Existing interface
The route ai.nutsnews.com forwards through the existing tunnel to the loopback local AI API on port 8788. Ollama listens on port 11434 and provides qwen2.5:3b.
Authentication and requests
Authenticated requests use the x-nutsnews-ai-key header. Existing endpoints include GET /health, GET /stats, POST /review, and POST /translate. Translation language support is defined by the deployed API; the compatibility probe uses French.
Release gate
Verify health and model availability, send a synthetic translation request, and require provider=local, model=qwen2.5:3b, and a successful response. Record duration without recording prompt or response contents. Compare the AI service process identity before and after unrelated releases.
Worker path
Check production-worker configuration and connectivity from its deployment environment. A direct developer-machine probe establishes endpoint health but is not a substitute for evidence from the worker path.
Cloudflare Workers compatibility probe
A dedicated authenticated compatibility worker calls the unchanged production AI route from the Cloudflare Workers runtime. Deployment verifies local-provider and Qwen-model identity before and after changes. The probe has no schedules, database writes, or production worker configuration changes.
Additive instrumentation
The API wrapper exports fixed-label counters, in-flight gauges, and latency histograms on loopback port 8791, scraped directly by Alloy. Background summary counts are separate. Queue depth inside Ollama is unavailable and labeled as a gap. The existing review/translate contract returns JSON and uses upstream stream=false; a stream flag does not change that behavior. Contract tests cover concurrent requests, authentication, timeout errors, and unchanged streaming behavior.
The installer checks the known live source hash, waits for two idle socket checks, saves the old source, sets a graceful stop timeout, and upgrades only the wrapper. A source mismatch or continuous traffic stops the rollout. Same-hash subsequent releases only verify the telemetry endpoint. Real local-provider and Cloudflare Worker inference gates run before and after rollout.