Prompt for the future agent#

You own the final simplification and production cutover of Forge's release system. Begin by reading every file in docs/forensics/2026-08-11-release-simplification-failure/, followed by the three authoritative linked documents. Treat all recorded IDs and states as historical evidence only; independently re-read current main, origin/main, PRs, workflow runs, D1, Cloudflare, bindings, tokens, and rollback targets before any mutation.

Your objective is not to finish or harden the existing collection of release subsystems. It is to reduce them to one ordinary lifecycle:

PR -> complete preview -> merge main
main -> exact affected-project build requests
builder -> immutable zero-traffic ready Worker versions
project lane -> expected-current publish -> generic health -> receipt/restore

Cloudflare's active stable Worker deployment is runtime truth. D1 is evidence and a read model. A private runner host is one attempt-derived Worker with one version and one deployment, used only as immutable build preparation. It has no publication lane, current pointer, repair loop, or rollback operation. The stable runner Worker version is the sole production selector.

Delete or make unreachable every legacy controller, production candidate, global component, dependency wave, cumulative baseline, manual generation seed, bootstrap-after-cutover, synthetic authority switch, compatibility field, and alternate publication path that is not required by that lifecycle. Do not modernize legacy machinery. Do not add adapters, dual running, durable host/app state, or another controller under the name of reconciliation.

First diagnose the currently observed normal-path failure: release request 73d3f4ba-f50f-4791-9b3a-77f003cbc8ac for PR #165 and source 359dfff476f38f330b809fab94a8943bbc259c8e was last observed stuck in validating with empty evidence and no exact-SHA Platform CI/Preview runs. Do not assume that is still current. If it remains, repair only the immutable validation-event to workflow-run delivery. Do not seed a main generation, wake a controller, adopt an old attempt, or bypass preview.

Before production, prove with the real compiled runner-host output that the Beta Worker-ID JSON versions API preserves every emitted module and produces the exact private Worker/version/namespace/container truth. Use only an attempt-named disposable proof. Bind broker authorization to the exact signed build attempt and provider-read Worker UUID. Prove preview and production resource/token separation and negative upstream permissions for every token role.

Compute affected projects once at the main CAS from the authoritative prior and new SHA, then persist immutable build requests. Builders must not reconstruct cumulative history. Publication ordering is per environment/project: the newest eligible ready generation wins; newer failed-before-ready builds do not permanently block an older ready row; a published generation permanently floors all lower rows.

Preserve all confirmed user data and the historical local runner rollback target through bootstrap, live verification, and three ordinary product proofs. Re-read the live migration ledger and exact DDL; do not trust stale migration numbers in documents or PR bodies. After the rollback-compatibility window, remove the old runner in a separate cleanup.

Merge source to main before production. Use a fresh isolated exact-main checkout for the one authorized bootstrap. Record exact prior Cloudflare deployments and versions, freeze only release publication, enforce the ten-minute stop-loss, verify provider truth plus generic and public behavior, and restore the prior stable Worker version on any post-traffic failure or ambiguity. Never patch inline or blindly retry.

After cutover, prove Better Auth plus NOMOREGIT invite flow and two other independent product changes through the ordinary PR-preview-main-builder-ready- publisher path without manually exchanged SHA, provider ID, fence, seed, or lane-clear message. The release-system PR itself does not count as a product proof.

Report exact source generation, build record, provider version, prior/new deployment, live identity, bindings, health, feature proof, receipt, and rollback outcome for each release. Then delete the bootstrap, manual seed, synthetic cutover state machine, dormant obsolete release PRs, and all reachable legacy publication paths.

Measure success by how much authority and code no longer exists. Do not call the work complete merely because CI, Wrangler, or a provider POST succeeds. Complete means the small normal lifecycle is live, three product releases have traversed it, rollback compatibility is proven, and the competing systems are gone.