SpyderGoat limits and non-guarantees
SpyderGoat provides an unsigned Cloudflare Worker-clock receipt with documented field formats and no accuracy SLA. It is an external HTTP comparison point, not clock synchronization, a signed RFC 3161 token, or proof that an event occurred.
What the API actually returns
The Worker calls Date.now() during response construction, derives MJD, UTC, and Unix seconds, and adds the literal source marker "server". /jd adds Julian Date. The marker is not a signature, origin proof, authentication statement, or clock-quality attestation.
The timestamp is the Worker clock read during response construction. It is not request-arrival time, not caller-receipt time, and not external-event time. The Worker does not expose server processing duration or one-way network delay.
Precision is not accuracy
utc exposes milliseconds through the ISO string. unix exposes whole, floored seconds. MJD and JD are rounded numeric values to eight decimal places. These output formats and their precision do not establish clock accuracy.
Eight-decimal MJD and JD provide a fine displayed increment, but the underlying input is a millisecond integer and trailing decimal zeroes may be omitted by JSON number serialization. Do not turn the formatting into a maximum clock-error claim.
Receipt time is not event time
The API does not know when an unrelated event began, occurred, was sent, reached your application, or was stored. Event time, client-claimed time, application receipt time, response-construction time, and caller receipt time must remain separately labelled.
A client can say an event happened at X and request SpyderGoat later. An event can be queued for minutes before the API call. Neither sequence allows the later response to select the event time.
Unsigned and not bound to caller data
The response is unsigned and can be copied or replayed. It is not request-bound, not nonce-bound, not data-bound, and not event-bound. It has no submitted-data hash, certificate chain, event identifier, or cryptographic binding.
It is not an RFC 3161 timestamp token. JSON copied into another record does not become signed evidence, and a response replayed with another action does not inherit event semantics.
HTTP comparison is not NTP
NTP disciplines clocks through a clock-synchronization protocol; this HTTP API does not set, synchronize, or discipline the caller clock. It returns a response for comparison only.
Cache, latency, availability, and limiter boundaries
Cache-Control: no-store is a cache-control instruction, not proof that every intermediary complied and not proof that clients, logs, or copied records discarded the response.
Network delay can be asymmetric. Request travel, Worker handling, response travel, and local scheduling separate response construction from caller receipt. One sample cannot remove those effects.
With the KV binding configured, free rate limiting is best-effort abuse control shared across /mjd and /jd: one unauthenticated GET per CF-Connecting-IP value every 30 minutes. A missing binding bypasses the check, and a missing IP uses the shared unknown key; neither fallback is a promised tier.
Availability and latency vary. A timeout, malformed response, platform failure, service unavailable outcome, or 429 must remain an explicit caller failure state. SpyderGoat publishes no uptime SLA, no latency SLA, no accuracy SLA, and no maximum-error bound.
Concrete counterexamples
- A client says an event happened at X, then requests SpyderGoat later; the later receipt does not establish X.
- An event is queued for minutes before the API call; response construction is not queue or event time.
- JSON is copied into another record; the receipt is not bound to that record.
- A response is replayed with a different payload; the API supplies no replay prevention.
- Network delay is asymmetric; RTT midpoint estimation cannot reveal either one-way delay.
- The service is unavailable; the caller has no external receipt and must not invent one.
- Two clocks disagree; the API alone does not establish which is correct.
What the API cannot prove
- That a client clock was correct.
- That an external event occurred.
- That an event occurred at the returned utc value.
- That a copied receipt belongs to a particular request, record, datum, or event.
- That a receipt was not replayed.
- That the caller received the response without delay.
- That two events occurred in causal order.
- That the caller clock became synchronized.
- That the Worker clock met an unstated accuracy or maximum-error bound.
- That the service will meet an unstated uptime or latency target.
Examples
Fixed illustrative /mjd response
Illustrative shape generated from a fixed input; not a live response or accuracy evidence.
{
"mjd": 61107.38011574,
"utc": "2026-03-08T09:07:22.000Z",
"unix": 1772960842,
"source": "server"
}Different timestamps answer different questions
Schema illustration only; no value is selected as the true event time.
{
"client_claimed_at": "2026-03-08T09:00:00.000Z",
"application_received_at": "2026-03-08T09:07:21.700Z",
"external_receipt_utc": "2026-03-08T09:07:22.000Z"
}Limits and non-guarantees
- What this receipt does not guarantee: SpyderGoat returns a server-derived HTTP time receipt derived from the Cloudflare Worker runtime clock. The Worker clock is read during response construction. It is an unsigned HTTP receipt, not NTP, an atomic-clock feed, a signed timestamp, or an RFC 3161 authority or timestamp token. It does not synchronize or discipline your clock, and it does not prove when an external event occurred. Displayed precision is not an accuracy guarantee. HTTP and network latency affect comparisons. SpyderGoat publishes no uptime or accuracy SLA.
- The API is not a monotonic clock, a clock-discipline service, a signed proof, a request/data/event binding mechanism, or an availability dependency with an SLA.
Runtime provenance
Current response fields come from buildTimeResponse(); current free-limit behavior comes from checkFreeRateLimit() and API routing in src/api/worker.js. Public HEAD, CORS, response-field, method, and rate-limit assertions are present in test/worker.test.js. These repository sources establish current SpyderGoat behavior; they do not establish independent Cloudflare clock accuracy.