Golf turns Cloudflare’s platform into a Git workspace with executable evidence, optional agents and protected previews. Each service has a specific job.
Active demo reviewed October 14, 2026 · native Artifacts / D1 / Workers
Canonical Git, collaboration, durable orchestration, isolated execution, optional inference and protected delivery.
26 deployed or conditional integration entries, including the supporting controls. “Conditional” identifies optional or incomplete consumer qualification; the live binding review is below.
Serves the shared Golf UI, native APIs, Git brokerage and trusted service entrypoints at custom domains. UI files are embedded in the control Worker.
Current boundary: Full native forge parity, fleet scale and SaaS onboarding remain open.
Provider reference ↗Stores canonical Git objects/refs and independent agent forks; supports clone/push, source/history/diffs and first-slice standard PR merge.
Current boundary: Merge requires same repository and base ancestor of head; no tree merge, squash, protected merge or native repository deletion.
Provider reference ↗Stores identities, grants, collaboration, operation journals, evidence intake, environments, email outbox and encrypted execution values; separate D1 databases back Worker previews.
Current boundary: Recovery, broader authorization matrices and complete repository parity remain open.
Provider reference ↗SQLite workspace authority serializes writes/revocations, admits bounded concurrent reads and coordinates tasks; read shards scale immutable-source reads; alarms run maintenance when Cron stops arriving.
Current boundary: Bounded single-installation qualification, not global scale or provider availability.
Provider reference ↗Runs exact-source approved CI and OpenCode proposals in DO-managed Linux containers with outbound interception and verified destruction.
Current boundary: One approved Actions path or Python module; Internet denied; arbitrary upstream workflows and hostile-repo isolation not qualified.
Provider reference ↗Uses @cloudflare/sandbox Files and SandboxFileError to access container files alongside raw ctx.container execution.
Current boundary: Golf uses raw ctx.container execution. It does not instantiate getSandbox or a Sandbox class.
Provider reference ↗registry.cloudflare.com holds pinned runner images and digest-verified per-job OCI artifacts; trusted Worker brokers short-lived account registry credentials.
Current boundary: Golf brokers provider authority and preserves repository/job approval. Broader image scanning, trust and retention policy remain separate acceptance.
Provider reference ↗Private immutable reports, context/results, read indexes, static previews, screenshots, per-preview app files, release assets and discussion attachments.
Current boundary: Release and attachment slice locally verified; release max 25 assets x 256 KiB, discussion max 100 files x 256 KiB; no attachment replacement/deletion.
Provider reference ↗Buffers evidence IDs into Workflows with durable D1 outbox, bounded retries and reauthorization.
Current boundary: Email/webhook transport currently uses D1 outboxes and maintenance, not Queues.
Provider reference ↗Optional separate queue retains failed evidence deliveries and exposes failure retention.
Current boundary: Provisioning implemented on Alchemy; real dead-lettered delivery not exercised on retained installation.
Provider reference ↗Coordinates authorization, exact-source tests, agent proposals, report publication, previews and cleanup through durable steps.
Current boundary: Bounded concurrency/retention/steps; Workflows coordinate effects but do not grant authority or approve merges.
Provider reference ↗Dispatches isolated PR Worker applications behind the preview gateway, with separate private D1/R2, child hostnames and an outbound-denial Worker.
Current boundary: Only approved prebundled module/schema; arbitrary builds/bindings, app cookies/WebSockets, production promotion and multi-tenant scale remain open.
Provider reference ↗OTP login and approved-email policies gate control/preview domains; service tokens protect machine access; Golf rechecks D1 repository grants and short-lived single-use preview grants.
Current boundary: Access admission does not itself grant repository permission; native account lifecycle and broader identity onboarding remain open.
Provider reference ↗Provides branded control/preview URLs and per-application child hostnames; Email onboarding provisions DKIM/SPF/return-path DNS.
Current boundary: Selected approved zone/hostnames only; customer vanity-domain lifecycle is separate planned Cloudflare for SaaS work.
Provider reference ↗Keeps management/registry/analytics credentials, app signing key, webhook encryption key and execution-value AES-GCM key in trusted bindings.
Current boundary: Secret rotation procedure and approved external-egress broker remain open; job log masking only detects exact secret text.
Provider reference ↗Runs optional metadata review advice on @cf/cloudflare/clef and coding proposals on @cf/zai-org/glm-5.3-flash through trusted brokers.
Current boundary: Advice is metadata-only; proposals change one approved file and are tested in an independent Artifacts fork; per-use-case model selection remains planned.
Provider reference ↗Private authenticated inference gateway disables prompt/response logs and cache, caps 60 requests/minute and configures 500 cents/day.
Current boundary: Rate/spend-limit enforcement not exercised; admin gateway usage UI remains planned; AI remains opt-in.
Provider reference ↗Optional one-dispatch static-preview PNG capture retained privately with digest checks and current-reader authorization.
Current boundary: Enabled in the retained demo, with no completed retained captures at this review. Historical hosted proof covers script-free static HTML only; full interactive QA remains open.
Provider reference ↗Optional sampled evidence-completion counts, report bytes, duration and observed tokens with hashed workspace index and no source/prompts.
Current boundary: Source, build and binding checks passed. Hosted ingestion and SQL readback are unverified. Metrics do not govern billing or quotas.
Provider reference ↗Operations collector reads requests/errors/subrequests from GraphQL with a separate Account Analytics Read credential.
Current boundary: Collection currently fails inside the Worker. The equivalent token/query succeeds externally.
Provider reference ↗Optional sampled logs help diagnose the native deployment alongside local D1 journals.
Current boundary: Provider observability is enabled on the retained demo; logpush is disabled. Wider tracing/export and retention remain separate acceptance.
Provider reference ↗Configured five-minute maintenance for CI intake retry, preview purge, evidence/index reconciliation, webhook/email retries and probes.
Current boundary: Retained account receives no scheduled events; workspace DO alarm supplies maintenance fallback and cause is unresolved.
Provider reference ↗Optional per-network/location approximate throttling protects credential-less public source and clone reads.
Current boundary: Signed-in, credentialed and runner requests are excluded. Limiter errors allow the request. This is not a security quota.
Provider reference ↗Consent-based own-Access-address repository subscriptions receive category-and-link notifications from D1 outbox with rechecks, bounded retries and daily attempt budget.
Current boundary: Retained installation provider acceptance verified; inbox receipt unobserved; bounces/complaints/replies/unsubscribe links remain open.
Provider reference ↗Encrypted repository subscriptions and stable signed deliveries to approved HTTPS receivers; retained Slack test accepted.
Current boundary: D1 outbox/maintenance provides bounded retries, not queue-based email/webhook transport. Receiver/event/retry matrix remains bounded.
Provider reference ↗cf supplies scoped provider discovery, setup/deploy and readback qualification; Alchemy optionally provisions equivalent reviewed native resources.
Current boundary: Alchemy beta and cf beta are deployment dependencies only; private state/journals require careful ownership and teardown inspection.
Provider reference ↗Read-only review on 2026-10-14: active Worker version 44, serving 100% of traffic. This is a dated review, not a live health feed.
Artifacts · D1 · R2 · Workers · SQLite Durable Objects · Containers · Managed image registry · Queues · Workflows · Workers for Platforms · Access · Custom domains and TLS · Secrets Store · Workers AI · AI Gateway · Browser Run · Analytics Engine · Rate limiting · Email Service · Managed observability.
Clef advice · GLM 5.3 Flash proposal with passing tests · Email provider acceptance · Managed registry publication · Exact-commit repository secret release · Protected previews · Native ancestor-base standard merge · Durable Object maintenance fallback.
Full product parity, disaster recovery and SaaS scale remain open.
Clef gives metadata-only PR advice. The maintained agent harness uses Workers AI through AI Gateway to propose an allowed file change on an independent Artifacts fork, then runs approved tests. The retained GLM 5.3 Flash proposal passed.
Authenticated gateway, no prompt/response logging or cache, 60 requests/minute and $5/day configured limit. Limit enforcement is a separate check, not a provider-wide bill cap.
Advice grants no approval. Proposals retain patches and test evidence; neither silently updates canonical Git.
Workers AI embeddings and Vectorize are being added for semantic code/issue search with current-reader access filtering. Search is not deployed yet.
Browse the hosted public repository, ask for private-workflow enrollment, or use the Alchemy recipe in your own account.