[AnthonyRonning]

Add independent Agent update delivery: an Agent-only Worker serves signed metadata, enumerated immutable artifacts, download redirects and byte ranges from its own R2 binding. The protected manual publisher verifies exact trusted-master Prod package producers, final downloaded-package consumers, workflow/source attestations, package identity and hashes before reservation, signing and publication stages. Credentialed Agent jobs reuse the existing updates-production environment and existing BWS access credential, following the pinned PCR action pattern with set_env: false; only the consuming step maps fetched values. No new environments, machine accounts or tokens are required. Underlying BWS grants and the shared environment secret context remain trusted.

Research's Worker, publisher, feed, clients, signing environment/policy and downloads remain unchanged. Agent publication creates no GitHub Releases or tags. Linux is omitted by default and requires its own packaged launch/update gates; this PR remains independent of #1212.

The publisher verifies current-pointer signatures with real minisign for either raw or commented public-key files. Identical retries compare immutable object bytes before writing locked keys; missing objects still use create-only writes and races require exact-byte equality. Different bytes, permission failures and storage errors fail closed. Pointer promotion remains conditional and monotonic. Private audit sidecars and exact-byte reservations make partial and already-promoted attempts retryable.

Validation at c40d3364 (bucket-binding follow-up to 8b5181d4):

• 94 publisher tests, including real minisign existing-pointer/rotation/retry regressions and 14 deterministic R2 transport/signing tests with independent signature vectors, bounded streaming, conditional headers, errors and redirect refusal.
• 7 workflow contracts, 10 Worker/workerd tests, formatting, TypeScript and pinned Wrangler dry run; 12 hook-selector tests.
• gh and jq run inside pinned Nix during preparation. Profile/release-info changes select delivery validation.
• At 8b5181d4, full local root nix flake check --no-update-lock-file passed for aarch64-darwin and the normal hook passed actionlint plus all 499 repository script tests. Signing-boundary, Agent-workflow, Nix-workflow and selector tests passed; standalone ShellCheck passed all 12 publisher run blocks.
• The final bucket-binding change passed the full Agent delivery gate again: 7 workflow contracts, 94 publisher and 10 Worker/workerd tests, formatting/types and fixture-only Wrangler dry run. Repeated full-flake/normal-hook checks were bounded and stopped on an unchanged host-specific iOS setup fixture; the final signed commit skipped that duplicate hook. No Research fixture was changed.
• Independent reviews found no actionable issue in either the credential-wiring or final bucket-binding change. Previous implementation-head hosted Agent Update Delivery Tests and Repository CI passed; the final head starts fresh hosted validation. No package/update signing was performed.
• An owner-authorized private-bucket probe used the real publisher R2Store and immutable_put with the bucket-scoped S3 pair: identical locked-object retries, missing-object creation, differing-byte refusal, streaming hash/HEAD/range, successful pointer CAS and stale-ETag 412 preservation all passed. Direct overwrite/delete of locked objects returned 409 ObjectLockedByBucketPolicy with bytes preserved; an unrelated bucket denied access with 403. The real latest pointer was untouched. This proves bounded transport/lock/CAS interoperability, not full manifest publication or an installed update.

Delivery remains inactive. The owner provisioned the private maple-agent-updates R2 bucket, disabled public bucket endpoints, configured the immutable-release lock and stored the bucket-scoped publisher credentials in existing BWS infrastructure with Agent-specific inputs in the existing updates-production environment. The checked-in binding now names that bucket; local checks still substitute a separate fixture. Routes stay owner-managed outside routine deploy configuration, and empty source pins still block publication. No Worker/route deployment, release, publication or PR merge was performed; Research configuration is unchanged. Full locked-prefix manifest/publication retry rehearsal, narrowly scoped Worker deployment with its R2 binding, routing independence in both directions, and the signed installed 0.0.1 → 0.0.2 rehearsal remain activation gates before invitations.

[github-actions]

Maple development preview: https://038b3c34.maple-ca8.pages.dev

Commit: c40d33644c145eeee1a74d74995021a4768c06dc

Uses development API, billing, flags and PCR configuration. Cloudflare Access applies.

[github-actions]

Maple Auth development preview: https://e675ea15.maple-auth-dev.pages.dev

Commit: c40d33644c145eeee1a74d74995021a4768c06dc

Uses development services. Cloudflare Access applies. Provider OAuth is not configured for PR URLs; use the stable Auth Dev host for OAuth rehearsal.