feat(control-plane): stand up the real HTTP transport as a Cloudflare Worker

[JSONbored]

Summary

Closes #7654

• Implements the exact routes packages/loopover-miner/lib/tenant-client.ts (already merged) hardcodes: POST /v1/tenants ({name, product}), GET /v1/tenants ({tenants: [...]}), DELETE /v1/tenants/:name — Bearer-authenticated against a single ADMIN_TOKEN secret.
• Adds a KV-backed tenant registry: TenantProvisioningDriver has no enumeration concept by design (create/destroy/exists are all per-tenant), so GET /v1/tenants needs its own durable inventory. Stores only name/product/lifecycle state/timestamps — never a tenant's database connection details (that's a credential, not admin-visible inventory).
• Not idempotent by design (matching tenant-client.ts's own doc comment: "a create is not idempotent, so it must not be silently re-sent"): recreating an already-active tenant is a 409; deleting an unknown one is a 404, not a silent no-op. A torn-down tenant may be recreated.
• Never echoes a tenant's database credentials on the wire, even though provisionTenant's result carries them (Real Postgres/Hyperdrive driver for control-plane's provisionDatabase/deprovisionDatabase #7653) — properly distributing those is Real secret-injection driver for control-plane's injectSecrets/revokeSecrets via the generalized broker #7852's job (the generalized secret broker); this transport doesn't create a new place for them to leak in the meantime.
• Deploys as a real Cloudflare Worker (wrangler.jsonc, nodejs_compat enabled so the existing Node-oriented auth.ts/provisioning.ts/pagerduty-notify.ts modules — node:crypto's timingSafeEqual, Buffer, process.env — work unmodified inside it). This is deliberately the deployment target Real Cloudflare Containers driver for control-plane's createContainer/destroyContainer/containerExists #7851's real Container/Durable-Object driver will extend next, rather than standing up a second, separate Worker just for that piece (control-plane had zero Cloudflare bindings before this PR).

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• Focused on Stand up control-plane's real HTTP transport (POST/GET/DELETE /v1/tenants) matching the already-merged client #7654's transport/routing layer only — works against whichever driver is currently configured (fake by default, real Neon driver if NEON_API_KEY/NEON_PROJECT_ID are set); does not implement real container creation (Real Cloudflare Containers driver for control-plane's createContainer/destroyContainer/containerExists #7851) or secret injection (Real secret-injection driver for control-plane's injectSecrets/revokeSecrets via the generalized broker #7852), both separate pieces.
• Owner-authored infra PR (admin-authenticated tenant create/destroy surface — structurally not a first-pass contributor task, per Stand up control-plane's real HTTP transport (POST/GET/DELETE /v1/tenants) matching the already-merged client #7654's own boundaries).

Validation

• git diff --check
• npm run typecheck (root)
• npm run control-plane:test — 82/82 passing (node --test).
• npm run control-plane:coverage — 100% line/branch/function coverage on every file this PR touches or adds; the only residual gap (settlement-backend-driver.ts) is pre-existing and untouched by this PR.
• npm run cf:typecheck (Workers-runtime typecheck for worker.ts against @cloudflare/workers-types + node types together, since nodejs_compat genuinely provides both).
• npx wrangler deploy --dry-run from control-plane/ — resolves the KV binding and both vars correctly.
• npm audit --audit-level=moderate — pre-existing ambient advisories only (confirmed identical to what already exists in the already-merged packages/discovery-index using the same wrangler version range); this PR's own new dependencies (hono, wrangler, @cloudflare/workers-types) introduce nothing new.
• New behavior has unit tests for every branch: auth (missing config, missing/wrong token), every validation failure, the not-idempotent create-conflict, delete-of-unknown-tenant, the onError 500 path, KV pagination (including a key disappearing between list() and get()), and an explicit check that database credentials never appear in any response body.

Safety

• No secrets, tokens, or credentials committed anywhere — ADMIN_TOKEN/NEON_API_KEY/PAGERDUTY_ROUTING_KEY are declared in env.d.ts as wrangler secrets, never given real values in this repo.
• No visible UI changes.

Notes

Follow-up infra work on top of #7180 (provisioning core) and #7653 (the Neon database driver this transport can select at runtime). Once this merges, #7851 (real Cloudflare Containers + Durable Object driver) becomes the next piece, extending this same Worker deployment rather than a new one.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.86%. Comparing base (fa3581d) to head (056f79e).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #7960       +/-   ##
===========================================
+ Coverage   67.32%   91.86%   +24.53%     
===========================================
  Files         735      738        +3     
  Lines       75458    75677      +219     
  Branches    22954    23004       +50     
===========================================
+ Hits        50803    69519    +18716     
+ Misses      20857     5080    -15777     
+ Partials     3798     1078     -2720     

Flag	Coverage Δ
control-plane	99.71% <100.00%> (+0.07%)	⬆️
shard-1	58.68% <ø> (ø)
shard-2	46.75% <ø> (?)
shard-3	56.40% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
control-plane/src/auth.ts	100.00% <100.00%> (ø)
control-plane/src/http-app.ts	100.00% <100.00%> (ø)
control-plane/src/index.ts	100.00% <100.00%> (ø)
control-plane/src/tenant-registry.ts	100.00% <100.00%> (ø)

... and 410 files with indirect coverage changes

[loopover-orb]

Warning

⏸️ LoopOver review result - manual review recommended

_{Review updated: 2026-07-22 00:16:21 UTC}

17 files · 1 AI reviewer · 1 blocker · CI green · clean

⏸️ Suggested Action - Manual Review

Review summary
This PR stands up the real HTTP transport for control-plane's tenant-provisioning API as a Cloudflare Worker, implementing the three routes tenant-client.ts already hardcodes, backed by a new KV-backed tenant registry with pagination. The route logic (auth middleware ordering, 409-on-active/404-on-unknown/allow-recreate-after-teardown, never echoing DB credentials) is correct and well-tested via Hono's app.request() against injected fakes. The build correctly splits worker.ts into its own tsconfig/coverage exclusion since it can only be exercised by real Workers/KV infra, mirroring discovery-index's established pattern.

Nits — 7 non-blocking

• The 'leaked secret' flag at control-plane/test/http-app.test.ts:16 (`const ADMIN_TOKEN = "admin-token-value"`) is a test fixture constant, not a real credential — no action needed, but worth confirming the scanner's rule doesn't need a test-file exclusion.
• control-plane/src/http-app.ts uses raw numeric status codes (503, 401, 400, 409, 201, 404) throughout; consider named constants if this file grows more routes, though it's consistent with discovery-index's own style today.
• control-plane/src/http-app.ts:82's DELETE handler nests to depth 5 (route handler → upsert call → object literal); this is a shape artifact of Hono's async handler signature, not a real complexity problem worth restructuring.
• The onError handler at http-app.ts:53 uses console.error with structured JSON — matches discovery-index's convention, but confirm this repo has a policy on structured logging vs. a shared logger before more services duplicate it.
• The registry's `list()` in tenant-registry.ts fetches every value with `Promise.all` per page — fine at expected tenant counts, but note KV's 1000-key-per-page cap doesn't bound total tenants if this ever needs to scale past a few thousand.
• Diff is mostly generated, vendored, or minified output — Exclude generated, vendored, and minified output and keep the diff focused on substantive changes.
• Possible secret-shaped assignment in the diff (generic_secret_assignment) — Verify the value is not a real credential.

Concerns raised — review before merging

• Patch-less file(s) could not be fully scanned for secrets (1): GitHub omitted inline diff for: control-plane/worker-configuration.d.ts. Fetched content exceeded the 512000-char scan cap or could not be retrieved completely, so leaked-secret verification is incomplete. Shrink the change, split the file, or ensure the diff is reviewable before merge. — Ensure patch-less files are within scan limits or split the change so secrets can be verified.

📋 Copy for AI agents — paste into your coding agent

Fix the following blocker(s) from this PR review:

1. Patch-less file(s) could not be fully scanned for secrets (1): GitHub omitted inline diff for: control-plane/worker-configuration.d.ts. Fetched content exceeded the 512000-char scan cap or could not be retrieved completely, so leaked-secret verification is incomplete. Shrink the change, split the file, or ensure the diff is reviewable before merge. — Ensure patch-less files are within scan limits or split the change so secrets can be verified.

Decision drivers

• ❌ Code review — 1 blocker (1 reviewer)
• ❌ Gate result — Blocking (Repo-configured hard blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#7654
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 21 registered-repo PR(s), 14 merged, 284 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 21 PR(s), 284 issue(s).
Improvement	✅ Minor	risk: low · value: minor

Linked issue satisfaction

Addressed
The PR adds a Hono-based HTTP app implementing POST/GET/DELETE /v1/tenants exactly matching tenant-client.ts's contract, with Bearer auth via auth.ts, a wrangler.jsonc deployable config, and tests (http-app.test.ts) covering all three routes against the fake driver.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, TypeScript, Ruby, Go, JavaScript, MDX, Shell, Solidity
• Official Gittensor activity: 21 PR(s), 284 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Start here: Treat this as maintainer-lane context rather than normal contributor-lane activity.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review