Conversation
Splits Phase 1 into implementation (1a) and attended deployment (1b): the code exists and its local lane is green, but nothing is merged or deployed, and conflating the two would let a code commit read as a passed release gate — which this runbook exists to prevent. Records Phase 2's source preconditions as verified without a deployment (dry-run bindings, migration tag, flags-off variables), so the operator starts from what is already checked rather than rechecking it. Three implementation facts diverge from what this document specified, and are recorded rather than left to drift: - The lease state machine gained `abandoned`. `released` must keep meaning "confirmed 204" for the ramp gates and operator queries to be readable, so a lease that provably owns nothing needed its own terminal state instead of being folded in. - Deploy-time `--var COMMIT` is not sufficient on its own. Metamind auto-deploys its default branch with a bare `wrangler deploy`, which would ship the placeholder and silently un-stamp a stamped deployment; the commit is now baked at build time so both paths carry it. Added as a Phase 1b precondition. - The origin allowlist binds attended mode too. Spelled out because it has a real operational consequence once Phase 1b ships the canary origins while the mode is still attended. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
gcharang
added a commit
that referenced
this pull request
Jul 28, 2026
Phase 0b passes with the merged master SHA (PR #22), as the runbook requires — not the pre-merge dev SHA. Phase 1b is marked Blocked. Pushing the Metamind Phase 1a branch deployed it to production: Cloudflare Workers Builds is building and deploying non-production branches, which Metamind's docs/deploy.md states is off. Nothing was merged; the push alone did it. Recorded rather than quietly fixed, because it inverts the ordering Phase 1b requires (additive D1 migration BEFORE code that queries the table) and the deployment carries no /health verification and no attended proof. It is a production state change with no gate behind it, so the ledger has to show it. Impact is confined to browser enrichment. The primary intake workflow, auth, CRM commit, and Gmail drafts are untouched, and the approval-resume lease release is internally contained, so decisions still land. Worth noting for the rollout's own record: this was only visible because Phase 1's build-time provenance stamp already existed. Under the former COMMIT=local placeholder, /health would have read `local` before and after. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes
devtomasterso the unattended production rollout runbook is merged, satisfying Phase 0b — the runbook requires this before Phase 1 operational work begins.Contents
docs/unattended-production-rollout.md— the canonical operator runbook (added ondev), plus the Phase 1 ledger update recording the Metamind implementation SHA, Phase 2's verified source preconditions, and three implementation deltas.Release impact
None. Docs-only: no pending changesets and no published-package code changed, so
release.ymlis a clean no-op. No Worker deployment is triggered by this repo'smaster— Understudy's migration-v2deploy is Phase 2 and stays a deliberate operator action.Ledger note
Phase 0b's
Approved SHAis filled in a follow-up commit once this merge produces a realmasterSHA — the runbook forbids copying the pre-mergedevSHA into that field.🤖 Generated with Claude Code