Cloudflare-native Runtime

This page describes son-of-anton-review on feat/cloudflare-native, the deployed-engine lineage from the handoff. It does not describe the unmerged feat/greptile-operator-parity API Worker. In particular, the native fetch handler does not serve /operator/api/*.

Worker and bindings

The main configuration is cloudflare-native/wrangler.jsonc. The key broker has a separate configuration, cloudflare-native/wrangler.key-broker.jsonc.

These are checked-in resource names and limits, not a probe of your account. Source: engine cloudflare-native/wrangler.jsonc:17-105.

Public ingress

GET /health returns an ingress health response. POST /github/webhooks requires the GitHub delivery, event and signature headers, verifies HMAC against GITHUB_WEBHOOK_SECRET, parses JSON, then checks KV.

The delivery marker uses DEDUPE_TTL_SECONDS, default 604800 seconds. Accepted but non-actionable events are recorded as ignored. Actionable deliveries are recorded before enqueue. Record or enqueue failures attempt to delete the marker and return HTTP 500; deletion is best-effort. A 500 permits redelivery, but is not a guarantee that GitHub will redeliver automatically.

Payload offload begins above 96 × 1024 encoded bytes, not characters, when WEBHOOK_PAYLOADS exists. Without that binding, the code attempts inline enqueue; an oversized queue message can then fail. The consumer resolves payloadRef before container dispatch.

Sources: engine cloudflare-native/src/ingress.js:139-171,264-346; cloudflare-native/src/consumer.js:125-175,344-356.

Dispatch and container lifecycle

The queue consumer configuration is batch size 1, batch timeout 5 seconds and max_retries: 8. The consumer separately reads MAX_ATTEMPTS, default 8, for its own error path. Do not treat these as the same counter.

The consumer claims a D1 dispatch lease, default LEASE_MS = 1800000, and renews it every min(30000, floor(LEASE_MS / 3)) milliseconds, with a minimum of one millisecond. A competing delivery retries while another holder is running; a succeeded holder allows acknowledgement. The request to the container includes the lease holder and action.

OmpContainer listens on port 8080 and has sleepAfter = '15m'. Its internal server accepts POST /review; a concurrent request receives 503 container_busy, and a stopping process returns 503 container_stopping. GET /health reports the current phase. The process logs its active phase every 30 seconds. That logging is not proof of a platform-level keepalive guarantee.

A successful review response is sent only after the final state flush succeeds. On termination, the server aborts the job, attempts a checkpoint flush and schedules process exit after 10 seconds. Checkpoint failures are logged. This is best-effort recovery, not a guarantee that all in-flight state survives eviction.

Sources: engine cloudflare-native/wrangler.jsonc:62-69; cloudflare-native/src/consumer.js:17,308-419,450-465; cloudflare-native/src/omp-container.js:14-46; cloudflare-native/container/entrypoint.mjs:391-486.

State and token transport

The container does not receive D1 or key-broker service bindings. HTTP requests to state.internal and broker.internal are intercepted by the outbound Worker; sandbox.internal handles validation. The binding side performs D1 operations and broker RPC.

The store bridge hydrates an in-memory run, serializes flushes, and advances event cursors only after acknowledgement. Before a native publish claim it flushes the analysis state, then awaits the D1 publication operation. Trace rows ride the same HTTP flush request, but state and traces are written in separate steps. They are not one atomic transaction.

Recovery skips analysis only when the hydrated run already has analysis.status = succeeded. A saved phase label alone does not resume a model call or validation process from its interruption point.

Sources: engine cloudflare-native/src/omp-container.js:62-84; cloudflare-native/src/state-transport.js:558-599,615-679; cloudflare-native/src/d1-store-adapter.js:263-354; cloudflare-native/container/entrypoint.mjs:49-68,95-148.

Effective configuration

Only nonblank string values in FORWARDED_KEYS enter the container, plus the executor and GILF_CF_SANDBOX_ENABLED=1. The App private key and the V5 activation flags are absent. A Worker environment setting outside this projection does not configure the runner.

The E2B gate uses all recorded validation.e2b cost, not a monthly invoice. At or above the ceiling it removes only the E2B shadow selector. Missing D1 or a failed spend read leaves the lane enabled. Concurrent or unrecorded work can exceed the estimate ceiling. See Test Lab.

Sources: engine cloudflare-native/src/container-env.js:15-141; cloudflare-native/src/publish-mode.js:26-35; cloudflare-native/container/entrypoint.mjs:319; src/validation-executor.js:378-386; cloudflare-native/wrangler.jsonc:132-161.

Cron schedules

The checked-in configuration uses the paired UTC schedules for 23:30 Europe/London. prime-watch is explicitly unscheduled. The native watchdog is invoked with alert delivery disabled; recorded failures do not imply an external notification was sent.

Sources: engine cloudflare-native/wrangler.jsonc:107-130; cloudflare-native/src/cron.js:53-88,175-176,260-263.

Provisioning instructions: Cloudflare quickstart. Durability limits: Queue and durability.