7 unit tests cover HMAC verify/reject, push+main-only filtering, the exact BuildBuddy Run payload shape, and the R2 upload/download/latest-alias roundtrip -- all run under plain Node, no Cloudflare account needed. README now documents what's actually been proven against real infrastructure (tangled.org clone over HTTPS, a full from-source nix build .#android on a real BuildBuddy executor producing a signed 20M apk, the nix-daemon startup fix) vs. the one remaining unknown: the Worker has never been deployed, which needs a Cloudflare API token + account ID only the account owner can provide. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>