# Prompt for the future agent

You own the final simplification and production cutover of Forge's release
system. Begin by reading every file in
`docs/forensics/2026-08-11-release-simplification-failure/`, followed by the
three authoritative linked documents. Treat all recorded IDs and states as
historical evidence only; independently re-read current main, origin/main, PRs,
workflow runs, D1, Cloudflare, bindings, tokens, and rollback targets before any
mutation.

Your objective is not to finish or harden the existing collection of release
subsystems. It is to reduce them to one ordinary lifecycle:

```text
PR -> complete preview -> merge main
main -> exact affected-project build requests
builder -> immutable zero-traffic ready Worker versions
project lane -> expected-current publish -> generic health -> receipt/restore
```

Cloudflare's active stable Worker deployment is runtime truth. D1 is evidence
and a read model. A private runner host is one attempt-derived Worker with one
version and one deployment, used only as immutable build preparation. It has no
publication lane, current pointer, repair loop, or rollback operation. The
stable runner Worker version is the sole production selector.

Delete or make unreachable every legacy controller, production candidate,
global component, dependency wave, cumulative baseline, manual generation seed,
bootstrap-after-cutover, synthetic authority switch, compatibility field, and
alternate publication path that is not required by that lifecycle. Do not
modernize legacy machinery. Do not add adapters, dual running, durable host/app
state, or another controller under the name of reconciliation.

First diagnose the currently observed normal-path failure: release request
`73d3f4ba-f50f-4791-9b3a-77f003cbc8ac` for PR #165 and source
`359dfff476f38f330b809fab94a8943bbc259c8e` was last observed stuck in
`validating` with empty evidence and no exact-SHA Platform CI/Preview runs. Do
not assume that is still current. If it remains, repair only the immutable
validation-event to workflow-run delivery. Do not seed a main generation, wake
a controller, adopt an old attempt, or bypass preview.

Before production, prove with the real compiled runner-host output that the
Beta Worker-ID JSON versions API preserves every emitted module and produces
the exact private Worker/version/namespace/container truth. Use only an
attempt-named disposable proof. Bind broker authorization to the exact signed
build attempt and provider-read Worker UUID. Prove preview and production
resource/token separation and negative upstream permissions for every token
role.

Compute affected projects once at the main CAS from the authoritative prior and
new SHA, then persist immutable build requests. Builders must not reconstruct
cumulative history. Publication ordering is per environment/project: the newest
eligible ready generation wins; newer failed-before-ready builds do not
permanently block an older ready row; a published generation permanently floors
all lower rows.

Preserve all confirmed user data and the historical local runner rollback target
through bootstrap, live verification, and three ordinary product proofs. Re-read
the live migration ledger and exact DDL; do not trust stale migration numbers in
documents or PR bodies. After the rollback-compatibility window, remove the old
runner in a separate cleanup.

Merge source to main before production. Use a fresh isolated exact-main checkout
for the one authorized bootstrap. Record exact prior Cloudflare deployments and
versions, freeze only release publication, enforce the ten-minute stop-loss,
verify provider truth plus generic and public behavior, and restore the prior
stable Worker version on any post-traffic failure or ambiguity. Never patch
inline or blindly retry.

After cutover, prove Better Auth plus NOMOREGIT invite flow and two other
independent product changes through the ordinary PR-preview-main-builder-ready-
publisher path without manually exchanged SHA, provider ID, fence, seed, or
lane-clear message. The release-system PR itself does not count as a product
proof.

Report exact source generation, build record, provider version, prior/new
deployment, live identity, bindings, health, feature proof, receipt, and
rollback outcome for each release. Then delete the bootstrap, manual seed,
synthetic cutover state machine, dormant obsolete release PRs, and all reachable
legacy publication paths.

Measure success by how much authority and code no longer exists. Do not call the
work complete merely because CI, Wrangler, or a provider POST succeeds. Complete
means the small normal lifecycle is live, three product releases have traversed
it, rollback compatibility is proven, and the competing systems are gone.