test/ covers journal.test.ts, auth.test.ts, generate.test.ts, tools.test.ts, promote.test.ts, but nothing exercises src/worker.ts directly: the /mcp route check (404 elsewhere), the 401-before-KV-touch gate, bearer token extraction (case-insensitivity, malformed header), and the Cache-Control header set on responses. These are exactly the two-layer-auth guarantees CLAUDE.md calls a hard rule ("Two tokens, two scopes... Read token must never reach write tools"), so the layer enforced in worker.ts itself is currently unverified by any automated test.
test/ covers journal.test.ts, auth.test.ts, generate.test.ts, tools.test.ts, promote.test.ts, but nothing exercises src/worker.ts directly: the /mcp route check (404 elsewhere), the 401-before-KV-touch gate, bearer token extraction (case-insensitivity, malformed header), and the Cache-Control header set on responses. These are exactly the two-layer-auth guarantees CLAUDE.md calls a hard rule ("Two tokens, two scopes... Read token must never reach write tools"), so the layer enforced in worker.ts itself is currently unverified by any automated test.