Repository navigation
PASAY-DEPLOY: rebuild deterministic production deployment workflow #78
Description
Goal
Rebuild .github/workflows/pasay-deploy-phase1.yml as the deterministic production deployment layer for the already-frozen PASAY topology. The current file is damaged/incomplete (one residual echo line) and must not be treated as a valid deploy workflow.
Required architecture
Agent workflows prepare/analyze only. Production actions stay in a deterministic GitHub Actions workflow.
Acceptance
- Recover the exact current Cloudflare + Neon production deployment contract from existing repo/history/evidence; do not invent infrastructure.
- Separate deployment credentials from OpenCode coding/review jobs.
- Use GitHub-native production environment/protection where supported by the current private-repo plan; document any plan limitation instead of bypassing it.
- Serialize production deployment (
concurrency=1semantics; no mid-deploy cancellation). - Deterministically perform required database migration/deploy/smoke steps with fail-closed checks.
- No production secret values in logs/artifacts.
- Record exact deployed commit SHA and evidence artifacts.
- No OpenCode/LLM decision inside the production execution path.
- No custom watcher/poller/daemon.
Stop condition
If the exact historical deployment contract cannot be recovered or a required production credential/environment boundary cannot be proven, stop BLOCKED with evidence rather than improvising.
Activity
jhackuy commentedon Aug 28, 2026
/oc
Execute PASAY-DEPLOY issue #78 exactly as written. First recover the last valid historical
pasay-deploy-phase1.ymlcontract and compare it to current Cloudflare/Neon production evidence. Do not invent deployment logic. Keep production execution deterministic, credentials isolated from OpenCode, concurrency serialized with no mid-deploy cancellation, secrets out of logs/artifacts, and stop BLOCKED with evidence if the exact contract cannot be recovered. Deliver via a narrow PR only; no production deploy and no merge.pasay-opencode-bot commentedon Aug 28, 2026
Created PR #83
github run
pasay-opencode-bot commentedon Aug 28, 2026
/oc
Execute this issue exactly as written. Treat the issue body and latest OWNER comments as the authoritative contract. Deliver by PR only; do not auto-merge or production-deploy unless the issue explicitly authorizes it.
pasay-opencode-bot commentedon Aug 28, 2026
User pasay-opencode-bot[bot] does not have write permissions
github run
pasay-opencode-bot commentedon Aug 28, 2026
/oc
Execute this issue exactly as written. Treat the issue body and latest OWNER comments as the authoritative contract. Deliver by PR only; do not auto-merge or production-deploy unless the issue explicitly authorizes it.
pasay-opencode-bot commentedon Aug 28, 2026
User pasay-opencode-bot[bot] does not have write permissions
github run
pasay-opencode-bot commentedon Aug 28, 2026
OPENCODE_DISPATCH_BLOCKED: execution completed without a repository change. Review the issue/run evidence; no PR was created.
jhackuy commentedon Aug 28, 2026
OWNER EVIDENCE UPDATE — unblock prior false BLOCKED.
GitHub server-side history is available and the historical deploy contract is recoverable without local Bash.
Evidence:
76c676a70af3b5a44f6bfee58cbff93551bb251b(this mirror already contains only the damaged residual line, so it is NOT the last-good contract).milestone/5-v1-closeoutcontains multiple real deploy-workflow revisions, including:044c9c63dbacca08727e95ab22184ff7ffc521c4— RETURN3-D STEP3 Alembic parser fix486621e57ec12bad4ab2df705a7cc0c767b65924— RETURN3-B production migration moved before deploy35ab6ddaba7c0e398a54edd99816738f597167fc— readiness evidence / WAF 1010 handling.github/workflows/pasay-deploy-phase1.ymlat044c9c63dbacca08727e95ab22184ff7ffc521c4is readable through GitHub and includes the full workflow contract:workflow_dispatchinputs,concurrency: group: pasay-deploy-phase1 / cancel-in-progress:false,environment: production, Cloudflare/Neon credentials, STEP0..STEP10 gates, production Alembic migration before deploy, smoke/evidence handling.Therefore the prior BLOCK reason "exact historical contract cannot be recovered because agents lack Bash/git log" is no longer valid. Continue Issue #78 from this recovered historical evidence. Do NOT invent infrastructure; use the recovered history as baseline and reconcile only against current repo/topology/evidence. Deliver a narrow PR only. No merge and no production deploy.
pasay-opencode-bot commentedon Aug 28, 2026
/oc
Execute this issue exactly as written. Treat the issue body and latest OWNER comments as the authoritative contract. Deliver by PR only; do not auto-merge or production-deploy unless the issue explicitly authorizes it.
pasay-opencode-bot commentedon Aug 28, 2026
User pasay-opencode-bot[bot] does not have write permissions
github run
pasay-opencode-bot commentedon Aug 28, 2026
OPENCODE_DISPATCH_BLOCKED: execution completed without a repository change. Review the issue/run evidence; no PR was created.
pasay-opencode-bot commentedon Aug 28, 2026
/oc
Execute this issue exactly as written. Treat the issue body and latest OWNER comments as the authoritative contract. Deliver by PR only; do not auto-merge or production-deploy unless the issue explicitly authorizes it.
pasay-opencode-bot commentedon Aug 28, 2026
User pasay-opencode-bot[bot] does not have write permissions
github run
jhackuy commentedon Aug 28, 2026
CLOSEOUT / NEXT GATE
PR #90 merged successfully into protected default branch
feature/telegram-ui-v2.4aeaadd0023d9dfdea847cf90eee2607e8e13347225a5ce8677a19fe72c95c588ad881ea711df0bdpasay-gatePASS;backend-freeze-gate (17 doors, 4 stages)PASS.opencode-reviewremained advisory / production-scope-blocked and was not weakened.workflow_dispatchonly.NEXT GATE: run
.github/workflows/pasay-deploy-phase1.ymlon protected default branch withrun_smoke_only=trueandexpected_target_sha=225a5ce8677a19fe72c95c588ad881ea711df0bd. This first post-merge run is read-only by contract: no deploy, no secret put, no Alembic migration, no DB bootstrap/DCL, no production queue POST, no Telegram setWebhook, no synthetic webhook POST. Full production deploy remains blocked until this smoke-only run passes.jhackuy commentedon Aug 28, 2026
OWNER_APPROVED — PRODUCTION FULL CLOSEOUT
Current production authority target:
225a5ce8677a19fe72c95c588ad881ea711df0bdExecute the existing merged
.github/workflows/pasay-deploy-phase1.ymlas a real workflow_dispatch full run, not smoke-only and not a synthetic push workaround.Exact inputs:
run_smoke_only = falsestep0_db_role_verify = truestep1_cloudflare_resources = truestep2_configure_secrets = truestep3_production_migration = truestep45_deploy = truestep6_infra_smoke = truestep78910_owner_bootstrap_and_tg_smoke = trueexpected_target_sha = 225a5ce8677a19fe72c95c588ad881ea711df0bdAcceptance requires the actual run to execute (not skip) DB role verification/min tx, Cloudflare resources/config, production migration, wrangler deploy, Worker+Container+Queue smoke, Owner/Secretary bootstrap, Telegram setWebhook/getWebhookInfo/synthetic webhook/idempotency, and final completion banner.
A green smoke-only run is not Production Closeout. Any failure must stop at the first exact blocker; do not add broad GRANTs, deploy-time DB privilege mutation, secret logging, or bypass
expected_target_sha.Status until such a full run completes:
PRODUCTION_FULL_CLOSEOUT = PENDING_DISPATCH.