Beta readiness

WiseWig is progressing toward a self-hosted beta, not yet a declared beta. Workers for Platforms and the hosted multi-tenant isolation drill moved to managed-isolated v2. They no longer block beta. The release gate is a deployed Cloudflare full profile that completes the agency scaffold/theme/edit/publish/plugin/AI handoff workflow without a Workers for Platforms entitlement.

Implemented beta scope

“Complete locally” means implementation, focused unit tests, real-workerd boundary tests where the platform supports local simulation, browser acceptance, generated binding checks, AI-readable documentation, and production-shaped dry-run bundles are committed. It does not substitute for the deployed self-hosted gate.

Current release evidence

The current candidate passed locally:

• 331 unit tests across 74 files;
• 19 tenant-workspace, 7 tenant-user, 3 plugin-sandbox, and 2 public-MCP real-workerd tests;
• 5 Chromium agency-site/editor/extension workflows;
• all 20 checked workspace TypeScript/Astro projects;
• all Worker and Astro builds/dry runs;
• the Morning Bell self-hosted full template prepare plus all five Worker dry-run bundles; private MCP reports TENANT_WORKSPACE and no dispatch namespace. The account-specific doctor now blocks unresolved OAuth deployment values.

The earlier managed-isolated Astro binding report contains only Astro-owned SESSION, IMAGES, and ASSETS, the exact TENANT_DISPATCH service, and WISE_WIG_DEPLOYMENT_MODE. Shared platform/tenant data and secrets are absent. That evidence is retained for v2 rather than used to declare beta.

The first real self-hosted deployment checkpoint created isolated wise-wig-beta-* D1/KV/R2/Queue resources, applied all eight D1 migrations, deployed the non-public plugin artifact Worker, and deployed the tenant workspace without optional plugins plus the anonymous public MCP Worker. A live MCP initialize returned the WiseWig public server capabilities and the Cloudflare trace completed without exceptions. Full tenant-workspace deployment with PLUGIN_LOADER was rejected with Cloudflare code 10195 because the test account is still on Workers Free. Analytics Engine was also unavailable; it is now optional in generated self-hosted configurations and guarded at runtime. Site/private-MCP deployment remains intentionally stopped because the local descriptor contains a pending OAuth client rather than production credentials.

Remaining beta gates

1. Run deployed full-profile acceptance for the EmDash bridge. Tenant-derived grants, signed executable binding, storage, published-page reads, plugin-owned content CRUD, media upload/delete, allowlisted HTTP policy, and after-publish lifecycle dispatch pass locally in real workerd. Add an upstream-published fixture when the experimental registry exposes a stable one. The optional AI/MCP sidecar must remain fail-closed and unable to broaden the EmDash trust contract.
2. Upgrade the beta account to Workers Paid, supply a real OAuth application for the site and private MCP callback origins, then prepare, diagnose, dry-run, and deploy the self-hosted Cloudflare full profile. The generated private MCP Worker must contain TENANT_WORKSPACE and must not contain TENANT_WORKERS or any dispatch namespace.
3. Run the five-page agency workflow against the deployed site, including extension login, draft editing, assets, publish, plugin lifecycle, public MCP data minimization, private MCP role filtering, and cross-tenant/object-name substitution attempts.
4. Record redacted evidence, rerun all repository gates from the exact commit, and tag beta only after every item passes.

Use wise-wig cloudflare self-hosted preflight --operator <name> --public-mcp-url https://…/mcp for the deployed receipt. It inspects current Worker versions and records stable outcomes only. The current account dry run correctly reports the valid plugin-artifact/public-MCP deployments, the AI-profile workspace capability mismatch, absent site/private-MCP Workers, pending OAuth configuration, and a successful live public-MCP initialize. This is expected failed evidence, not a beta receipt.

The previous Workers for Platforms entitlement failure is no longer a blocker. The guarded drill and evidence tooling remain as the managed-isolated v2 drill; do not weaken that future topology to create a shared managed tier.

Beta declaration checklist

• AI/MCP scope is schema-driven, authorized, attributable, reversible, and public/private separated.
• EmDash packages pass validation, publisher proof, checksums, ingestion, AI/MCP non-escalation, isolated execution, tenant grants, supported storage/content/media/HTTP bridging, lifecycle dispatch, and deployed full-profile acceptance.
• Self-hosted private MCP uses the OAuth-pinned tenant Durable Object and has no Workers for Platforms dependency.
• Managed-isolated v2 capability stripping and per-tenant execution remain fail-closed and separate from beta.
• Local two-tenant and archive/restore gates pass.
• Guarded read-only managed-isolated v2 preflight and sanitized evidence receipts are tested and documented.
• The complete deployed self-hosted full-profile workflow passes and its receipts/output are recorded in release evidence.
• The tested commit is tagged as the beta; docs and marketing are changed from candidate/alpha language only after that tag.

Non-blocking post-beta work

• Publish the repository-local CLI as a standalone package.
• Move the legacy hosted-provider UI into a separately authenticated operator/platform application.
• Add automatic custom component/theme package discovery without weakening the closed schema boundary.
• Add richer guided controls and notification adapters on top of the stable structured CMS contracts.
• Add the optional Node/workerd runner after the Cloudflare Dynamic Workers runner, with explicit documentation and tests for its weaker standalone CPU/memory enforcement.