v0.4.0 — AMH WT Agent Harness

AMH WT Agent Harness — bounded delegation behind the MCP

The master model delegates; small K2-class workers execute the tasks they are good at; an independent verifier checks; the master accepts. Nothing self-applies.

New private companion Worker (agent/):

• Coordinator (Durable Object) — versioned job packets with acknowledgement hashes, tamper-evident hash-chained audit log, per-user tenant isolation
• Continuity Keeper — compact project briefing; keep / archive / drop / reload-by-ID memory layers; automatic 4/7/30-day retention with byte budgets
• SafeTry — read / plan / approval-required / blocked capability lanes; HTTPS-only allowlisted crawling with SSRF guards; no raw shell, no secret exposure
• Guided templates — web research, secondary deep dive, citation verify, UI check, Cloudflare diagnose/inventory, config compare, missed items, zero-AI site health, revision proposals
• Honest model lanes — free profile (GLM Flash primary + Gemma verifier) with clear labeling; paid-k2 profile enables Kimi K2.6 primary + verifier
• Agent profiles — friendly names (auto-named if you skip it), a permanent renameable office-manager, rename/remove with audit events, immutable version scorecards
• Revisions — workers file candidate improvements as diffs with evidence; master approval required before anything becomes active
• Web console — session + CSRF + Turnstile-ready auth, strict CSP, live progress bars with visible handoffs, Done tab, opt-in redacted local cache/export
• Terminal watcher — npm run watch in agent/: running agents pinned on top with live bars; operator commands agents, job <id>, name <id> <new name> applied through the internal API and audit-logged
• Email loopback verifier — real deliverability receipts, not a vague "sent" badge
• Knowledge vault — approved redacted lessons land in Git under agent/knowledge-vault/<site>/<date-time>_<type>.json; private stashes stay ignored

Main MCP worker v0.4.0: new tools agent_research_start, agent_research_status, agent_research_list, agent_briefing, agent_control over a private Worker-to-Worker service binding — worker models never see the internal key or any Cloudflare token.

Tests: 71 worker + 11 harness passing. Both Wrangler bundles dry-run clean.

v0.3.0 — Per-user OAuth + AMH/WT

-/-\ M H // WT — v0.3.0

Cloudflare Ops MCP now has an OAuth-first public-user model. Every user connects their own Cloudflare account and receives a separate cfops_ connector key. The owner API token is never distributed through Git or MCP clients.

Shipped

• Per-user OAuth connections bound to cryptographically random connection IDs.
• SHA-256 connector-key storage; raw connector keys are shown once and never stored.
• Server-side access-token refresh, authenticated status, and one-user revoke.
• Public callers cannot select another user's tenant/connection.
• Private owner/admin fallback remains backward-compatible.
• 16 guarded Cloudflare tools; mutations remain dry-run until apply: true.
• AMH/WT walrus branding, full setup examples, Privacy, Terms, Security, and AI-readable docs.
• v0.4 roadmap for the AMH stateful agent middle layer, Cache Guardian, Change Guardian, Playwright UI tests, and allowlisted Wrangler operations.

Verified

• 60/60 automated tests passing.
• Redacted local-token leak scan passing.
• npm pack --dry-run passing with 35 release files.
• Wrangler production dry-run passing: 92.32 KiB upload / 25.59 KiB gzip with the OAuth KV binding detected.

Hosted rollout status

The source/self-host release is complete. The existing cfops.nothingunseen.com edge currently still reports v0.1 because that domain is owned by a Cloudflare account not available in the active local Wrangler profiles. Deploy v0.3.0 only after authenticating Wrangler to the account that owns nothingunseen.com; this avoids overwriting or creating resources in the wrong account.