed two mcp-portal gatekeepers (4b8031cf) — upstream singleton enforcement is now a thing; our two-tier internal/external split is the multi-install pattern via separate workers, fine, but watch this on rebases. 6. GOOGLE DEPTH — enhanced Gmail gatekeeper (#367), Google Drive native document sessions incl. Docs/Sheets splits (#296), Calendar availability batching (#435) + primary alias (#426). 7. Built-in blueprints unpacked (#265) — gadget sources live in source control, not .gadget archives; easier to review/diff. WHERE THINGS ARE GOING (open PRs as of Sep 4): - OFFICE EXPORT across workspace blueprints: #439 docx (workspace-docs), #433 xlsx (workspace-sheets), #434 pptx (workspace-slides), all by maxwellpeterson. RELEVANCE: directly answers MVP piece 1's VERIFY FIRST question (2d09d82b) — OS gadgets are gaining native Office-format export; the formula/feature gap vs Office CLI narrows. - SKILLS IN THE COMPOSER: #423 composer skill picker + #422 selected skills as composer pills (FBalint). RELEVANCE: upstream is shipping user-facing 'skills' — notable given the Klarus/Alper positioning lesson (4df88ef0 update Sep 3): the fashion vocabulary is arriving in the OS UI itself; packaging implications for how DocuClear surfaces capability without ceding the taxonomy argument. - #441 gatekeeper-kit replayable runs with account-adjudicated expiry (ndisidore); #440 folder-scoped Google Drive resource; #427 createExternalResource agent tool; #381 rename prohibitAllSharing → containsRestrictedData. - Models: GLM 5.3 Flash added to suggested models (#376); eval catalog is provider-typed. CADENCE OBSERVED: heavy daily merge velocity from a ~6-person core team (Maximo-Guk, ndisidore, maxwellpeterson, dcartertwo, FBalint, AshishKumar4 + kentonv); Dependabot keeps toolchain current (wrangler 4.125, workers-types 20260825). Theme of the week: gatekeeper formalisation (kit), agent↔git convergence (worktrees), office-format export, skills UX. NEXT REFRESH: re-ingest docs on rebase cadence; observers.md and blueprints.md are the two that move fastest.
Tags: cloudflare-os, reference, state-snapshot, github, worktrees, gatekeeper-kit, evals, skills, office-export, docuclear-relevant, volatility:state, project:cloudflare-os, kind:episodic — Source: mcp — 2026-09-04 12:02:39 UTC