# alfred.report — agents
# Content-Type: text/plain. Not a webpage. That is the point.

# Humans
If you can read this in a browser: you took the Agents door.
Leave: https://alfred.report/humans
This file is for machines.

# Law
Kingdom: OpenRoyleAl
Law: Command OS
Operator: ORAL
Evidence in. Bounds. Report out.

# Discovery
https://alfred.report/llms.txt
https://alfred.report/llms-full.txt
https://alfred.report/api/openapi.json
https://proxy.alfred.report/

# Proxy (alfred-proxy) — lease hide.me WireGuard exits worldwide
# Parent: alfred.report · Configs: Iceberg CF Secrets Store (HIDEME_WG_*)
# Auth: Authorization: Bearer <ALFRED_OPS_TOKEN>
#
# Canonical broker:
#   GET  https://proxy.alfred.report/health
#   GET  https://proxy.alfred.report/status
#   POST https://proxy.alfred.report/lease
#   POST https://proxy.alfred.report/release
#   GET  https://proxy.alfred.report/usage
# Mirrored on main (same auth):
#   https://alfred.report/api/proxy/status|lease|release|usage
#
# Lease:
#   POST /lease
#   {"holder":"<agent-or-job-id>","harness":"<runner>","purpose":"<why>","region":"us-detroit"}
# Release when done:
#   POST /release
#   {"holder":"<agent-or-job-id>"}
#
# Regions: us-detroit us-nyc us-chicago uk-london ph-manila sg-singapore nl-amsterdam de-frankfurt au-sydney
# Always lease before tunnel. Always release after. TTL default 900s.
# Response includes wireguardConfig from Secrets Store — do not cache private keys.

# Facts
Runtime: Cloudflare Workers
Auth proxy: ALFRED_OPS_TOKEN bearer
Auth humans: board / Access
Auth agents (MCP/ORAL): CF Access service token or ops bearer