@oneie/claude 0.5.0 → 0.7.0

package/commands/deploy.md

@@ -2,89 +2,147 @@
 
 **Skills:** `/cloudflare` (Workers auth) · `/signal` (deploy:success / deploy:degraded)
 
-Ship all four services to Cloudflare. Deterministic sandwich — W0 baseline, build, smoke, approval, parallel deploy, health.
+Ship all five services to Cloudflare. Deterministic sandwich — W0 baseline, build, smoke, approval, parallel deploy, health.
 
-> **Production cutover (2026-05-23):** Astro site runs on **CF Workers with Static Assets** (not Pages). Production target is **`https://one.ie`** via the `one-prod` worker. Deploy command is `wrangler deploy --env production`.
+> **Monorepo (2026-06-04):** all services live in one repo (`Server/one-ie`). Deploy each via `wrangler deploy` from its folder — **never via repo push, no CI**. Deploys are run locally.
+>
+> **Production cutover (2026-05-23):** Astro site runs on **CF Workers with Static Assets** (not Pages). Production target is **`https://one.ie`** via the `one-prod` worker. Deploy command is **`wrangler deploy` (no `--env` flag)** — see the deploy-target trap note below.
+>
+> **⚠️ Deploy-target trap (found 2026-07-03; fixed in-tree 2026-07-04, verified still fixed 2026-08-02 — `one.ie/web/package.json`'s `deploy` script is now `npm run build && wrangler deploy` with no `--env`, and `wrangler.toml` has no `[env.production]` block. The trap is only reachable by hand-typing `--env` now):** `one.ie`'s custom domain is bound to Worker service **`one-prod`** (confirmed via Cloudflare API). `one.ie/web/wrangler.toml` has no explicit `legacy_env` setting, which means Wrangler's **default legacy-environment behavior applies** for TOML configs: passing `--env production` appends `-production` to the top-level `name`, deploying to a *different* script, `one-prod-production` — which nothing routes to. Three consecutive deploys to `one-prod-production` showed zero effect on `https://one.ie` until `wrangler deploy` was run **without** `--env production`. **Always deploy this worker bare: `wrangler deploy` (no `--env` flag).** Do not re-add `--env production` out of habit — it silently ships to a decoy. **The trap is not limited to `wrangler deploy`** — `wrangler secret put`/`secret delete` take the same `--env` flag and silently target the same `one-prod-production` decoy (hit 2026-07-06 provisioning `UPGRADE_LINK_SECRET`: it landed on the decoy first, invisibly — no error, just a secret nothing reads). Any bare `wrangler <subcommand>` against this worker: **no `--env` flag, ever.**
 >
 > **Environment model:**
-> - **Production (live):** `https://one.ie` — `one-prod` worker, deployed from `one.ie/web/` via `wrangler deploy --env production`
-> - **Dev (live):** `https://dev.one.ie` — `one-substrate` worker, deployed on every `main` push
+> - **Production (live):** `https://one.ie` — `one-prod` worker, deployed from `one.ie/web/` via bare `wrangler deploy` (**not** `--env production` — see trap note above)
 > - **Gateway (live, stable):** `https://api.one.ie` — `one-gateway` worker
+> - **Pay gateway (live, stable):** `https://pay.one.ie` — `one-core-worker`, deployed from `pay/backend/` via `bun run deploy` (no `--env` flag; no explicit `[[routes]]` block in its wrangler.toml either — same bare-deploy discipline as `one-prod`). Not part of the original "4 services" naming (found 2026-07-05 after a commit there went unshipped for a full deploy cycle) — treat it as a 5th first-class deploy target, not an afterthought.
+> - **Dev (`dev.one.ie` / `one-substrate`) — RETIRED 2026-06-04 (prod-only). NEVER a deploy target.** The sibling tree `apps/dev.one.ie` is dead code — do not build or ship it. The CF git-integration that auto-built `one-substrate` on every push to `one-ie/stage` was disconnected (CF dashboard → Workers & Pages → one-substrate → Settings → Builds). Nothing deploys via repo push anymore.
 > - **Legacy idle (rollback only — do not deploy):**
 >   - `https://oneie.pages.dev` — old Pages project for `one.ie` ("Ecommerce Playbook" content). Re-attach `one.ie` to this project to roll back.
 >   - `app.one.ie`, `demo.one.ie`, `onestudio.dev` — still bound to the prior `one-demo` worker. `one-demo` stays in the account untouched for rollback; redeploying `one-demo` would push stale code, so don't.
->   - `https://one-substrate.pages.dev` — paused Pages project, rollback only.
 >
-> See `docs/cf-workers-migration-todo.md` for migration history. The custom-domain detach step (Pages → Worker) is done manually via the CF API (no in-repo script today).
+> The custom-domain detach step (Pages → Worker) is done manually via the CF API (no in-repo script today).
 
 ## Modes
 
 | Invocation | What |
 |-----------|------|
-| `/deploy` | Full pipeline — W0 + build + 4 services + health |
-| `/deploy --skip-tests` | Skip W0 baseline (risky — use only when already verified) |
-| `/deploy --dry-run` | Build + smoke only, no deploy |
-| `/deploy --preview-only` | Build + preview Worker deploy (no CI-gated services) |
+| `/deploy` | Full pipeline — W0 + build + 5 services + health |
 | `/deploy astro` | Astro Worker only (re-bundle after UI changes) |
 | `/deploy workers` | Gateway + Sync + Agents only (no Astro rebuild) |
 | `/deploy gateway` | Gateway worker only |
 | `/deploy sync` | Sync worker only |
 | `/deploy agents` | Agents edge agents only |
+| `/deploy pay` | Pay gateway (`one-core-worker` → pay.one.ie) only |
 
 ## The 8-Step Pipeline
 
-```bash
-bun run deploy          # full pipeline
-bun run deploy -- --dry-run
-bun run deploy -- --skip-tests
-DEPLOY_CONFIRM=yes bun run deploy   # CI / non-interactive
-```
+> **No root orchestrator exists (confirmed 2026-07-08).** There is no root `package.json` and no `scripts/deploy.ts` in this repo — `bun run deploy` / `bun run verify` at repo root **error with "Script not found"**. The commands below are run manually, per-service, from `Server/one-ie`. If a root orchestrator is ever added, update this note; until then, treat every command in this file as the literal thing to run.
 
-**Step 1 — W0 Baseline**
+**Step 1 — W0 Baseline** (no unified script — run per service)
 ```bash
-bun run verify   # biome + tsc --noEmit + vitest run + audit:design
+# Typecheck all 5 services (each has its own tsconfig, no shared root)
+(cd one.ie/web && bunx tsc --noEmit)
+(cd api && bunx tsc --noEmit)
+(cd sync && bunx tsc --noEmit)
+(cd channels && bunx tsc --noEmit)
+(cd pay/backend && bunx tsc --noEmit)
+
+# Test suite lives only in one.ie/web
+(cd one.ie/web && bunx vitest run)
 ```
-Record tests passed/total. Fix before proceeding — never deploy on red.
+Record tests passed/total. Fix before proceeding — never deploy on red, **except** entries on the Known-Flaky list below (currently environment-dependent, not code regressions).
 
 **Step 2 — Changes**
 `git diff` summary. Flag large changesets.
 
+**Step 2.5 — Commit, PR, Merge**
+Tests are green at this point, so it is safe to commit. The shared tree is pinned to `main` (`hook:branch-pin`) — never `git checkout`/`switch` there. Do the commit + branch + PR in a scratch worktree instead, then merge via `gh` and fast-forward the shared tree.
+```bash
+# 1. From the shared tree (still on main): stage by explicit path, never -A
+git status --porcelain   # review scope
+git diff --stat
+
+# 2. Cut a worktree for the deploy branch
+slug="deploy-$(git rev-parse --short HEAD)"
+git worktree add -b "deploy/$slug" ".do-worktrees/$slug" main
+
+# 3. In the worktree: bring over the same paths, commit, push
+cd ".do-worktrees/$slug"
+git add <explicit paths from step 2>
+git commit -m "$(cat <<'EOF'
+deploy: ship <summary of staged changes>
+EOF
+)"
+git push -u origin "deploy/$slug"
+
+# 4. Open PR, wait for CodeRabbit + any checks, merge
+gh pr create --base main --head "deploy/$slug" --title "deploy: <summary>" --body "Automated deploy PR — see /deploy pipeline"
+gh pr merge "deploy/$slug" --squash --auto --delete-branch
+
+# 5. Back in the shared tree: fast-forward and clean up the worktree
+cd /Users/toc/Server/one-ie
+git switch main   # only allowed HEAD move in the shared tree
+git pull origin main
+git worktree remove ".do-worktrees/$slug"
+```
+Generate the commit message and PR title from the diff — conventional commit format (`feat:`, `fix:`, `chore:`, etc.). If there is nothing to commit (`git status --porcelain` is empty), skip this whole step silently — proceed to Step 3 on the tree as-is.
+
+`gh pr merge --auto` queues the merge and returns immediately if required checks (e.g. CodeRabbit review) are still running; poll `gh pr view "deploy/$slug" --json state,mergedAt` before Step 5's `git pull` if the merge hasn't landed yet — don't build off an unmerged branch.
+
 **Step 3 — Build**
 ```bash
-NODE_ENV=production astro build
+cd one.ie/web && NODE_ENV=production bun run build
 ```
-Target: ~23s. Emits `dist/_worker.js/index.js` + static assets via `@astrojs/cloudflare@13`. Watch for bundle size warnings.
+Target: ~30-35s. Emits `dist/server/` + static assets via `@astrojs/cloudflare@13`, then patches `wrangler.json` with DO bindings and symlinks `.dev.vars`. Watch for bundle size warnings.
+
+**Fixed 2026-07-19:** the build was V8-heap-OOMing (`FATAL ERROR: Reached heap limit … JavaScript heap out of memory`, `Abort trap: 6`, exit 134) at Node's default ~4 GiB old-space ceiling — not a system memory shortage (5+ GiB free at the time). `package.json`'s `build` script now sets `NODE_OPTIONS=--max-old-space-size=8192` inline, so plain `bun run build` picks it up automatically; no manual env var needed anymore.
 
 **Step 4 — Credentials**
 `CLOUDFLARE_API_TOKEN` must be unset. Deploy uses `CLOUDFLARE_GLOBAL_API_KEY` only.
 Scoped tokens lack permissions for workers + custom domains.
+```bash
+unset CLOUDFLARE_API_TOKEN
+echo "${CLOUDFLARE_GLOBAL_API_KEY:+set}" "${CLOUDFLARE_EMAIL:+set}"   # both must print "set"
+```
 
 **Step 5 — Smoke**
-Verify `dist/server/` exists, all 4 wrangler configs present: `api/wrangler.toml`, `sync/wrangler.toml`, `agents/wrangler.toml`, root `wrangler.toml`.
+Verify `dist/server/` exists, all 5 wrangler configs present: `api/wrangler.toml`, `sync/wrangler.toml`, `channels/wrangler.toml`, `one.ie/web/wrangler.toml`, `pay/backend/wrangler.toml`.
 
 **Step 6 — Approval**
 `main` branch: prompts "yes". Other branches: auto-approved.
-CI: `DEPLOY_CONFIRM=yes bun run deploy` (already set in `.github/workflows/deploy.yml`).
 
 **Step 6.5 — D1 Migrations**
 Run before any worker deploy so schema is current when new code lands:
 ```bash
-cd one.ie/web && bunx wrangler d1 migrations apply DB --remote --env production
+cd one.ie/web && bunx wrangler d1 migrations apply DB --remote
 ```
-"✅ No migrations to apply!" is a pass. Any applied migration is logged and counted.
+**No `--env production`** — same deploy-target trap as the worker deploy itself (see trap note at top of file); `wrangler.toml`'s `[[routes]]`/`[triggers]` were reconciled to top level 2026-07-04 so there is no env-scoped target left to hit, and passing `--env production` here has no matching env block to resolve against.
+"✅ No migrations to apply!" is a pass. Any applied migration is logged and counted (e.g. `0195_workspace_sources.sql` applied 2026-07-08, 4.63ms).
 Migration failures block deploy — never ship worker code ahead of its schema.
 
-**Step 7 — Deploy (parallel workers + astro)**
-Gateway + Sync + Agents deploy in parallel (~16s). Astro Worker deploys after (~16s).
+**Step 7 — Deploy (parallel workers + astro + pay)**
+```bash
+(cd api && unset CLOUDFLARE_API_TOKEN && bunx wrangler deploy) &
+(cd sync && unset CLOUDFLARE_API_TOKEN && bunx wrangler deploy) &
+(cd channels && unset CLOUDFLARE_API_TOKEN && bunx wrangler deploy) &
+(cd pay/backend && unset CLOUDFLARE_API_TOKEN && bun run deploy) &
+wait
+cd one.ie/web && unset CLOUDFLARE_API_TOKEN && bunx wrangler deploy   # after the 4 above land
+```
+Gateway + Sync + Agents + Pay deploy in parallel (~10s each). Astro Worker deploys after (~30s — largest bundle).
 
 **Step 8 — Health**
 ```bash
 curl https://api.one.ie/health                   # Gateway
 curl https://one.ie/api/health                   # Astro Worker (production)
-curl https://one-sync.oneie.workers.dev/         # Sync
-curl https://agents.oneie.workers.dev/health   # Agents
+curl https://channels.one.ie/health              # Agents (channels) — custom domain
+curl https://pay.one.ie/                         # Pay gateway — 200 on root is the gate
+curl https://pay.one.ie/status                   # …and /status returns status:"ok" (richer; no /health on this entry)
+# Sync (one-sync) is a CRON-ONLY worker (no HTTP route) — no health endpoint.
+# Its successful `wrangler deploy` ("Deployed one-sync triggers") IS the health signal.
 ```
-3 retries with backoff. All 4 must return 200. Astro `/api/health` must report `units: 140` (or current count) — empty `units: 0` means the build didn't bake `PUBLIC_GATEWAY_URL` correctly.
+3 retries with backoff. The 4 HTTP services must return 200. Astro `/api/health` returns `{"status":"ok","agent":"one-prod","model":…,"hasOpenRouter":true}` — assert `status:"ok"`. (The old `units: N` field was removed; there is no `units` to check anymore.)
+
+> **Network gotcha:** `*.oneie.workers.dev` URLs are **blocked on this network** (curl exit 6/28). Always health-check via the custom domains: `api.one.ie`, `one.ie`, `channels.one.ie`. The agents worker is named **`channels`** and is reachable at **`channels.one.ie`**, not `agents.oneie.workers.dev`.
 
 ---
 
@@ -111,10 +169,18 @@ language grammar files into the SSR worker on every build. **Do not re-enable.**
 
 ```js
 ssr: {
-  external: ["node:async_hooks", "@mysten/sui", "@mysten/bcs", "shiki", "@shikijs/core", "@shikijs/types"]
+  external: ["node:async_hooks", "shiki", "@shikijs/core", "@shikijs/types", /* … */]
 }
 ```
 
+**`one.ie/web/astro.config.mjs` § `vite.ssr.external` is the authority for this
+list — never reconcile that file to this doc.** It carries 17 entries as of
+2026-08-02 (`cookie`, `cytoscape`, `@xyflow/react`, `recharts`, `@stripe/*`,
+`media-chrome`, `motion`, `@100mslive/*`, … alongside the shiki trio). Deleting
+entries to match a stale snippet here would blow the bundle. A companion
+`build.rollupOptions.external` also drops anything matching `shiki/` or
+`@shikijs/` by prefix.
+
 The CF adapter bundles everything by default. `ssr.external` creates a bare
 `import { x } from 'pkg'` reference without inlining the package.
 
@@ -147,12 +213,16 @@ at runtime.
 **Use this pattern for:** any page that has no server-side data dependencies
 (no `Astro.locals`, no `Astro.request`, no DB queries in frontmatter).
 
-Currently prerendered (verify with `grep -l "export const prerender = true" src/pages/*.astro`):
-`404.astro`, `board.astro`, `build.astro`, `ceo.astro`, `chat.astro`, `chat-agents.astro`,
-`chat-fast.astro`, `chat-routing.astro`, `in.astro`, `speed.astro`.
+The prerendered set changes every cycle — never hardcode it. Read it from the
+tree (34 pages as of 2026-08-02):
 
-Pages that CANNOT be prerendered (need runtime session/auth):
-`world.astro` (reads `Astro.locals.session`), `market.astro` (fetches capabilities).
+```bash
+cd one.ie/web && grep -l "export const prerender = true" src/pages/*.astro
+```
+
+Pages that CANNOT be prerendered: any page whose frontmatter reads
+`Astro.locals` (session/workspace context), `Astro.request`, or queries the DB.
+Those must stay SSR.
 
 ### Rule 4 — `inlineStylesheets: 'auto'` in `astro.config.mjs`
 
@@ -194,6 +264,9 @@ Do not remove for production builds.
 | 2026-04-18 (post Pages→Workers migration) | — | — | 9.5 MiB | Rules 1-3 + 5 |
 | 2026-05-22 before `inlineStylesheets` fix | 18.5 MiB | 3.3 MiB | 9.5 MiB | Over 3 MiB ceiling — deploy FAILED |
 | 2026-05-22 after Rule 4 (`'always'` → `'auto'`) | 10.1 MiB | **2.1 MiB** | **672 KiB** | Under ceiling — deploy ✓ |
+| 2026-07-08 | 14.7 MiB | **3.22 MiB** | — | **Exceeds the documented 3 MiB (3072 KiB) free-tier ceiling and still deployed successfully.** Either this account is on a paid Workers plan (10 MiB ceiling) rather than free tier, or the ceiling figure elsewhere in this doc is stale — unconfirmed which. Don't treat "under 3 MiB" as a hard gate until this is resolved; treat 3.2 MiB as the new floor to watch, and re-run Bundle Size Diagnosis if growth continues. |
+| 2026-07-19 | 20.2 MiB | **4.43 MiB** | — | +37% over 2026-07-08's 3.22 MiB. Deployed successfully — no diagnosis run yet. Growth window covers several merged features that day (newsletter platform, directory-submission, social-formats, movers-playbook, etc.) landing in one `/deploy` cycle; not isolated to a single change. Re-run Bundle Size Diagnosis if the next snapshot keeps climbing. |
+| 2026-07-29 | 20.9 MiB | **4.60 MiB** | 1.2 MiB | +6% over 2026-07-19, third consecutive climb. Cheap diagnosis WAS run this cycle (the two grep/`ls` commands below, not a full audit): **no single runaway** — Shiki hits 0, top chunks are `_astro_data-layer-content` 2.1 MiB (content collections), `worker-entry` 1.2 MiB (up from 672 KiB at the 2026-05-22 baseline), `index` 1.3 MiB, `icons` 0.8 MiB, `mermaid` 0.8 MiB, `stripe.esm.worker` 0.6 MiB, `react-vendor` 0.5 MiB. Growth is diffuse feature accretion, not a regression; this deploy's own diff was test-only. Two named candidates if a real audit is ever warranted: `mermaid` (0.8 MiB in the SSR bundle — Rule 2 `ssr.external` candidate if it's only reached from `client:only` islands) and the 15 chunks referencing `react-vendor` (Rule 3 suggests some page still SSR-renders React via `client:load`). |
 
 The 2026-05-22 regression was caused by `build: { inlineStylesheets: 'always' }`
 inlining the full Tailwind stylesheet into every route's manifest entry. One
@@ -205,11 +278,11 @@ char change (`always` → `auto`) saved 8.8 MiB.
 
 | Service | URL | Config | Deploy command |
 |---------|-----|--------|---------------|
-| Astro Worker (prod) | `one.ie` → `one-prod` | `one.ie/web/wrangler.toml` | `cd one.ie/web && wrangler deploy --env production` |
-| Astro Worker (dev) | `dev.one.ie` → `one-substrate` | `wrangler.toml` (root) | `wrangler deploy` |
+| Astro Worker (prod) | `one.ie` → `one-prod` | `one.ie/web/wrangler.toml` | `cd one.ie/web && wrangler deploy` — **no `--env production`** (deploy-target trap: appends `-production` to the script name → `one-prod-production`, which nothing routes to; see trap note at top of this file) |
 | Gateway | `api.one.ie` → `one-gateway` | `api/wrangler.toml` | `cd api && wrangler deploy` |
-| Sync | `one-sync.oneie.workers.dev` | `sync/wrangler.toml` | `cd sync && wrangler deploy` |
-| Agents | `agents.oneie.workers.dev` | `agents/wrangler.toml` | `cd agents && wrangler deploy` |
+| Sync | `one-sync` — **cron-only, no HTTP route** (health = deploy success) | `sync/wrangler.toml` | `cd sync && wrangler deploy` |
+| Agents | `channels.one.ie` → `channels` (`*.workers.dev` blocked on this network) | `channels/wrangler.toml` | `cd channels && wrangler deploy` |
+| Pay gateway | `pay.one.ie` → `one-core-worker` | `pay/backend/wrangler.toml` | `cd pay/backend && bun run deploy` (= bare `wrangler deploy`, no `--env` flag) |
 | Pages (legacy idle, rollback) | `oneie.pages.dev` | — | **do not deploy** — rollback target for `one.ie` |
 | Worker (legacy idle, rollback) | `one-demo` (still serves `app.one.ie`, `demo.one.ie`, `onestudio.dev`) | — | **do not deploy** — rollback window for the prod cutover |
 
@@ -223,13 +296,9 @@ Never: `CLOUDFLARE_API_TOKEN` (scoped token lacks workers + custom domain permis
 The deploy script auto-unsets `CLOUDFLARE_API_TOKEN` from the spawned env to prevent
 accidental use of a scoped token that was exported in the shell.
 
-CI secrets required in `.github/workflows/deploy.yml` env block:
-- `CLOUDFLARE_API_KEY` (mapped from `secrets.CLOUDFLARE_GLOBAL_API_KEY`)
-- `CLOUDFLARE_EMAIL`
-- `CLOUDFLARE_ACCOUNT_ID`
-- `CLOUDFLARE_API_TOKEN: ''` (explicit blank)
-- `DEPLOY_CONFIRM: 'yes'`
-- `PUBLIC_GATEWAY_URL: https://api.one.ie` (build-time-inlined by Astro — **required**; without this the Worker bundle falls back to `one-gateway.oneie.workers.dev` and `/api/health` returns `units: 0`)
+Required env (export locally before running any deploy step — there is no CI, no root script):
+- `CLOUDFLARE_GLOBAL_API_KEY` + `CLOUDFLARE_EMAIL` — auth
+- `PUBLIC_GATEWAY_URL: https://api.one.ie` — build-time-inlined by Astro (**required**; without it the Worker bundle falls back to `one-gateway.oneie.workers.dev` and gateway-backed routes break). Lives in `one.ie/web/.env`.
 
 ---
 
@@ -237,25 +306,25 @@ CI secrets required in `.github/workflows/deploy.yml` env block:
 
 ### `/deploy` (full pipeline)
 
-1. `bun run verify` — W0 gate. Fail here means don't deploy.
-2. `git diff` summary — surface scope to user.
-3. `NODE_ENV=production bun run build` — Astro production build.
-4. Verify credentials: assert `CLOUDFLARE_GLOBAL_API_KEY` present, unset `CLOUDFLARE_API_TOKEN`.
-5. Smoke check: assert `dist/_worker.js/` exists, all 4 wrangler configs present.
-6. Approval gate: prompt on `main`, auto on other branches.
-7. Parallel deploy: Gateway + Sync + Agents concurrently, then Astro Worker.
-8. Health checks: all 4 endpoints × 3 retries with backoff.
-9. Report:
+1. Per-service typecheck + `one.ie/web` vitest — W0 gate (see Step 1 above; no unified script exists). Fail here means don't deploy, except Known-Flaky entries.
+2. `git status --porcelain` + `git diff --stat` — surface scope to user. **Stage by explicit path, never `git add -A`** — untracked scratch/backup dirs (e.g. `.wip-backups/`) belong to prior sessions, not this commit.
+3. Commit, PR, merge — worktree branch, push, `gh pr create`, `gh pr merge --squash --auto --delete-branch`, then `git switch main && git pull` on the shared tree (see Step 2.5). Skip entirely if working tree is clean.
+4. `cd one.ie/web && NODE_ENV=production bun run build` — Astro production build.
+5. Verify credentials: assert `CLOUDFLARE_GLOBAL_API_KEY` present, unset `CLOUDFLARE_API_TOKEN`.
+6. Smoke check: assert `dist/server/` exists, all 5 wrangler configs present.
+7. Run D1 migrations (Step 6.5): `bunx wrangler d1 migrations apply DB --remote` — no `--env`.
+8. Parallel deploy: Gateway + Sync + Agents + Pay concurrently, then Astro Worker.
+9. Health checks: 4 HTTP endpoints (Gateway, Astro, Channels, Pay via custom domains, cache-busted with `?_t=$(date +%s)`) × 3 retries with backoff; Sync verified by deploy success.
+10. Report:
    ```
    Branch:     main
-   Tests:      320/320 pass
-   Build:      23.2s
-   Migrations: 2 applied (0 already up-to-date)
-   Workers:    parallel 16.7s (vs ~42s sequential)
-   Astro:      16.1s
-   Health:     4/4 (Gateway 308ms, Astro 666ms, Sync 287ms, Agents 287ms)
-   Preview:    https://<hash>.one-substrate.<account>.workers.dev
-   Total:      ~65s
+   Tests:      4082/4084 pass (2 known-flaky: SSRF DoH lookup, sandbox-network-blocked)
+   Typecheck:  5/5 services clean
+   Build:      33.4s
+   Migrations: 1 applied (0195_workspace_sources.sql)
+   Workers:    gateway+sync+channels+pay parallel, then astro
+   Health:     4/4 HTTP 200 (Gateway, Astro, Channels, Pay) + Sync deploy-confirmed
+   Bundle:     gzip 3220 KiB (exceeds documented 3072 KiB free-tier figure, deploy succeeded — see Verified Bundle Numbers note)
    ```
 
 ### `/deploy astro`
@@ -265,9 +334,11 @@ Deploys the production worker (`one-prod`) to `one.ie` from the `one.ie/web/` di
 1. `cd one.ie/web && NODE_ENV=production bun run build`
 2. Check bundle size: `du -sh one.ie/web/dist/server/`
 3. If > 12 MiB: check which chunk grew (`ls -lhS one.ie/web/dist/server/chunks/ | head -15`)
-4. Run D1 migrations: `cd one.ie/web && bunx wrangler d1 migrations apply DB --remote --env production`
-5. `cd one.ie/web && bunx wrangler deploy --env production`
-6. Health: `curl -sL https://one.ie/api/health` (expect 200, `units > 0`)
+4. Run D1 migrations: `cd one.ie/web && bunx wrangler d1 migrations apply DB --remote` (**no `--env production`** — see Step 6.5 note)
+5. `cd one.ie/web && bunx wrangler deploy` — **no `--env production`** (deploy-target trap: see note at top of this file — `--env production` appends `-production` to the worker name and ships to a script nothing routes to)
+6. Health: `curl -sL "https://one.ie/api/health?_t=$(date +%s)"` (expect 200, `status:"ok"`) — always cache-bust with `?_t=`, see Gotchas § cache-control on errors
+
+**Resolved 2026-07-04:** `one.ie/web/package.json`'s `"deploy"` script had the same `--env production` trap. Confirmed via the CF API that it was real — neither `one-prod` (live) nor the `one-prod-production` decoy had any cron schedules registered, meaning `billing-alerts-cron.ts`/`billing-allocation-cron.ts`/`billing-autotopup-cron.ts`/`billing-lifecycle-cron.ts`/`billing-verify-cron.ts`/`funnel-aggregate-cron.ts`/`webhook-deliver.ts`/`broadcast-drain-cron.ts` were not running on any schedule. Fixed by reconciling `wrangler.toml`: the `[[routes]]` (custom domain) and `[triggers]` (crons) blocks — the only two things that existed *only* under `[env.production]` — were moved to top level (everything else was already duplicated there); the now-fully-redundant `[env.production.*]` block was deleted entirely, and `package.json`'s script dropped `--env production`. The trap is now structurally impossible — there's no `--env production` target left to hit.
 
 **Pre-flight (one-time, on cutover only):** ensure no other CF entity owns the `one.ie` custom domain. If wrangler errors with a hostname conflict, detach the prior owner first:
 
@@ -281,24 +352,31 @@ curl -s -X DELETE \
 
 ### `/deploy workers`
 
+Verified 2026-07-08: all three complete independently with no shared state, so
+run them in parallel (this matches Step 7 of the full pipeline).
+
 ```bash
-cd api && bun wrangler deploy && cd ../workers/sync && bun wrangler deploy && cd ../../agents && bun wrangler deploy && cd ..
+(cd api && unset CLOUDFLARE_API_TOKEN && bunx wrangler deploy) &
+(cd sync && unset CLOUDFLARE_API_TOKEN && bunx wrangler deploy) &
+(cd channels && unset CLOUDFLARE_API_TOKEN && bunx wrangler deploy) &
+wait
 ```
 
 Report: version hash per worker, health latency per service.
 
-### Cutover tool (`scripts/cf-cutover.ts`)
+### `/deploy pay`
 
-For Pages→Workers custom-domain flips on other services (script is parameterized):
+Deploys the pay gateway (`one-core-worker`) to `pay.one.ie` from the `pay/backend/` directory.
 
-```bash
-bun run cf-cutover                # dry-run, safe
-bun run cf-cutover --execute      # real cutover: Workers route + Pages detach + health verify + substrate signal
-```
+1. `cd pay/backend && bunx tsc --noEmit` (no dedicated `typecheck` script — run `tsc` directly)
+2. `unset CLOUDFLARE_API_TOKEN && bun run deploy` (= bare `wrangler deploy`, no `--env` flag)
+3. Health — both probed live 2026-08-02, both **200**, neither authenticated:
+   - Gate: `curl -sL -o /dev/null -w "%{http_code}" https://pay.one.ie/` (expect 200)
+   - Richer: `curl -sL https://pay.one.ie/status` → assert `status:"ok"` (also reports version, destinationMode, contract addresses)
 
-Defaults: domain=`dev.one.ie`, worker=`one-substrate`, pages=`one-substrate`. Override via `CF_CUTOVER_DOMAIN`, `CF_CUTOVER_WORKER`, `CF_CUTOVER_PAGES_PROJECT` env vars.
+   `pay/backend/src/index.ts` mounts `pay/backend/src/routes/status.ts` (`/status`) and `discoveryRoutes` (`/`). It does **not** serve `/health` — the `/health` handler in `pay/backend/src/api/routes/status.ts` belongs to the separate, unmounted `src/api/` tree. Do not health-check `/health` here; it 404s.
 
----
+**Found 2026-07-05:** `pay/backend` shipped a real commit (`feat(pay): embeddable payment-link page`) that sat unshipped through a full `/deploy` cycle because the skill's service map only named 4 services. `pay.one.ie` is a first-class 5th deploy target, not a manual afterthought — check `git log` scoped to `pay/` for unshipped commits on every `/deploy` run, the same as the other 4 services.
 
 ## Bundle Size Diagnosis
 
@@ -328,73 +406,92 @@ grep -l "react-vendor" dist/server/chunks/
 
 ```bash
 # Workers — rollback to previous version
-bun wrangler rollback --name one-prod        # production
-bun wrangler rollback --name one-substrate   # dev
-
-# Legacy Pages fallback (still live at one-substrate.pages.dev for rollback window):
-bun wrangler pages deployment list --project-name=one-substrate
-bun wrangler pages deployments rollback --project-name=one-substrate
-
-# Revert a Worker via git
-cd api && git stash && bun wrangler deploy
+cd one.ie/web && bunx wrangler rollback --name one-prod        # production
+
+# Redeploy a Worker from its last-committed code WITHOUT touching the shared tree.
+# Never `git checkout HEAD -- .` here: it silently destroys every uncommitted
+# change under that path, including a concurrent session's. `hook:branch-pin`
+# permits pathspec restores, so nothing will stop you — that's why it's banned by
+# convention. `git stash` is blocked outright by hook:git-add-guard.
+# Cut a throwaway worktree at the good commit and deploy from there instead.
+# A fresh worktree has NO node_modules — install before wrangler, or bunx fails:
+git worktree add /tmp/rollback-wt <good-sha>
+(cd /tmp/rollback-wt/api && bun install && unset CLOUDFLARE_API_TOKEN && bunx wrangler deploy)
+git worktree remove /tmp/rollback-wt
 ```
 
+`wrangler rollback` is the cheaper move when the last good code is simply the
+previous deployment — it needs no worktree and no rebuild.
+
 ---
 
 ## Known-Flaky Test Allowlist
 
-Located in `scripts/deploy.ts`:
-
-```typescript
-const KNOWN_FLAKY = [
-  'Act 15: Speed Benchmarks',  // hardware-dependent
-  'STAN distribution',          // stochastic
-  'explorer mode',              // stochastic
-]
-```
-
-These failures don't block deploy. Real failures (type errors, broken logic)
-always block. Use `--strict` to require full green.
+No allowlist is enforced in code (`scripts/deploy.ts` doesn't exist in this repo — see
+pipeline note above). Treat these by name when they appear in `bunx vitest run` output
+in `one.ie/web`; don't block deploy on them, but don't silently ignore new failures either
+— confirm the failure signature matches before waving it through:
+
+- `tests/e2e/c5-webhook-subscribe.test.ts` — `workflow:webhook-subscribe` "writes a KV
+  record…" and "fails closed on a non-owned workflow". **Root cause (confirmed 2026-07-08):**
+  `ssrfGuard()` (`one.ie/web/src/lib/ssrf.ts`) resolves DNS via Cloudflare DoH by fetching
+  `https://1.1.1.1/dns-query` directly; this local dev network refuses connections to
+  `1.1.1.1:443` (`curl: (7) Failed to connect`), so `resolveHostIPs` returns `[]` and every
+  URL — including the test's `https://example.com` — comes back `blocked_url`. Verify before
+  waving through: `curl -v --max-time 5 https://1.1.1.1/dns-query 2>&1 | grep -i refused`
+  — if that shows "Connection refused", it's this network gap, not a code regression. If it
+  connects fine and the test still fails, it's real — investigate.
+- Hardware/stochastic benchmarks (speed, distribution-timing tests) — expected variance,
+  not correctness bugs.
+
+Any other failure (type errors, assertion mismatches on business logic) blocks deploy —
+diagnose and fix before proceeding.
 
 ---
 
 ## First-Time Setup
 
-Only needed once — see `docs/deploy.md` for full walkthrough:
+Only needed once. There is no `docs/deploy.md` — this block plus the 8-Step
+Pipeline above is the whole walkthrough. Resource names below are the ones
+actually declared in `one.ie/web/wrangler.toml`; creating differently-named
+resources produces bindings the Worker can't resolve.
 
 ```bash
-# Create CF resources
-bun wrangler d1 create one
-bun wrangler kv namespace create KV
-# → Paste IDs into wrangler.toml + sync/wrangler.toml
-
-# Run D1 migration
-bun wrangler d1 execute one --remote --file=migrations/0001_init.sql
-
-# Gateway secrets (TypeDB credentials)
+# Create CF resources — names must match wrangler.toml exactly
+bunx wrangler d1 create one-owners                # → binding DB
+bunx wrangler kv namespace create SESSION         # → binding SESSION
+bunx wrangler kv namespace create CHAT_CACHE      # → binding CHAT_CACHE
+bunx wrangler kv namespace create THREADS         # → binding THREADS
+bunx wrangler r2 bucket create one-content        # → binding CONTENT
+# → Paste IDs into one.ie/web/wrangler.toml + sync/wrangler.toml
+
+# Run D1 migrations (the ledger starts at 0001_owners.sql — there is no 0001_init.sql)
+cd one.ie/web && bunx wrangler d1 migrations apply DB --remote
+
+# Gateway secrets (TypeDB credentials) — no --env flag, ever
 cd api
-printf 'admin' | bun wrangler secret put TYPEDB_USERNAME
-printf 'YOUR-PASSWORD' | bun wrangler secret put TYPEDB_PASSWORD
+printf 'admin' | bunx wrangler secret put TYPEDB_USERNAME
+bunx wrangler secret put TYPEDB_PASSWORD   # paste at the prompt; never inline the value
 cd ..
 
 # First deploy — Worker auto-provisions on first `wrangler deploy`
-bun run deploy
+# (see "The 8-Step Pipeline" above for the actual per-service commands — no root script)
 ```
 
 ---
 
 ## Logs
 
-- `.deploy.log` — all deployment output, each worker appends here
-- `.deploy-build.log` — W0 baseline diagnostics (biome + tsc + vitest separate)
+No `.deploy.log` / `.deploy-build.log` files are written today — there is no wrapper
+script to produce them (see pipeline note at top of file). Output only lives in each
+`wrangler deploy` command's own stdout; capture it yourself if a durable record is needed.
 
 Live logs:
 
 ```bash
-bun wrangler tail --name one-prod            # Astro Worker (production)
-bun wrangler tail --name one-substrate       # Astro Worker (dev)
-cd api && bun wrangler tail && cd ..     # Gateway
-bun wrangler deployments list --name one-prod | head -10
+cd one.ie/web && bunx wrangler tail --name one-prod   # Astro Worker (production)
+cd api && bunx wrangler tail                          # Gateway
+cd one.ie/web && bunx wrangler deployments list --name one-prod | head -10
 ```
 
 ---
@@ -404,9 +501,9 @@ bun wrangler deployments list --name one-prod | head -10
 - TypeDB Cloud port is **1729** (not 80 or 443)
 - TypeDB HTTP API prefix is `/v1/` (signin, query, databases)
 - Always `CLOUDFLARE_GLOBAL_API_KEY` — scoped tokens lack permissions for workers + custom domains
-- `import.meta.env` is build-time — `PUBLIC_GATEWAY_URL` is baked into the worker bundle at build. Missing → `/api/health` returns `units: 0`
+- `import.meta.env` is build-time — `PUBLIC_GATEWAY_URL` is baked into the worker bundle at build. Missing → gateway-backed routes fall back to the wrong host and break
 - Custom domains: `[[routes]]` double bracket, no wildcards, add `workers_dev = true`
-- Worker upload limit: **3 MiB gzipped** on free tier (10 MiB on paid). Wrangler reports `gzip:` — only that number counts. Follow the 5 Bundle Size Rules above
+- Worker upload limit: **3 MiB gzipped** on free tier (10 MiB on paid) — though a 2026-07-08 deploy shipped at 3.22 MiB gzip successfully, so this account's actual ceiling is unconfirmed (see Verified Bundle Numbers). Wrangler reports `gzip:` — only that number counts. Follow the 5 Bundle Size Rules above regardless of which ceiling applies
 - **D1 schema-drift fails at runtime, not compile-time.** Migrations that DROP+CREATE a table (e.g. `0059_domains.sql` renamed `slug`→`gid`, `verified`→`verified_at`) silently break any code that queries the old columns — typecheck passes, deploy succeeds, the route 500s in production. After any DROP+CREATE migration, grep the codebase for the old column names and fix call sites BEFORE deploying
 - **Error responses get the same `cache-control` as success responses.** Astro's Layout sets `public, max-age=300, s-maxage=86400, stale-while-revalidate=604800` on every render including 5xx pages. A bad deploy will be cached at the CF edge for 24h. When diagnosing, always bust the cache: `curl "https://host/path?_t=$(date +%s)"`. Consider a middleware rule that strips `cache-control` on `>= 500` status
 

package/commands/do-autonomous.md

@@ -1,6 +1,9 @@
 # /do autonomous loop
 
-Loaded by `do.md` for empty invocation or `--once` flag.
+Invoked directly (`/do-autonomous`); `do.md` has no `--once` row in Step 0. The live
+headless contract is `do.md` § *Autonomous gate resolution* (`--autonomous` /
+`DO_AUTONOMOUS=1`), backed by `one.ie/web/src/lib/do-autonomous.ts` and
+`text/do-autonomous-plan.md`. This file is the task-queue loop it runs.
 
 ---
 
@@ -13,22 +16,27 @@ ORIENT: Read text/TODO-plan.md
         → note the active front (Atomicity / Vocabulary / New Surfaces)
         → note the Top 15 priority list
         → let this shape which task you pick
+        → every task traces UP to a promise (text/<slug>.md): the work is kept
+          only when the promise's proof: still exits 0. Reconcile upward, never against it.
 ```
 
 ```
 loop:
-  SENSE:    GET http://localhost:4321/api/tasks
+  SENSE:    POST http://localhost:4321/api/ask/tasks:mine     (or tasks:everywhere)
+            (/api/tasks does not exist — tasks:* receivers are the only door,
+             and /api/ask is POST-only)
             Sort by priority (effective = score + strength − resistance)
             Skip blocked tasks (blockedBy non-empty)
 
   SELECT:   Pick highest unblocked (P0 > P1, attractive > ready > exploratory)
-            If all blocked: GET /api/state → follow pheromone highways (deadlock escape)
+            If all blocked: GET /api/export/highways → follow pheromone highways
+            (deadlock escape; /api/state does not exist)
 
   EXECUTE:
     BRIEF (before touching any file):
       source = task.source
-      If source missing: grep -l "{task.name}" docs/*-todo.md
-      Read docs/{source}-todo.md:
+      If source missing: grep -l "{task.name}" text/*-todo.md
+      Read text/{source}-todo.md:
         • frontmatter source_of_truth → spec docs to pre-load
         • find checkbox matching task.name → note exit criteria + "See also"
         Read each source_of_truth entry (first 80 lines each)
@@ -38,23 +46,28 @@ loop:
 
   VERIFY:   bun tsc --noEmit on touched files
 
-  MARK:     POST http://localhost:4321/api/tasks/{id}/complete
-
-  CLOSE:    POST http://localhost:4321/api/loop/cycle-close {
-              slug,
-              kind: "code",
-              scores: { security, stability, simplicity, speed }
-            }
-            composite = 0.35·security + 0.30·stability + 0.25·simplicity + 0.10·speed
+  MARK:     POST http://localhost:4321/api/ask/tasks:status
+              { "data": { "tid", "status": "done", "workspace": "<slug>" } }
+            (/api/tasks/{id}/complete does not exist — tasks:status is the only
+             status door, same as /close)
+
+  CLOSE:    Neither /api/loop/cycle-close nor /api/loop/close exists. The live
+            cycle-close door is the world:do-event receiver:
+            POST http://localhost:4321/api/signal/world:do-event
+              { "data": { "type": "learn", "slug", "cycle", "composite", "tags": [...] } }
+            composite = the `task` rubric — weights are data in
+            .claude/scripts/rubric-weights.json (`task` block), which
+            w4-rubric.ts reads. Today: 0.30·security + 0.25·stability +
+            0.20·simplicity + 0.15·integration + 0.10·speed.
+            This is the 5-axis TASK rubric — NOT the in-cycle W4 composite,
+            which carries goal-fit at 0.30 and gates on it at >= 0.50
+            (see do.md § W4). w4-rubric.ts prints it as `task-composite=`
+            so the two can never be confused in a log.
             composite ≥ 0.65 → mark(loop:cycle:{slug}, composite × 5)
             composite < 0.65 → warn equivalents (route back to W3, max 3 W4 loops)
-            Response: { ok, slug, kind, composite, gate: "pass"|"fail", marks: { cycle, namespaced } }
-
-            Note: /api/loop/close (without "cycle-") is a different endpoint —
-            it manages WorkLoop session/stage tracking. Don't confuse them.
 
-  FEEDBACK: POST http://localhost:4321/api/signal {
-              receiver: 'loop:feedback',
+  FEEDBACK: POST http://localhost:4321/api/signal/loop:feedback {
+              (receiver is a PATH segment — /api/signal bare returns 400)
               data: {
                 tags: task.tags,
                 strength: rubricAvg,
@@ -65,7 +78,7 @@ loop:
             strength < 0.65 → warn(0.5) each tag path
             Always emit — even timeout, even dissolved. Every loop closes.
 
-  GROW:     GET http://localhost:4321/api/highways → report learned paths
+  GROW:     GET http://localhost:4321/api/export/highways → report learned paths
 
   → repeat
 ```