[uscolective-byte]

Summary

Introduce a role-based, bounded helper Worker delegation protocol for Trinity. This is a draft and does not alter deployed Cloudflare services.

• Shared client requestWorkerHelp for callers with a TRINITY_DISPATCHER service binding.
• New trinity-dispatcher Worker routing read-only requests to explicitly configured helper service bindings.
• Shared authenticated helper adapter to integrate in each actual production Worker once its source and binding are known.
• Auth-protected Admin Dashboard endpoints GET /api/workers/capabilities and POST /api/workers/help.
• Node built-in test suite (node --test tests/delegation.test.mjs) and integration instructions.

Safety

No automatic provisioning, no Cloudflare API token storage, no writes/deploys, no arbitrary URLs. Two-hop delegation, size limits and request timeouts. Missing helpers produce helper_not_configured rather than fictitious service creation.

Required before merge/deploy

• Identify actual live fleet and review each Worker source.
• Integrate helper handlers and configure real service bindings and encrypted TRINITY_DELEGATION_SECRET in staging.
• Run tests and Wrangler build/deploy dry-run; tests have been added but not executed here because checkout was unavailable.
• Review and harden existing demo session auth before using the dashboard as production admin API.
• Add durable idempotency/audit/limits before any side-effecting operations.

No production deployment requested or performed.