v2.1.0 to v2.1.0

---

name: "deploy-and-runtime-verification"

description: "MANDATORY deploy after every code change. Typecheck → deploy → purge CDN → E2E on production → visual verify → fix-forward loop. Workers Builds native CI/CD, D1 Time Travel PIT recovery, D1→R2 long-term backups, wrangler rollback, wrangler secrets management, structured observability, cross-browser smoke tests, rollback procedures, and GitHub auto-configuration."

metadata:

version: "2.1.0"

updated: "2026-05-03"

effort: "high"

model: "sonnet"

license: "Rutgers"

compatibility:

claude-code: ">=2.0.0"

agentskills: ">=1.0.0"

submodules:

- backup-and-disaster-recovery.md

- changelog-and-releases.md

- ci-cd-pipeline.md

- critical-css.md

- font-subsetting.md

- gh-fix-ci.md

- launch-day-sequence.md

- pipeline-health-check.md

- r2-lifecycle.md

- service-worker.md

- uptime-and-health.md

priority: 2

pack: "backend"

triggers:

- "deploy"

- "wrangler deploy"

- "rollback"

paths:

- "concern:cloudflare-workers"

---

# 08 — Deploy and Runtime Verification

Enforce the mandatory typecheck→deploy→CDN-purge→prod-E2E→visual-verify loop after every code change; never mark done without a live PROD assertion.

## Mandatory deploy loop (every code change)

1. Build + typecheck

2. `wrangler deploy` (or platform equivalent)

3. Purge CDN (`wrangler cache purge` or `curl -X POST https://api.cloudflare.com/client/v4/zones/{id}/purge_cache`)

4. Fetch each changed route on PROD URL via curl + Playwright

5. Assert new content / headers / JSON-LD / status live

6. AI vision QA at 6 viewports (per `_kernel/standards.md#breakpoints`)

7. Fix-forward (max 3 redeploys) — never silently fail

8. Only then mark DONE

"Local typecheck + build pass" is NOT done. Per `rules/verification-loop.md`.

## Auth fallback chain

- `CLOUDFLARE_API_TOKEN` from `/Users/Apple/.local/bin/get-secret`

- On 401: `CLOUDFLARE_API_KEY` + `CLOUDFLARE_EMAIL`

- NEVER silently skip deploy because creds missing — surface as blocker

## Workers Builds (native CI/CD)

- Configure in `wrangler.jsonc` `build` block

- Auto-deploys on push to `main` per `rules/main-only-branch.md`

- Secrets injected via dashboard or `wrangler secret put` per `rules/secret-provisioning.md`

## Secrets management

- Two-way mirror: every prod secret also in chezmoi (`~/.local/share/chezmoi/home/.chezmoitemplates/secrets/{KEY}`)

- `scripts/check-secrets.mjs --audit` runs before every deploy

## D1 backup strategy

- **D1 → R2 long-term** — `wrangler d1 export <db> --output=backup.sql` + upload to R2 daily via cron

- 1 TB storage limit per account, 10 GB per database

## Rollback procedures

- **Worker** — `wrangler rollback <version-id>` in <30s

- **D1** — Time Travel PIT to known-good timestamp

- **R2** — bucket versioning enabled; revert via object version

- **Combined deploy** — log `{commit, version_id, timestamp}` to D1 after every deploy; rollback target one query away

## Auto-rollback gates (gradual deployment)

- Auto-rollback at p99 error >1% or LCP regression >20%

## Browser console gate

## Cross-browser smoke

Per `_kernel/standards.md#breakpoints` × 3 browsers (Chromium, Firefox, WebKit):

- No console errors at any breakpoint

- Lighthouse Perf ≥75 + A11y ≥95

## Observability check post-deploy

- Sentry — recent events in dashboard

- PostHog — recent pageviews + captures

- Workers Tracing — recent traces in Axiom (Tier 2)

- AI Gateway — recent LLM calls logged (Tier 3)

- GA4 — recent events (Tier 2)

## GitHub auto-configuration

- Add CF Workers Builds via dashboard or API

- Wire OIDC + `cloudflare/wrangler-action@v3` for CI

## Per-deploy CHANGELOG entry

## See submodules: workers-builds.md, d1-backups.md, rollback.md, github-config.md.