Summary

Solid, well-isolated foundation for the Agent Hub distribution layer — the design is sound and the security posture (server-side checksum, version immutability, publisher scoping, fail-loud auth) is exactly right. Code is clean, typed strict, and the in-memory R2 fake makes the 32 handler-level tests genuinely meaningful. The one thing worth fixing before this goes live: the Worker's manifest validation drifts from the canonical src/gaia/hub/manifest.py on reserved agent IDs, which can let through agents that no GAIA client can install. A couple of operational gaps (in-memory size handling, CORS, CI) are also worth a look.

Issues

🟡 Important

1. Reserved-ID check missing — diverges from the canonical validator (src/manifest.ts:136)

parseManifest mirrors manifest.py's id regex, languages, tiers, and platforms — but not its reserved-ID block. manifest.py:393 rejects ids like chat, code, doc, file, etc. (the built-in agent names); the Worker accepts them. The consequence is concrete: a publisher can upload an agent at agents/chat/, but any client that later reads its gaia-agent.yaml runs it through manifest.py, which rejects the id on parse — so the published agent is un-installable. This also masks itself in the suite, where the sample fixture uses id: chat (test/fake-r2.ts:178), so every test publishes a reserved id without noticing.

Suggested direction: mirror the reserved set in manifest.ts and reject in parseManifest, then change the test fixture to a non-reserved id (e.g. my-chat). Since the README stresses the field names mirror manifest.py, the validation rules should too — otherwise the two will keep drifting silently.

2. 250 MiB default vs. the Worker memory limit; size check happens after full buffering (src/publish.ts:25,124-135)

The artifact is fully materialized in memory (artifactFile.arrayBuffer() → Uint8Array → SHA-256) before the size check at line 129. Cloudflare Workers cap at ~128 MB memory, so DEFAULT_MAX_BYTES = 250 MiB is above what the runtime can actually hold — a large native-binary artifact (the PR explicitly supports binaries, not just wheels) will OOM with an opaque 500 rather than the clean 413, and the limit never protects memory because the bytes are already buffered. Recommend rejecting via Content-Length up front, dropping the default well below the memory ceiling, and/or streaming to R2 (createMultipartUpload) for large artifacts. At minimum, lower the default and document the ceiling.

3. No CORS headers on the catalog routes (src/index.ts:20-29)

The PR positions index.json / per-agent manifests for consumption by "the Hub UI". If that UI is served from a different origin than hub.amd-gaia.ai, browser fetch will be blocked — there are no Access-Control-Allow-Origin headers on serveObject/json. Is the UI same-origin? If not, the GET routes need CORS. Worth confirming before the UI work lands on top of this.

4. Nothing runs these 32 tests in CI

No workflow under .github/workflows/ covers workers/agent-hub/ (the repo's CI is Python-only), so npm test / npm run typecheck only ever run locally. For isolated infra this is the moment to add a small Node workflow gated on workers/agent-hub/** — otherwise the suite silently rots. Reasonable as a fast follow-up, but call it out so it isn't forgotten.

🟢 Minor

• Immutable artifacts get no Cache-Control (src/index.ts:25-28) — versioned artifact/manifest keys are immutable and could carry a long max-age; index.json a short one. Cheap CDN win.
• eslint-disable comments with no ESLint config (test/fake-r2.ts:56 et al.) — the disables are inert; either add a flat ESLint config + lint script or drop the directives.
• Token comparison isn't constant-time (src/auth.ts:59) — object-key lookup on the bearer token. Low risk here (network jitter dominates, tokens are high-entropy), noting only for completeness.

Strengths

• Security model is the highlight — server-side SHA-256 that's never trusted from input and is also handed to R2's put integrity check; version immutability enforced both via the manifest (source of truth) and an object-level head() as defense-in-depth; ownership check that blocks even *-scoped admin tokens from hijacking another author's id (test/publish.test.ts:68). The auth deliberately returns a generic message so callers can't distinguish token-vs-scope failure.
• Fail-loudly throughout — matches CLAUDE.md exactly: unset/malformed PUBLISH_TOKENS is a loud 500, never allow-all; every guard raises a structured, actionable HttpError instead of degrading.
• Test approach is excellent — the in-memory FakeR2 honors the optional sha256 integrity check, so the suite exercises real handler flow end-to-end (auth, scope, immutability, checksum, index rebuild, downloads) without Miniflare, and even asserts the original artifact is byte-for-byte untouched after a rejected republish.
• Genuinely isolated — no src/gaia coupling, no dependency on the in-flight Agent Hub: Restructure — move production agents to hub/agents/ #1102 restructure, clean module boundaries.

Verdict

Request changes — the design is right and most of this is mergeable as-is, but issue #1 (reserved-ID divergence making published agents un-installable, hidden by the id: chat fixture) should be resolved before merge, and #2–#4 are worth addressing or consciously deferring with a tracked follow-up.

Note: I reviewed the source and tests directly but did not run npm test / npm run typecheck in this environment; the PR reports both green.