Cloudflare Runtime & Research Operations Patch

This production patch restores Cloudflare-compatible public-endpoint DNS preflight and adds a fail-closed path for publishing validated, secret-free research artifacts. It does not promote the in-progress Level 2 comparison to a shipped capability.

What changed

✓Replaced unsupported Workers DNS lookup with dual-stack resolve4/resolve6 checks and valid-address filtering.
✓Added safe endpoint-policy reason categories without exposing provider response bodies or credentials.
✓Added an explicitly confirmed publisher for immutable references, active pointers, and temporary reports after full artifact validation.
✓Kept bilingual benchmark and progress surfaces explicit that v0.4 remains in progress.

Verification evidence

●35 automated tests plus TypeScript, ESLint, Next.js, and OpenNext builds
●A real production failed-endpoint run normalized three HTTP 401 samples without persisting a key or full Base URL
●English, Chinese, desktop, mobile, and Level 2 missing-reference production routes

Next target

Configure an official reference privately and complete a positive-control run before promoting v0.4.0.

Release boundary

This article records shipped work and explicit limitations. Experimental results are not promoted by a patch release.

Check the current build All updates