Deployment

Readiness first

Do not treat this as production until T10 is dated in VERIFICATION.md. Put Cloudflare Access on the Worker, with a bypass only for /api/slack/events, /api/slack/command, and /api/github/webhook. Read Security and Readiness first.

Live operation requires a Cloudflare account with Workers, Durable Objects, Workers AI, and Containers/Sandbox access. Check current eligibility, quotas, and pricing in the Containers and Sandbox documentation. No provisioning time is guaranteed.

AI Gateway setup

1. Create or select an account-owned AI Gateway. Its ID is GATEWAY_ID.
2. Review the Google AI Studio provider guide and configure supported stored BYOK credentials or Unified Billing.
3. The current internal helper uses AI.gateway(GATEWAY_ID).run with the native Google endpoint and provider-native JSON. It does not use CF_ACCOUNT_ID or AI_GATEWAY_TOKEN. The Worker AI binding supplies account access.
4. Keep real provider credentials outside the container. OpenCode uses a dummy Google key.
5. Confirm a live coding run against a throwaway repo before claiming it works. Provider keys stay in AI Gateway BYOK; the container never sees them.

For direct HTTP integrations outside this code, authenticated gateways use cf-aig-authorization, not an interchangeable generic Authorization header. Consult gateway authentication and stored BYOK. Do not copy obsolete token-proxy instructions into this implementation.

Prepare locally

pnpm install
pnpm typecheck
pnpm lint
pnpm test
pnpm docs:check
pnpm build
npx wrangler deploy --dry-run

The dry run is packaging validation, not deployment. Record missing Docker, image, or runtime limitations honestly. Building the docs does not require live coding credentials.

Deployment commands after blockers are resolved

npx wrangler login
# Configure optional GitHub secrets described in Configuration.
pnpm build
pnpm deploy

These commands change your Cloudflare account. pnpm deploy does not automatically build assets. Wrangler uses ./Dockerfile for the image and ./public for assets; the dashboard is at / and docs at /docs/. Static missing paths use 404-page rather than an SPA catch-all.

Protect every reachable hostname, including alternate workers.dev routes, with reviewed authentication. Browser login alone does not authenticate service callbacks. Never expose the Worker origin outside Access. Complete the acceptance procedure in an isolated test installation before inviting users.

Updates and recovery

Preserve the previous revision and lockfile. Re-run checks, review Durable Object migrations, and validate in a test installation. Code rollback does not automatically restore Durable Object data or undo GitHub branches/PRs. Avoid deleting runtime data as part of a routine docs update.