Remote content controls and Wikimedia access#

Restoration release, 2026-10-16; content policy remote-content-2026-10-16.1. The eight existing tools support previously unseen entities within their bounded schemas. The historical seven exact requests/frozen-result comparisons are gone. New names, identifiers, aliases and ordinary source changes need no per-entity review. The hosted service is Wikidata-only; local optional Google support is unchanged.

Content admission and identity evidence#

Admission checks the records returned in this response, selected labels and direct classification signals. It does not recursively certify P31/P279 ancestors, occupations, genres, subjects, affiliations, creators, qualifiers or their dependency graphs. Unknown subclasses do not require exhaustive adult-screening closure. A small explicit direct-category deny set and bounded label checks remain. They can withhold a response; they are not a universal adult-content classifier.

The canonical resolver still gathers the P31/P279 evidence needed for identity, compares local anchors, detects incompatible kinds and contradictions, and preserves HOLD, AMBIGUOUS, INSUFFICIENT_EVIDENCE and WRONG_IDENTITY. A missing identity fact is still missing evidence. Content admission never recalculates a verdict or promotes a surviving candidate after filtering. Provider agreement and matching names do not prove a local entity's identity. Suggested sameAs links require independent review before publication.

Fields actually returned#

The hosted projection includes QIDs, chosen labels and their actual language, direct type identifiers, selected entity-valued property/QID facts, bounded country/locality relationships, relationship rank/property/direction, closed reason/evidence/conflict codes, canonical decisions and bounded provenance/counters. Explicit supported field selections remain effective. Descriptions, aliases, external links, media, addresses, arbitrary scalar/source prose, qualifiers and raw references are omitted. These fields may still inform the resolver internally. Coordinates are returned only for recognized direct place types without a person, unknown type or unresolved nondeprecated P31 snak; other coordinates are omitted.

The adapter may hydrate missing returned records once through the same coordinator. It never follows an adult-classification frontier. At most 32 returned records and 512 direct statements per checked property are assessed, within the existing eight-attempt/20-second request limits. Missing records or labels, content refusal and provider errors are explicit outcomes rather than saved-answer fallbacks.

ALLOWED means admitted under these limited checks. Responses report age_suitability: not_certified. This is neither identity verification nor a promise that all obtainable Wikidata content suits every age. Mutable public data can be incomplete, erroneous, vandalized or mature. No paid moderation, LLM classification, new provider or universal ontology certification is used.

Shared upstream admission#

The private Python Worker has no direct-network fallback. Every upstream attempt passes through the same existing SQLite Durable Object singleton used for public accounting. Separate persistent rows coordinate upstream access; UTC quota reset never clears an upstream cooldown. Only the fixed read-only Wikidata Action API, Query Service and Wikidata MCP addresses are permitted. Caller cookies, authentication and network identity are never forwarded.

• At most one upstream flight across all invocations and endpoint families.
• At least one second after completion before the next flight; five seconds after a request taking more than one second.
• Numeric and HTTP-date Retry-After are persisted. A 429 without a valid value pauses for 60 seconds; 5xx pauses at least 15 minutes. Longer valid delays win.
• A 30-second in-flight lease is written before egress. Caught failed or uncertain requests quarantine for at least 60 seconds. An interrupted invocation without cleanup retains its originally written 30-second lease; restart cannot reset it.
• Busy callers fail closed; short pacing delays can wait at most 5.5 seconds before an atomic recheck. No unbounded queue or automatic upstream retry.
• The actual network operation, including its bounded body, has a five-second abort deadline. The private binding can allow up to 12 seconds for coordination plus I/O, within the unchanged 20-second overall tool deadline.
• Preserve canonical Action API query parameters for on-demand interactive reads. MediaWiki explicitly permits interactive tasks to omit maxlag; the exception applies only when a person waits for the answer, not to unattended clients. This remote service is for interactive lookups; unattended jobs must use the local client with the appropriate maxlag policy. Explicit maxlag values are preserved, and any maxlag response still triggers a shared pause. Default identification is the descriptive project/version/contact User-Agent, with Accept-Encoding: gzip.

Storage failure prevents egress. Redirects are refused; requests are at most 64 KiB and upstream responses at most 2 MiB. Private proxy calls share the core's eight-subrequest ceiling. Runtime CPU limits remain core 1250 ms, gateway/DO 20 ms; gateway subrequests remain four. No increase in the public daily cap, Cloudflare plan or Google quota is permitted by this release.

Per-call attempt headers/metrics conservatively count private proxy operations, including coordinator refusals; they are an upper bound on external Wikimedia attempts. The singleton also keeps a current-day admitted-flight counter, with uncertain attempts charged rather than refunded.

No prompts, URLs, bodies, names, session tokens or identity envelopes are stored in the upstream coordination row: only an opaque lease, timestamps and day/attempt counters. Existing aggregate operational metrics and privacy limits continue to apply.

Source and access requirements#

Wikidata's licensing policy places structured main/Property/Lexeme/EntitySchema data under CC0. Other namespaces have different licensing. The service returns selected structured facts, not article HTML, copied media or external-site content. CC0 does not grant trademark rights: see CC0 legal code, section 4. No partnership, official status or trademark ownership is claimed.

Wikidata data access encourages source attribution. Results retain bounded provenance and QIDs; product copy identifies Wikidata independently of its publisher. External URLs are references, not a licence to rehost their content, and are never fetched here.

The User-Agent policy requires descriptive identification and contact information. The API Usage Guidelines, Action API etiquette, rate-limit guidance and Robot policy govern access, including global concurrency, compression, throttling and Retry-After. The Query Service manual adds its own compute/error limits. Application limits are not provider entitlements or an exemption. Significant-volume identification may require further operator arrangements; no authenticated bot status or Cloudflare exemption is claimed.

The original readiness audit verified descriptive request construction and actual JSON MCP responses; it did not obtain a provider-side capture of the production Worker's outbound User-Agent. A direct Action API probe is not represented as such a capture. Request construction is verified at the final outbound boundary in offline/native bridge tests. Live success is evidence of API interoperability, not an independently observed provider-side User-Agent capture.

Verified release evidence (2026-10-16)#

Staging used the actual deployed core, authenticated gateway and authoritative atomic reservation. Seven retrieval calls succeeded with 21 upstream proxy attempts:

These are fresh MCP responses, not fixture replay or a model-selection test. Provider-failure and malformed/incomplete-provider cases are exercised offline; no live provider outage was manufactured or counted as successful retrieval. The old gateway-generated 502 still has an unproven original cause; later 200 responses do not establish that cause or a timeout fix.

The source suite passes 510 tests, including unchanged canonical identity tests; 53 offline coordinator/operator tests cover concurrency, restart leases, persisted pauses, reservation replay, exhaustion, authorization and fail-closed accounting. The five historical blocked snapshots admit 5/5 in offline replay; that is separate from the seven live deployed staging calls. Independent review findings were reproduced and fixed. MR !25 passed CI before merge.

Production core 70cdd375-b429-4c58-91ef-cc90dde569fb was promoted from merged commit ab8acaf and verified against 913 runtime files in source-bound artifact ba1cd6463583ca0526c27671a09c23ede552c62fd0a0e5c986d42261ba18b3c6. The gateway remains 69ed772c-c9be-47ef-be9e-99c84027a0ae, with identical source, bindings, namespace and resource ceilings. Initialize, eight schemas and status passed with zero provider I/O. One production lookup returned Paris(Q90), Cornell University(Q49115) and cat(Q146), HTTP 200 in 3858 ms, one upstream proxy attempt. All seven retrieval workflows are live-tested in staging; only this lookup was repeated in production. This small sample is not a load or accuracy guarantee.

The owner authorized at most 32 additional upstream attempts. An atomic staging reservation covered 21 staging attempts and an eight-unit conservative precharge for exactly one production RPC (its unchanged maximum). Actual observed wire usage was 22; the ledger charged 29/32 and retained 3 reserved, without refunds. The prior three-attempt run remains exhausted. Shared stage ledger: charged 32/40, remaining 8, reserved 3, available 5. No counters, namespaces or pauses were reset. Protocol checks, metadata scans and offline fixtures do not count as retrievals.

Recorded verification#

The response replay uses actual dated staging/production replies with presentation timing edited for readability. It is not a recording of ChatGPT selecting tools. Historical failed/partial recordings remain available without relabelling them.

Restoration recording · Transcript · Historical exact-profile recording

Runtime and cost evidence#

Current limits remain core 1250 ms CPU/eight subrequests, gateway and coordinator 20 ms/four subrequests, 100,000 public admissions per UTC day. Staging retains its existing 1000 ms core,40 upstream/day and 50 public/day ceilings. The staging coordinator's additive validation reservation preserves legacy charges and pauses; production continues to use the current production gateway unchanged.

The historical calculation and measurements are a workload estimate, not a current invoice or total-dollar cap. Rejected network ingress can still be billable. This restoration changes no billing plan, quota namespace or deployed resource ceiling.

Legal attestations and directory submission remain the publisher's decision. Clean scans do not constitute directory approval or age-suitability certification.