Add Cloudflare deploy doctor rollback conformance and cost evidence

[yhay81]

Outcome

Provide a safe, reproducible deploy-to-first-send and operations path for the Cloudflare proof.

Scope

• plan-first deploy with pinned current stable tooling
• doctor, upgrade, rollback, cleanup, and provider capability drift checks
• isolated disposable resource namespace in the approved general-purpose test account
• conformance evidence and reproducible observed cost model
• least-privilege credentials and secret handling

Acceptance criteria

• deploy, API test, failure drill, rollback, and cleanup succeed in a unique HayaSend namespace in the designated non-production account
• unrelated test resources remain untouched and no HayaSend residue or private test data remains
• artifacts, tool versions, capability digest, and evidence URLs are recorded
• provider switching changes deployment configuration, not application send code
• documentation retains the Beta limitation

Depends on the Cloudflare Email Sending and event adapters.
Parent direction: #81
Execution plan: #84

[yhay81]

Implementation checkpoint

Draft PR #118 implements the Cloudflare deployment lifecycle and conformance work for this issue.

• Exact head: efefb582962e2df4104dd96bfbef7f32ab3147a9
• CI: all jobs passed — https://github.com/haya-inc/hayasend/actions/runs/30283178516
• CodeQL: Actions, Python, and JavaScript/TypeScript passed — https://github.com/haya-inc/hayasend/actions/runs/30283174943
• Open code-scanning alerts for refs/pull/118/head: 0
• Both commits are GPG-signed and contain Signed-off-by trailers.
• Local evidence: 392 tests passed; Workers boundary and Wrangler dry-run passed; package, conformance, build, dependency freshness, and audit checks passed.

The hosted acceptance gate remains intentionally open: deploy, API test, controlled failure, rollback, cleanup, and zero-residue verification must run in a designated disposable Cloudflare account. The currently authenticated Cloudflare account contains production/staging domains and 38 Workers, so it has not been mutated or used for this lifecycle test. PR #118 remains Draft until the isolated hosted proof is complete.

[yhay81]

Hosted-account checkpoint

The approved reusable Cloudflare test account is now connected and configured without touching the production/staging account.

• Account ID: 18b626f66aa92bc01c3da9aef54aa3b8
• Existing inventory preserved: 6 Workers/Pages applications and 1 D1 database
• Current empty surfaces: 0 domains and 0 Queues; R2 is not yet subscribed
• Verified controlled recipient: yusuke@haya.company
• GitHub environment: cloudflare-integration, restricted to main
• Configured secrets: one-year least-privilege account-owned Cloudflare token plus a generated HayaSend runtime key
• Token permissions: D1 Write, Queues Write, Workers R2 Storage Write, Workers Scripts Write, and Email Sending Write only

PR #118 now uses a unique run-scoped HayaSend namespace, proves it is absent before deployment, and verifies it is absent after cleanup. Issue acceptance and PR documentation were updated to the reusable general-purpose test-account model.

Exact head 35358dc247a1479d0aeebed0a99b23654f8e6645 is green:

• CI: https://github.com/haya-inc/hayasend/actions/runs/30296987829
• CodeQL: https://github.com/haya-inc/hayasend/actions/runs/30296984374
• Open code-scanning alerts for refs/pull/118/head: 0
• Dependencies are current as of 2026-07-28; audit reports 0 vulnerabilities.

Two explicit provider prerequisites remain before the hosted lifecycle run:

1. Enable the R2 usage-based subscription ($0.00 due now; charges only above the included monthly limits, with automatic renewal).
2. Onboard a dedicated sender domain. hayasend-test.com is currently available through Cloudflare Registrar for $10.46/year, renewing at $10.46.

Neither cost-bearing action has been accepted yet. Workers Paid is not required because the proof sends only to the verified destination.

[yhay81]

Cloudflare hosted-account checkpoint — 2026-07-28

Verified in the designated general-purpose test account 18b626f66aa92bc01c3da9aef54aa3b8:

• R2 is enabled; current state is 0 buckets, 0 B storage, 0 operations, and $0.00 billable usage.
• hayasend.com is registered and Active, expires 2027-07-28, with auto-renew enabled.
• GitHub environment cloudflare-integration now has CLOUDFLARE_TEST_FROM=HayaSend Integration <integration@hayasend.com>.
• The verified controlled recipient remains yusuke@haya.company.
• Unrelated shared-test resources remain untouched.

Provider reality discovered from the live dashboard: Email Sending Beta currently requires Workers Paid, including for a verified-destination proof. The displayed plan is $5/month + usage and lists Email Sending as Included only on Paid. No upgrade was performed without explicit authorization.

Remaining gate: authorize Workers Paid, onboard hayasend.com to Email Sending, then run the exact-head hosted lifecycle (real SDK send, 503 drill, rollback, cleanup, and zero HayaSend residue).

[yhay81]

Hosted Cloudflare acceptance completed — 2026-07-28

The cost-bearing gate is resolved and the full #104 lifecycle has now passed on PR #118.

Account and provider readiness

• Workers Paid is active at the documented $5/month + usage baseline.
• hayasend.com is Active, auto-renewing, and onboarded to Cloudflare Email Sending Beta.
• The binding was restricted to the verified yusuke@haya.company destination and used HayaSend Integration <integration@hayasend.com> as the controlled sender.
• The approved reusable general-purpose test account was used; production/staging resources were not touched.

Exact branch evidence

• PR head: e188da626f8d80ec55f6ab34d315e7e1f4013bbc
• CI: https://github.com/haya-inc/hayasend/actions/runs/30301996779 — all jobs passed
• CodeQL: https://github.com/haya-inc/hayasend/actions/runs/30301993202 — Actions, Python, and JavaScript/TypeScript passed
• Open code-scanning alerts: 0
• Local: 46 files / 398 tests; Workers: 4 files / 34 tests; type, conformance, build, Workers boundary/types, and Wrangler dry-run passed
• Dependencies current; npm audit: 0 vulnerabilities

Hosted lifecycle

1. Deployed/upgraded the isolated hayasend-proof-104-20260728 namespace with D1, R2, three Queues, Email Sending, and the authenticated API.
2. Doctor passed health, runtime, deployment identity, capability digest, explicit Beta/non-production truth, and authenticated API checks.
3. The official Resend SDK sent email_c60294c003314f6f81111a53b0dd027d; HayaSend reached sent.
4. D1 independently recorded email sent, delivery attempt accepted, provider cloudflare-email, and the correlated RFC Message-ID.
5. A controlled failure deployment reached HTTP 503 after bounded edge propagation and was detected.
6. Rolled back 100% to reviewed immutable version afad1624-7ff6-4f79-88cc-f4e05660cc53; post-rollback Doctor passed.
7. The reproducible one-message cost estimate was $5/month, with all usage components inside current included allowances.
8. Cleanup removed three private payload objects, the isolated Worker, R2 bucket, all three Queues, and D1 database. A second idempotent cleanup passed.
9. Independent D1/R2/Queue/Worker checks found zero HayaSend residue. The unrelated hayate-as-spike D1 database remained present.
10. The short-lived local proof token was deleted and its mode-0600 secret file removed. The protected GitHub Integration token remains active for the post-merge main workflow.

The hosted proof also exposed and fixed four real integration defects: Cloudflare RFC Message-ID validation, Queue-consumer deletion order, uploaded-version/edge propagation, and Wrangler's post-delete KV cleanup failure. Each now has regression coverage.

PR #118 can be moved out of Draft and merged through the normal protected flow. After merge, the same lifecycle will be run from main through the protected cloudflare-integration environment before this issue is closed.

[yhay81]

Post-merge exact-main acceptance evidence — 2026-07-28

The protected-main Cloudflare gate is now fully complete.

Reviewed main

• Final protected main: 1ff47c4b0a4b83c86304c7352a84c2c2d415ec05
• Implementation and stabilization PRs: feat: add Cloudflare deployment lifecycle proof #118, fix: wait for Cloudflare SDK edge propagation #119, ci: update upload-artifact action #120, and fix: extend Cloudflare doctor stabilization #121, all merged through the normal protected squash flow
• Exact-main CodeQL: 30304477554 — Actions, Python, and JavaScript/TypeScript all passed with results_count: 0
• Open default-branch code-scanning alerts: 0
• Final lifecycle: 30304599377 — success, exact head SHA verified
• Lifecycle job annotations/warnings: 0
• Evidence artifact: cloudflare-lifecycle-30304599377-1

Hosted lifecycle results

• Account guard accepted only the approved reusable general-purpose-test account 18b626f66aa92bc01c3da9aef54aa3b8; production/staging accounts were not used.
• Toolchain evidence: Node v26.5.0, npm 12.0.1, Wrangler 4.114.0.
• All GitHub Actions pins were compared with their repositories' latest releases. ci: update upload-artifact action #120 corrected the only stale SHA to the actual actions/upload-artifact@v7.0.1 release commit.
• Initial Doctor passed health, runtime, deployment identity, capability digest, authenticated API, and explicit Beta/non-production truth.
• Official Resend SDK send produced HayaSend email email_d60e576d07584064bb793013398ab962 with status sent.
• This proves HayaSend/provider acceptance; inbox receipt was not claimed as separate delivery evidence.
• Controlled failure deployment was polled until HTTP 503 and the failure body reported status: failure-drill / production_ready: false.
• Rollback restored the reviewed immutable version; post-rollback Doctor passed all checks.
• Reproducible observed cost: $5/month Workers Paid baseline; current one-message Worker/D1/R2/Queue/Email usage stayed inside included allowances.
• Cleanup detached three Queue consumers, removed the Worker, deleted the private R2 payload object and bucket, deleted all three Queues, and deleted the D1 database.
• Cleanup result: complete: true; independent named-resource verification found zero HayaSend residue.

Two real propagation bounds were hardened from hosted evidence: #119 extended the SDK edge window without changing its idempotency key, and #121 extended Doctor's transient-only bounded stabilization window after a separate run observed more than 30 seconds of workers.dev 404 propagation. Both have regression coverage.

Cloudflare Email Sending remains Beta and the adapter remains explicitly production_ready: false; this evidence authorizes controlled non-critical evaluation, not critical production traffic. #104 remains correctly closed as completed.