Protected static and Worker previews
Editable Mermaid source · All ten diagrams.
Static output
Passing approved exact-source tests can publish a bounded Artifacts directory into private R2. The dedicated Preview Worker receives only a broker binding; it does not receive broad D1/R2/Artifacts/provider credentials. Access checks identity, then Golf verifies current repository access and lease validity.
Managed Worker applications
Workers for Platforms dispatches the bounded approved module profile. Per-preview D1, R2 and Secrets Store signing material are isolated from production. The Outbound Worker denies unapproved Internet access. Custom domains and TLS are part of admission; alternate endpoints cannot bypass protection.
Arbitrary dependencies, bindings, application cookies/WebSockets and universal app QA remain outside this profile. Optional Browser Run captures script-free static HTML, not a complete interactive test.
Repository preview policy
The native environment slice supports one environment named preview, enforcing allowed branches, maximum lifetime and concurrency when publishing or renewing previews. Hosted checks exercised branch refusal, stale-version refusal and count limits. Renewal, automatic previews and app previews under policy retain separate acceptance; changing policy does not yet revoke every existing nonconforming preview.
Maintenance purges expired previews. The retained account had Cron delivery failures; Workspace alarms provide a fallback after the object is active. Read Operations and the actual preview state rather than assuming a stale READY row is still served.
Merge and production boundary
Native first-slice merge commits require a same-repository PR with base already an ancestor of head. Squash, divergent tree merges, forks, drafts and locked targets are refused. Preview readiness does not authorize merge or production promotion. Broad protected publication, rollback and arbitrary production CD remain open.