Receipts: features/release-and-deploy.md

[justinhelmer]

Receipts ledger for features/release-and-deploy.md — production follows the release PR, one Worker at a time. Each live validation of an [agent] criterion is a comment here: criterion, date, deploy SHA, evidence link. Never edit the spec with a receipt.

[justinhelmer]

Criterion: every PR's CI shows the Workers its diff would deploy (ordinary mode, --base HEAD^). Date: 2026-09-07. Head: feat/release-deploys-affected-workers@200793d (PR #506, before merge). Evidence: CI job deploy targets — output:

Deploy targets for 969893c: **1 of 4 Workers** — bot
| memory | skip | ref 5c6ed9a | no input changed |
| bot | deploy | ref 5c6ed9a | src/core/commandCatalogue.ts, src/core/commands/deploy.ts, src/deploy/affected.ts, src/deploy/plan.ts, src/deploy/run.ts |
| resident | skip | ref 5c6ed9a | no input changed |
| sandbox | skip | ref 5c6ed9a | no input changed |
Unclassified paths: none.

Correct by inspection: the PR changes src/ (a bot image input) and no Worker's worker.ts imports the changed modules. Release-PR mode (live-commit bases + sticky comment) and the release deploy itself are receipted after merge.

[justinhelmer]

Criterion: the release PR carries a sticky deploy-plan comment, posted from the push to main. Date: 2026-09-07 19:14Z. Commit: main@3f7c507 (the #508 merge). Evidence: release-please run https://github.com/coreplanelabs/switchboard/actions/runs/34154741066 — jobs release-please ✅, the release PR carries its deploy plan ✅, deploy skipped (not a release); release PR #494 (head e3f2d52) has exactly one comment starting <!-- switchboard:deploy-targets -->: 4 of 4 Workers, bases live 8b361d8 (memory) / live 19cc41c (bot) / live a653cf6 (resident) / none (sandbox: no SANDBOX_TOKEN, no tag yet), with per-Worker reasons. The PR's own pull_request checks sit at action_required as the spec predicts.

Findings the plan surfaced (follow-up PR): (1) three unclassified paths from #496 — .prettierignore, .prettierrc.json, eslint.config.mjs — make the fleet unsure; (2) #496 deleted the per-Worker package-lock.json files (one root lockfile), so the production-dependency rule reports "could not be read — treated as changed" for every Worker; both fail open (deploy), as designed.

[justinhelmer]

Criterion (#522): the release PR's next plan shows no unclassified paths. Date: 2026-09-07 19:38Z. Evidence: the release-please run for the #522 merge re-rendered the sticky comment on #494 (head 66bee76, comment updated 19:38:20Z): Unclassified paths: none.; the bot's reason is the root package's dependency diff (@anthropic-ai/sdk 0.122.0 → 0.123.0, …); memory/resident still report production dependencies of <workspace> could not be read — treated as changed against their pre-#496 live commits (8b361d8 / a653cf6 — that lockfile has no workspace entries), which is the documented fail-open until the first CI deploy moves them past #496; sandbox unsure (no SANDBOX_TOKEN, no tag). The bare package-lock.json: path on the bot row (no code span) is #526's F3.

[justinhelmer]

Criterion: merging the release PR deploys exactly the selected Workers — first attempt, refused before anything deployed. Date: 2026-09-07 20:53Z. Release: v0.2.0 (main@6036672, #494). Evidence: run https://github.com/coreplanelabs/switchboard/actions/runs/34161067561 — release-please ✅ (tag + release), the release PR carries its deploy plan skipped (correct: this push is the release), deploy / deploy affected ❌ at the deploy step: plan = 4 of 4 (live bases 8b361d8 / 19cc41c / a653cf6, sandbox unsure), account assertion ✅ (wrangler whoami lists account 3c7b28f2…), then refusing — working tree is not clean: the workflow's own plan step had written plan.json/plan.txt into the checkout. Fail-closed held; production unchanged (bot 19cc41c, memory 8b361d8, resident a653cf6). Fix: #537 (plan files → RUNNER_TEMP). The deploy for v0.2.0 will run via workflow_dispatch from main after #537 merges.

[justinhelmer]

Criterion: merging the release PR deploys exactly the selected Workers — second attempt (v0.2.1), partial. Date: 2026-09-07 21:21Z. Release: v0.2.1 (main@083f022, #535). Evidence: run https://github.com/coreplanelabs/switchboard/actions/runs/34162851123 — plan 4 of 4 (live 8b361d8 / 19cc41c / a653cf6, sandbox vs tag v0.2.0), pre-checks ✅ (clean tree after #537, account via whoami), memory deployed and live: switchboard-memory.coreplanelabs.dev/healthz → build.commit 083f022, builtAt 21:22:49Z — the first Worker deployed to production from CI. Bot step blocked: its preflight refused on every retry with two problems, in-flight runs (which did reach 0 at ~22 min) and container application not consulted: wrangler containers list failed — the latter never clears, consistent with CLOUDFLARE_API_TOKEN lacking the Containers scope (the token was created for the assets-only docs Worker). Run cancelled at ~22 min of the 45-min wait; resident and sandbox not attempted (order held). Next: fix the preflight's error text (it drops wrangler's stdout, hiding the cause), add the Containers scope to the token, re-dispatch deploy-production.yml from main.

[justinhelmer]

Criterion: the deploy runs the selected Workers in order, preflighted, with the bot's live gate — manual run of the same command (CI's token lacks the Containers scope; see the previous receipt). Date: 2026-09-07 21:47–21:55Z. Commit: main@07b6bc0 (v0.2.1 + #530/#538/#542), from a clean worktree at origin/main with the wrangler OAuth login. Evidence: npm run cli -- deploy all --affected --wait-max 45 → plan: memory skip (live 083f022, no input changed), bot deploy (live 19cc41c), resident deploy (live a653cf6), sandbox skip (vs tag v0.2.1, no input changed); account via whoami ✅; bot preflight waited out 2 in-flight runs (Justin ended them), then preflight ok … container application settled — with the OAuth identity the wrangler containers list check passes, which pins the CI failure on the token's scope; bot version 4e57deca uploaded, live gate: serving 19cc41c, expected 07b6bc0 → live (commit 07b6bc0, drained after 47s); resident preflight 3 residents, no resident has work in flight, version b06e7c92. Exit 0. /healthz after: bot 07b6bc0, memory 083f022, resident 07b6bc0.

[justinhelmer]

Criterion (#551): with a token lacking the scope, the deploy refuses at the pre-checks naming the Worker, the scope and wrangler's words — before deploying anything. Date: 2026-09-07 22:54Z. Release: v0.3.0 (main@5683440, #544). Evidence: run https://github.com/coreplanelabs/switchboard/actions/runs/34168199545 — Cloudflare credential: CLOUDFLARE_API_TOKEN (the docs token — fallback); plan 3 of 4 (memory, bot, sandbox; resident skip; every base live, sandbox via SANDBOX_TOKEN); account ✅; then in 13 s: refusing — bot: the credential cannot \wrangler containers list --json` — its deploy needs Containers: Edit … wrangler said: {"error":"There has been an unknown error listing containers.\n{"error":"Authentication error"}"}and the same for sandbox. Production unchanged (memory 083f022, bot 07b6bc0, resident 07b6bc0) — contrast run 34162851123, which deployed memory and then idled 22 min. **Why the docs token was used:**CLOUDFLARE_DEPLOY_TOKEN exists as a repository secret (22:16Z) but evaluated empty in the workflow; the likely cause is that it was set without a value on stdin (gh secret set NAMEwith no redirect). Next: re-set it from the local file and dispatchdeploy-production.yml` from main.

[justinhelmer]

Receipt — production deploy from CI with CLOUDFLARE_DEPLOY_TOKEN (items 3, 4, 7, 9): 3 of 4 Workers deployed and live; the sandbox step failed on a Worker bug that CI caught and #562 fixed.

Run: https://github.com/coreplanelabs/switchboard/actions/runs/34168670237 (workflow_dispatch at d75e40c, 2026-09-07 23:03Z, after the repo secret CLOUDFLARE_DEPLOY_TOKEN was populated).

• Pre-checks passed with the new token: bot: credential can wrangler containers list --json, resident: … containers list + … r2 bucket list, sandbox: … containers list. The earlier v0.3.0 release run (https://github.com/coreplanelabs/switchboard/actions/runs/34168199545) refused the same plan up front on the docs token — the refusal path works as designed.
• memory — Current Version ID: caf36d4c…, live on d75e40c (/healthz builtAt 23:03:45Z).
• bot — preflight no runs in flight, Current Version ID: 551b594d…, live gate: deployed, not live yet — serving 07b6bc0 ×3 → live (commit d75e40c, drained after 47s).
• resident — preflight 3 residents, no work in flight, Current Version ID: e69920b1…, live on d75e40c (builtAt 23:06:19Z).
• sandbox — FAILED: Cloudflare validator rejected the upload with Uncaught Error: No such module "node:path/posix" (error 10021). Cause: feat(sandbox): the cold sandbox image and SDK move together to 0.12.9 — Node from the base, pnpm via npm, the NodeSource layer retired #546 moved the sandbox Worker to SDK 0.12.9, which imports node:path/posix, and wrangler.jsonc had no nodejs_compat flag. Fixed on main by fix(sandbox): the Worker speaks SDK 0.12.9 for real — nodejs_compat, credential via exec env, typed errors, installed-SDK guard #562 (8ce3f64). deploy all stopped at the failed step and exited 1, as designed; the three Workers deployed before it stayed live.

Still open for the full end-to-end receipt (item 3 via the release path): release PR #561 (0.4.0, head 08409bb) carries #562; its deploy-targets comment reads memory, bot, sandbox against live d75e40c/8b361d8. Merging it should deploy exactly those three through the deploy job of release-please.yml.

[justinhelmer]

Receipt — end-to-end release path (item 3, plus 4, 7, 9): merging release PR #561 deployed exactly the Workers its comment named, and all four are live on the release commit.

• Release PR: chore(main): release 0.4.0 #561 (0.4.0), merged 2026-09-07 23:28:55Z as 7959a38. Its final deploy-targets comment (head 2825a3c) read 4 of 4 Workers — memory, bot, resident, sandbox — judged against live d75e40c / 8b361d8.
• Release: https://github.com/coreplanelabs/switchboard/releases/tag/v0.4.0 published 23:29:06Z, target 7959a38.
• Run: https://github.com/coreplanelabs/switchboard/actions/runs/34170182218 — release-please ✓ → deploy / deploy affected ✓ (the release-PR comment job skipped, as it should on a release event). Fired 3 s after the merge; finished 23:35Z.
• Credential: DEPLOY_TOKEN_SOURCE: CLOUDFLARE_DEPLOY_TOKEN; account: wrangler whoami lists account 3c7b28f2…; all four capability pre-checks passed (containers list for bot/resident/sandbox, r2 bucket list for resident).
• Plan in the run matched the PR comment: Affected: memory, bot, resident, sandbox (HEAD 7959a38), same per-Worker reasons.
• Per Worker (log → /healthz build.commit probed at 23:37Z):
  • memory — Current Version ID: 1802f382… → live 7959a38 (builtAt 23:29:59Z)
  • bot — preflight no runs in flight; Current Version ID: f1d44596…; live gate saw serving d75e40c ×3, then old container still draining — 1 run(s) in flight ×3, then live (commit 7959a38, drained after 95s) → live 7959a38 (builtAt 23:30:11Z, draining false)
  • resident — preflight 3 residents, no work in flight; Current Version ID: 4c2f346a… → live 7959a38 (builtAt 23:33:19Z)
  • sandbox — Current Version ID: 704ac890… (the nodejs_compat fix from fix(sandbox): the Worker speaks SDK 0.12.9 for real — nodejs_compat, credential via exec env, typed errors, installed-SDK guard #562 made the validator accept it) → live 7959a38 (builtAt 23:33:51Z, bearer probe)

Now that every Worker serves a post-#496 commit, the next release's sandbox row will read its production dependencies from the root lockfile instead of "could not be read — treated as changed".

[justinhelmer]

Receipt — the release PR's own CI runs unattended (item 1, #584 merged 2026-09-08 00:27:58Z as b430874).

• The merge to main that followed re-pushed release PR chore(main): release 0.5.0 #570 (0.5.0) at 00:29:06Z and again at 00:36:43Z. Both heads' pull_request runs (ci, pr-title, codeql) started on their own — gh run list --branch release-please--branches--main--components--switchboard shows every run completed with no action_required, triggering actor coreplane-infra[bot] — and the required checks reported. The v0.2.0–v0.4.0 heads each needed a click; this one did not.
• The release-please run's mint the App token step succeeded (the org secret OP_SERVICE_ACCOUNT_TOKEN and the coreplane-infra installation were already in place; nothing new was created).
• Found on the way: pr-title.yml double-fires on a release-please update (synchronize + edited in the same second) and its cancel-in-progress: true left the cancelled run as the required title status — chore(main): release 0.5.0 #570 read "1 cancelled, 20 successful" and would not merge. Unblocked by re-running the cancelled run (34173881613 → success); the fix is cancel-in-progress: false (PR to follow).

[justinhelmer]

Receipt — v0.5.0 (PR #570, merged 2026-09-08 00:41:02Z as c14eca7): the release deployed 3 of 4 Workers unattended, waited out a run in flight, and exercised the new busy path's happy half.

• Run: https://github.com/coreplanelabs/switchboard/actions/runs/34174120389 — fired 3 s after the merge, deploy / deploy affected ✓ at 00:47Z. Credential CLOUDFLARE_DEPLOY_TOKEN; account and the sandbox's containers list pre-check passed (the only one the plan needed).
• Plan matched the release PR's sticky comment: Affected: bot, resident, sandbox against live 7959a38; memory skip — no input changed.
• The preflight wait, live (item 13, first half): the bot step's first attempt was preflight REFUSED … 1 run(s) in flight (the Switchboard review of fix(ci): pr-title runs are queued, never cancelled — a release-please update fires synchronize and edited together, and the cancelled twin blocked the release PR #586, started 00:42:29Z); deploy all logged still waiting — 1 run(s) in flight (draining: no), waited 0m of 45m, retried after 60 s, got preflight ok, and deployed. The not deployed yet — the bot was busy; dispatch the retry step was skipped, as it must be when the wait succeeds. The timeout half (exit 75 → self-dispatch) still awaits a bot busy for the full 45 min.
• Per Worker (/healthz build.commit probed at 00:49Z):
  • bot — Current Version ID: 7b6fc8b9…; live gate serving 7959a38 ×3 → live (commit c14eca7; 47s after the upload) → live c14eca7 (builtAt 00:43:20Z, draining false, inFlight 0)
  • resident — preflight 3 residents, no work in flight; 1efd71a0… → live c14eca7 (00:45:46Z)
  • sandbox — live (Worker serves c14eca7; rollout complete (1 running instance on version 11); probe echo ok exit 0) — the feat(deploy): the sandbox step is live only when the Worker, the container rollout and an echo-ok probe agree (#569) #583 three-way gate on its first release → live c14eca7 (00:46:20Z)
  • memory — skipped, still 7959a38 by design
• This release PR's heads ran their CI as coreplane-infra[bot] without an "Approve and run" (fix(release): release-please acts as the coreplane-infra App, so the release PR's own CI runs without an 'Approve and run' click #584 receipt above); the one snag was the pr-title cancelled twin, fixed by fix(ci): pr-title runs are queued, never cancelled — a release-please update fires synchronize and edited together, and the cancelled twin blocked the release PR #586.

[justinhelmer]

Receipt — release-and-deploy.md item 16 (sandbox live gate, #583) on release 0.5.0

First production run: release-please run 34174120389, deploy affected job.

What the gate did (pass on mechanics):

00:42:08  3. sandbox (switchboard-sandbox) — deploy/cloudflare-sandbox: npm run deploy — needs SANDBOX_TOKEN — credential must pass `wrangler containers list --json` (Containers: Edit) — then wait until live (…)
          per-thread exec proxy — stateless per run; done only when the Worker serves the commit, every running container is on the new image and an `echo ok` probe answers from one (#569)
00:47:18  [deploy:all] sandbox: version 0c48b341-f216-4262-81c0-bc62ecb5669a uploaded — waiting until live (commit c14eca7)
00:47:24  [deploy:all] sandbox: live (Worker serves c14eca7; rollout complete (1 running instance(s) on version 11); probe `echo ok` exit 0 from deploy-gate:c14eca7633fc3cff095b5e24641bdd0399783186 (version 11); 7s after the upload)
          worker    script                 version                                live     status
          bot       switchboard            7b6fc8b9-…                             live     deployed
          sandbox   switchboard-sandbox    0c48b341-…                             live     deployed

The plan rendered the gate and the needs SANDBOX_TOKEN requirement; the bearer /healthz read, the instance listing, the probe exec and the probe-instance lookup all ran and agreed; the results table reports the sandbox live for the first time (it was n/a before #583). A deploy-gate:c14eca7… instance exists in wrangler containers instances (created 00:47:39Z, inactive after the 5-min idle window as designed).

What it did not prove (fail on the rollout signal): the application version it compared against was 11, the pre-deploy version; containers info now reports 12 with the new image digest. The gate accepted "rollout complete" and a probe on a version-11 instance because the deploy's new version had not registered when it polled, 7 s after the upload. Filed as #589 with the fix (read the version before the upload and wait for it to advance). Until that lands, the live verdict for the sandbox is the Worker signal plus a probe on whatever image was serving — the same guarantee as before #583 plus the probe.

[justinhelmer]

Receipt — v0.6.0 and v0.6.1 deployed from CI unattended, both release PRs authored by coreplane-infra[bot] with no approval click.

• v0.6.0 (chore(main): release 0.6.0 #587, merged 01:32:36Z as 4b10d7b): run https://github.com/coreplanelabs/switchboard/actions/runs/34177001081 — Affected: memory, bot, resident, sandbox; all four live on 4b10d7b by 01:40Z (bot live 64 s after upload; sandbox three-way gate, 3 running instances). The template-render check was red on main at that commit (feat(ledger): the live-run ledger on the state Worker — lease with a fencing token, step records, an append route, a per-run transcript object, reclaim #592 vs feat(deploy): render each Worker's wrangler.jsonc from a template and the deployment profile #588, fixed by fix(deploy): the memory Worker's RunTranscriptDO binding and v6 migration live in the wrangler template — #592 edited the generated file after #588 made it a render #595); the deploy job runs deploy all, not the suite, and the generated config it shipped was correct.
• v0.6.1 (chore(main): release 0.6.1 #599, merged 01:57:02Z as 06273f6): run https://github.com/coreplanelabs/switchboard/actions/runs/34178369446 — Affected: bot, sandbox (memory, resident: skip — no input changed); bot live 160 s after upload, sandbox gate green. /healthz at 02:06Z: bot 06273f6, sandbox 06273f6, memory and resident still 4b10d7b by design.
• Deploy job started 26 s after the merge; environment: production has no protection rules, so nothing waits on a person.