Context

The customer API-key incident was caused by a code/auth issue plus CDN cache policy interaction. We need a repeatable sweep so future cache-rule or gateway changes do not reintroduce overcaching or break MCP.

Evidence

Manual live sweep on 2026-06-28 found:

• Before Cloudflare rule Add power grid stress & blackout alert layer #7, fake auth headers on generated RPC GETs could receive cached 200s from Cloudflare.
• After rule Add power grid stress & blackout alert layer #7, fake auth returns 401/DYNAMIC on bootstrap and generated RPCs, while anonymous public endpoints remain cacheable.
• MCP remained functionally OK but needs no-store assertions.

Scope

• Add a focused script or test harness gated behind an explicit env var, for example LIVE_API_CACHE_TESTS=1.
• Cover bootstrap, representative public RPCs, representative generated RPCs, premium RPCs, MCP OPTIONS/POST, and OAuth/protected-resource metadata.
• Assert both status/body and cache posture: no sentinel, no cached 200 for fake auth, no-store on auth errors, public anonymous endpoints still cacheable.

Acceptance Criteria

• The sweep can run locally against production without committing secrets.
• The sweep fails loudly on overcaching, undercaching of public anonymous endpoints, sentinel leakage, or MCP auth/protocol breakage.
• README or test output documents the Cloudflare rule assumptions being validated.