Public outer transport

Deployed at https://relay.sparrowsystems.co using Wrangler 4.130.0.

Client -> Worker custom domain -> VPC service -> existing Cloudflare Tunnel
       -> parent 127.0.0.1:8080 -> enclave inner TLS

The Worker and its account are untrusted transports. Client secrets remain inside inner TLS authenticated through an independently pinned Nitro measurement. The VPC service fixes one loopback origin; the incoming URL cannot select another host/port. The Worker forwards allowed GET paths and query bytes without logs, cache access, automatic retries or redirect following. Worker observability, invocation logs, workers.dev and preview URLs are disabled in its configuration.

The custom domain provisions DNS/certificate routing through the authorized Workers API. Do not add the old proposed direct-tunnel CNAME to this hostname. No zone-wide cache rule is required by this path: the Worker uses no cache and sends no-store headers on all responses. Public retry/cache checks passed. Cloudflare account logging and traffic analysis remain outside this setting's guarantees. Workers/VPC availability and request quotas are additional operational dependencies; VPC is a beta service.

Reproduce from the repository root:

node --test deploy/cloudflare-v2/worker/worker.test.mjs
npx wrangler deploy --config deploy/cloudflare-v2/worker/wrangler.toml --dry-run
npx wrangler deploy --config deploy/cloudflare-v2/worker/wrangler.toml
python3 deploy/cloudflare-v2/smoke.py

The service binding already exists. Its original creation command was:

npx wrangler vpc service create attested-relay-v2-origin --type http \
  --tunnel-id 2f2137bf-c07d-41b9-94f0-276947c38dd6 --ipv4 127.0.0.1 --http-port 8080

The SDK source now identifies itself as attested-relay/2; unchanged PyPI 0.2.0a2 uses Python's generic user agent and encountered an edge 403 during testing. Use the updated source pending a new package release. Current production still warms, so a correctly verifying client must reject application requests.

Public validation. References: custom domains, VPC Service configuration, binding API.