{
  "ok": true,
  "data": {
    "service": "CTCL",
    "api_version": "v1",
    "release": "0.1",
    "leap_table": {
      "tai_minus_utc_s": 37,
      "gps_minus_utc_s": 18,
      "as_of": "2017-01-01",
      "note": "Latest known offset, not a live/future-predicting leap table. No leap second has been declared since 2017-01-01 (IERS Bulletin C); verify for high-stakes/scientific use."
    },
    "tzdb": "IANA via the runtime Intl database",
    "source_precision": "millisecond_representation (edge wall clock)",
    "precision_tiers": {
      "coarse": ">= 1 s",
      "standard": ">= 1 ms",
      "high": ">= 1 µs (representation)",
      "ultra": ">= 1 ns (representation)"
    },
    "trust_tiers": {
      "T0": "unknown",
      "T1": "local, unsynchronized",
      "T2": "network-synchronized",
      "T3": "authenticated source",
      "T4": "calibrated authoritative chain"
    },
    "current_trust_tier": "T2",
    "rate_limit_policy": {
      "enforced": true,
      "mechanism": "cloudflare-workers-ratelimit (approximate per CF design)",
      "anonymous_per_min": 120,
      "scope": "/v1/* per IP",
      "note": "§38; every /v1/* call passes the native limiter (429 on reject) + edge/DDoS protection. Hard per-key guarantees would use a Durable Object. Contact licensing for higher tiers."
    },
    "honesty": "precision is not accuracy; ns/us fields are format-padding on a millisecond source (§16).",
    "runtime": {
      "instant_registry_kv": "healthy",
      "rate_limiter": "enforced",
      "instant_signing": "enabled (Ed25519, key_id ctcl-ed25519-1)",
      "edge_wall_clock": "operational",
      "oauth_google": "enabled",
      "oauth_github": "enabled"
    },
    "known_limitations": [
      "custom_expression transform intentionally NOT implemented — arbitrary-expression eval is a security risk",
      "TAI/GPS use the full historical leap-second table (1972-2017) for any given instant, but cannot predict FUTURE leap seconds — none have been declared since 2017-01-01, but if one is, post-that-date conversions are stale until the table is updated; GPS is not applicable before its 1980-01-06 epoch",
      "rate limiting is per-colo approximate (Cloudflare's native limiter design), not a hard global per-key guarantee — that would need a Durable Object",
      "signing (§31/§31.1) covers /v1/now, registered instants, custom system definitions, and Temporal Groups — every persisted resource type is signed",
      "monotonic duration timing (§32), clock-rollback detection (§33), and offline degraded mode (§39) are implemented client-side in the SDK (monotonic/guardedNow/offlineNow) — the server itself does not track a client's local clock",
      "no source allowlist or app-level audit log (§31.1) — the API is read-only/query-only (nothing external is ingested to allowlist), and Cloudflare's platform request logs are the only request log today",
      "gpu_availability and simulation_state planner constraints require an external data feed this deployment does not have",
      "no CLI or webhook relay for this Web deployment yet — REST, SDK, the web playground, and MCP (/mcp) are the interfaces today",
      "Remote MCP (/mcp) exposes read/compute tools only (§12.3) — Trigger/WakeEvent/Agent-Wake capability lives entirely in the Temporal Port desktop app's Local MCP, which has access to its own local SQLite state this Worker does not",
      "Accounts (§Phase-5 Step 2, Google/GitHub sign-in) exist ONLY to make Shared Workspace ownership real — one role (owner vs. everyone else), not general RBAC. Instants, custom systems, Temporal Groups, and unowned/anonymous workspaces remain exactly as accountless and open as they always were; signing in is opt-in protection, never required",
      "no email/password sign-in, no account merging across providers if the same person's email differs between Google and GitHub, no account deletion endpoint yet — this is a minimal accounts layer, not a full identity platform"
    ]
  },
  "meta": {
    "api_version": "v1",
    "request_id": "req_9f00c5a038634c01b14f"
  }
}