C-GC connectivity probe

Answers open question 4.1: can this device reach the proxy? Three checks, in order. Each one shows PASS or FAIL with the full error text.

Check 1 Page loaded …

Trivially true if you can read this — but it proves the hosting domain is not blocked by the device's URL allowlist. 


      


      
      

        

          Check 2
          Worker reachable (GET /health)
          …
        

        

          This is the check that answers the actual question. No token, no auth. If
          this fails, the whole delivery architecture needs rethinking.
        

        

          

            
            
          

        

        
        
        

      


      
      

        

          Check 3
          End-to-end Canvas call (GET /api/v1/users/self)
          …
        

        

          Optional and manual. Proves proxying, Authorization pass-through, and CORS all
          work together. Read-only: it fetches your own user record and nothing else.
        

        
        
        
        
        

          This field is never written to storage, never put in the URL, and never included in the
          copied results. It lives in the page until you close or reload the tab. This page performs
          exactly one authenticated request and it is a read.
        

        

      


      
      

        

          Results
          Copy all three outcomes as text
        

        
        
        

          If the clipboard is blocked by device policy, select the text below and copy it by hand.
        

        
      


      

        Deployed with wrangler. If check 2 fails on a
        *.workers.dev URL but the page itself loaded, the most likely cause is the
        managed-device URL allowlist — see the custom-domain fallback in DEPLOY.md.