Feed today
Feed serves digital-signage feed APIs and workspace analytics. Its fourteen published operator actions cover widget, observed analytics, reporting, protected device credential assignments, source fetch attempts, canonical archival and privacy. Device-facing ingestion and playback routes are separate from these published CLI/MCP actions.
Resolve a granted workspace
Auth owns canonical workspace identity, creation, rename and default selection. Feed keeps an identity-only mirror for foreign-key parents. Workspace console routes may insert that mirror before checking their route permission, so their GET actions require confirmation in the published action contract.
Review engagement without overclaiming completeness
Analytics windows use inclusive Unix milliseconds and SQL LIKE media patterns. Observed devices are capped at 1000 without pagination. Credential assignments do not necessarily have observation rows. Digest and anomaly checks can persist new records per invocation; notification delivery needs independent proof.
Register a source and inspect its fetch result
Registration encrypts name and endpoint in staging and production; development stores them without encryption. It creates a new record. Sync performs a no-redirect HTTPS fetch, consumes up to 1048576 bytes, discards the body and records the terminal run. HTTP 200 can contain failed. Completed is not content import, playback configuration or device delivery.
Rotate credentials deliberately
Rotation replaces the protected assignment credential hash and returns a one-time response. An unassigned id can receive an assignment without an observed device row. Handle CLI/MCP protected secret references through the supported flow; device installation and an accepted subsequent event must be verified separately.
Understand archive and privacy scope
Workspace archival refuses six nonempty Feed tables and delegates the canonical decision to Auth before removing the mirror. Organization privacy export and erasure span all local organization stores. Erasure is sequential across D1 and KV, retains global configuration, encryption keys and a hashed receipt for 2557 days, and does not erase Auth identity or external backups. Internal protection diagnostics are environment-wide.
Use source-bound worked examples
Discover the exact action and granted resource, validate input, inspect the unchanged plan, authorize its effects, execute and verify its documented response. Examples use synthetic Auth/grants, in-memory stores and simulated external transport. Native structured guidance is stored separately from the human Markdown body.
Action reference
Evidence
Actual Feed Worker response using synthetic Auth, workspace grants, in-memory D1/KV and simulated source/notification transport. No live provider, encryption audit, device enrollment or external delivery is established. Credentials are excluded or explicitly redacted. SQL result shapes are also reviewed against migrations and handlers; empty captures do not exercise every populated export store. Live publication and read-back are separate environment evidence.