“Worker V5.8.8 of the DEMI Registry demi-proxy (Cloudflare Worker, deployed 13 October 2026) fixes AI package section D formatting, adds a CAPSULE_URL default and an OpenAI domain-challenge endpoint, while preserving byte-identical registration code from V5.8.7.”
PropositionsT1: Read-only MCP server at POST /mcp using stateless Streamable HTTP and JSON-RPC 2.0, no authentication, public data only | T2: Five MCP tools (get_ai_package, get_record, lookup_record, verify_fingerprint, list_children), all marked readOnlyHint, sealed/hidden records return public minimum only | T3: lookup_record accepts UPL code, file SHA-256 or Ethereum transaction hash | T4: verify_fingerprint checks hash only, never the file, covering main and other fingerprinted files | T5: GET /registry/{UPL}/children lists later stages; index.json and lookup supply all addresses so no assistant constructs one itself | T6: CAPSULE_URL defaults to ramsmile.com/demicapsule | T7: GET /.well-known/openai-apps-challenge serves the OpenAI domain token | T8: GET /mcp returns 405
ConstraintsCloudflare Worker runtime | JSON-RPC 2.0 over stateless Streamable HTTP | No registration, payment or record-mutation operations permitted | No API keys required by callers | Registration code byte-identical to V5.8.7 (UPL-TECH-26-294654-EN) | Anchored index unchanged | Basis for DEMI Capsule plugin v1.0.5 (UPL-TECH-26-144456-EN), currently under directory review
MechanismsT1: Send POST /mcp with a valid JSON-RPC 2.0 request; confirm stateless response and no auth challenge | T2: Call each of the five tools and confirm readOnlyHint flag and correct public-minimum response for sealed/hidden records | T3: Call lookup_record with each of the three input types and verify correct record returned | T4: Call verify_fingerprint with a hash and confirm file content is never requested or returned | T5: Call GET /registry/{UPL}/children and confirm all address fields (page, record, AI package, certificate, children) are present without manual construction | T6: Check CAPSULE_URL environment variable absent or empty and confirm default resolves to ramsmile.com/demicapsule | T7: GET /.well-known/openai-apps-challenge and confirm OpenAI domain token in response | T8: GET /mcp and confirm HTTP 405 returned — all five tools verified locally and live via Claude custom connector on 13 October 2026
BoundariesCannot register records, process payments or mutate any registry data | No authentication or key management for callers | Anchored index structure is not modified in this version | OPEN: rate limiting strategy not defined; index migration from single KV key to a database not yet implemented; owner-key check for the Vault not yet built