Progress

Current Status

This repository now contains a runnable Cloudflare Workers prototype for a bounded prepaid edge runtime and micro-worker marketplace, with local authoring, staged catalog release gates, Tempo/MPP payment integration, and inspectable ops flows.

Milestones Completed

Runtime + API MVP

• Scaffolded the Workers TypeScript app with wrangler, typescript, vitest, and schema validation.
• Implemented the public API surface for workers, previews, runs, results, artifacts, demos, package schemas, publishers, catalog management, and close ops.
• Added a bounded execution engine with cooperative CPU metering, artifact limits, binding allowlists, and explicit budget enforcement.
• Added sample workers: repo-summarizer and json-transformer.
• Added a Dynamic Workers-shaped dispatch contract and execution backend mode so the control plane can route runs through a serializable dispatch envelope while local development still uses an in-process dispatcher.
• Added a separate execution-target worker entrypoint and fetch-based remote execution target path so the control plane can execute runs through a real service-boundary request instead of only in-process dispatch.
• Added a dedicated execution-sandbox worker entrypoint plus dispatch-namespace execution path so remote dynamic-worker-dispatch runs can cross both the execution-target boundary and the isolated sandbox-worker boundary.

Pricing, Receipts, and Persistence

• Implemented fixed-point money accounting in micros.
• Added preview quotes, budget reservation, metered settlement, and signed run receipts.
• Added schema validation for manifests and receipts.
• Added local persistence with a Durable Object-backed state store and a memory fallback.
• Added optional R2-backed external blob storage for run artifacts and attested code-package bodies, plus a D1 runtime index that mirrors runs, receipts, artifacts, catalog metadata, publishers, and audit events for queryable history.

Tempo / MPP Integration

• Added a stub payment rail that preserves the final Tempo/MPP flow shape.
• Added real tempo-session verification with mppx/server.
• Added inspectable 402 responses and settlement metadata.
• Added deferred close state tracking, sweep endpoints, cron support, and ops inspection routes.
• Added a dedicated service payee bootstrap flow and a canonical payee env file for shared local Tempo setup.

Catalog, Publishers, and Packages

• Added persisted catalog records with manifest versioning, visibility, and status controls.
• Added publisher onboarding, self-service tokens, code artifact attestation, and publisher-owned worker publishing.
• Added signed mpp-code-package support with schema/version metadata, signature checks, compatibility validation, and author tooling.
• Added package templates, package build/validate endpoints, and the local publisher studio.
• Added staged publish gates and release flow for publisher-owned versions, including lint/policy/compatibility/dry-run checks, explicit draft / ready / blocked / live release stages, promotion gates, and version re-check endpoints.

Ops + Demo Tooling

• Added /demo for local paid-flow walkthroughs.
• Added /ops and protected close-ops routes with bearer auth.
• Added scheduled close sweeps and manual reconcile endpoints.
• Added the first lean-runtime CLI flow with init, provision, deploy, secret set, and doctor, including generated Cloudflare config templates for the control plane, execution target, and execution sandbox worker plus Dynamic Workers-shaped environment checks.
• Added real Cloudflare-facing lean-runtime CLI flows for login, remote dispatch-namespace provisioning, remote secret sync, and deploy-time secret syncing across the control plane, execution target, and execution sandbox worker.
• Extended lean-runtime provisioning so it now creates the runtime D1 database, artifacts R2 bucket, code-packages R2 bucket, and execution dispatch namespace, then writes the provisioned D1 database id back into the generated Wrangler config.
• Added a first production-hardening pass with constant-time bearer checks, persisted audit events, request rate limits for expensive/admin routes, retention cleanup, /ops/audit, and /ops/maintenance.
• Added lean runtime private-worker routes with staged private publish, explicit deploy, staged version updates, and rollback flow via /runtime/private-workers/*.
• Added a runtime-first package authoring flow for lean private workers with /runtime/studio, /runtime/package-templates, /runtime/code-packages/build, /runtime/code-packages/validate, and /runtime/code-artifacts, including manifest-ready publish hints after upload.
• Added retention/export controls with persisted retention overrides, run/artifact/receipt pruning, and ops exports for runs, receipts, audit events, and private-worker inventory via /ops/retention, /ops/exports/:type, and /ops/maintenance.
• Expanded the ops surface into a broader control-plane console with filtered /ops/audit, new /ops/runs and /ops/private-workers endpoints, recent-run/private-worker rollups in /ops/summary, and a richer browser dashboard at /ops.
• Prepared the project for public alpha packaging with a real npm bin entrypoint, MIT licensing, a clean .env.example, a public README quickstart, and a packaged CLI smoke test that exercises init -> provision -> deploy -> doctor.
• Added a product profile map for keeping multiple product experiences in one repo, covering Runtime Core, Paid Tool Gateway, Streamed Session Runtime, Priority Lanes, and the later Marketplace Layer.
• Shipped the first Paid Tool Gateway slice on top of the lean runtime core, including /tools and /tool-runs public routes, /tools/studio and /tools/private-tools authoring routes, tool-native response shaping, and CLI profile support via mpp-runtime init --profile tools.
• Made the Paid Tool Gateway profile more first-class with one-shot capability tickets via /tool-tickets, tool-specific ops aliases and exports via /ops/tool-runs, /ops/tools, and /ops/tool-tickets, plus a profile-aware ops console for tools.
• Shipped the first Streamed Session Runtime slice on top of the lean runtime core, including /sessions/preview, /sessions, /sessions/:sessionId, /sessions/:sessionId/events, and /sessions/:sessionId/close, plus stream-profile CLI init support, /ops/sessions, and session exports.
• Shipped the first Priority Lanes slice on top of the lean runtime core, including /lanes, /lane-auctions, /lane-runs/preview, /lane-runs, lane-specific ops aliases and exports, and lanes-profile CLI init support.
• Shipped the first Batch Jobs slice on top of the lean runtime core, including /batches, /batch-runs/preview, /batch-runs, /batch-runs/:batchRunId/events, parent plus child batch run records, sequential multi-item batch execution with aggregate receipts, batch-specific ops aliases and exports, and batch-profile CLI init support.
• Made Batch Jobs safer and more production-shaped with replay-safe batchRequestId / Idempotency-Key submits, stable itemId support, per-item retry policies, per-attempt child runs, and batch event trails that show retry scheduling explicitly.
• Shipped the first self-hosted Marketplace Layer slice, including /marketplace, /marketplace/discover, /marketplace/items/:itemId, /marketplace/publish, /marketplace/publishers, catalog-backed public discovery payloads, publisher detail routes, and marketplace-profile CLI init support.
• Expanded the Marketplace Layer with a compact transactional item page (Preview Price, Run Now, and tool ticket minting), trust/storefront metadata (release stage, publish checks, attestation, source, and starting-price hints), and optional federated discovery across multiple self-hosted marketplace instances via MARKETPLACE_INDEX_SOURCES.
• Added local proxy item and publisher detail pages for federated marketplace sources, so remote listings can still be browsed inside one self-hosted marketplace shell before handing off to their underlying runtime/tool/session/lane routes.
• Extended federated marketplace flows with same-origin proxy checkout and follow-up routes, so remote listings can preview, run, mint tool tickets, and fetch result/session payloads through local /marketplace/items/* routes instead of bouncing users straight to remote profile endpoints.
• Added marketplace trust, reputation, and economics overlays for local and federated listings, including publisher badges, run counts, payout summaries, last successful publish signals, and publisher earnings views.
• Added federated marketplace source controls with allowlist/denylist behavior, per-source cache TTLs, sync/health tracking, and optional signed metadata verification via MARKETPLACE_METADATA_SECRET plus per-source metadataSecret.
• Polished the self-hosted CLI onboarding flow with generated .mpp-runtime/GETTING_STARTED.md guides, profile starter payloads under .mpp-runtime/starters/, richer doctor checks, and deploy preflight validation that stops early with actionable next steps when provisioning or secrets are incomplete.
• Added a production-safety pass for self-hosted deployments: mpp-runtime secret bootstrap now mints strong local auth/execution secrets, deploy preflight rejects placeholder or weak required secrets, doctor warns when privileged routes are left unprotected, and marketplace federation downgrades unsigned “trusted” sources to unverified.
• Added a launch-grade example pack under examples/profiles/ with copy-paste preview/run/publish JSON for runtime, tools, stream, lanes, batch, and marketplace, plus safer federated marketplace source config and onboarding-guide links back to those examples.
• Added an explicit config migration path for alpha installs: CLI config schema v1, a new mpp-runtime upgrade command with dry-run support, doctor warnings for legacy v0 workspaces, and an UPGRADING.md guide for safely regenerating onboarding and Wrangler scaffolding.
• Added a reusable GA-style release gate with bun run release:check, a committed CHANGELOG.md, a maintainer-facing RELEASE.md, a clearer profile-choice section in the README, and a release-readiness test so docs, packaging, and ship-time smoke checks stay aligned.

Tempo Findings So Far

• The original server-side close failure was NotPayee(), caused by signing close transactions from an access-key address that did not match the payee/recipient.
• That was fixed by creating a dedicated service payee EOA and configuring the runtime to sign close calls from that same recipient address.
• After that change, close attempts started executing but still failed on Moderato because the runtime was using the payment currency (PathUSD) as the transaction fee token.
• On Moderato testnet, validators currently expect AlphaUSD, and the dedicated payee account currently has AlphaUSD faucet balance but not PathUSD.

Config Note For Mainnet

The runtime now treats payment currency and server transaction fee token as separate settings:

• TEMPO_CURRENCY_ADDRESS
  • The payment/session currency used by the MPP/Tempo challenge and settlement flow.
• TEMPO_FEE_TOKEN_ADDRESS
  • The fee token used by server-submitted Tempo transactions such as session close or settle follow-up actions.

Current testnet default:

• TEMPO_CURRENCY_ADDRESS=0x20c0000000000000000000000000000000000000 (PathUSD)
• TEMPO_FEE_TOKEN_ADDRESS=0x20c0000000000000000000000000000000000001 (AlphaUSD)

Before mainnet deployment, review and update both values explicitly for the target Tempo network rather than assuming the payment currency is also the correct fee token.