fix(deploy): fail closed on workers.dev setup failure

[simple-agent-manager]

Summary

• Fail closed when the reusable deploy workflow cannot configure/verify the Cloudflare workers.dev subdomain prerequisite for cron triggers.
• Preserve successful deploy behavior for 2xx responses and 409 already-configured responses.
• Add executable workflow-shell tests using a fake curl response for 2xx success, 409 already enabled, and 403 hard failure.

Validation

• pnpm lint
• pnpm typecheck
• pnpm test — global run hit unrelated/flaky failures; targeted and isolated reruns below passed
• Additional validation run (if applicable)
• N/A: this PR does not change candidate selection for a sweep/cron/alarm loop; it changes deployment prerequisite handling.

Additional validation:

• pnpm vitest run scripts/quality/deploy-reusable-workflow.test.ts — 13 tests passed
• pnpm --filter @simple-agent-manager/terminal test — 5 files / 99 tests passed in isolation after the global run reported Vitest worker startup timeouts
• (cd packages/shared && pnpm vitest run tests/unit/alternative-inference-providers-vertical-slice.test.ts) — 17 tests passed in isolation after the global run showed one failure
• pnpm build — passed

Global pnpm test note: the full monorepo test run exited non-zero because @simple-agent-manager/terminal#test reported Vitest fork worker startup timeouts, and the visible shared failure passed when rerun in isolation. These failures are outside the changed files.

Staging Verification (REQUIRED for all code changes — merge-blocking)

• Staging deployment green — not run before PR creation
• Live app verified via Playwright — N/A for workflow-only deployment gate change
• Existing workflows confirmed working — N/A for workflow-only deployment gate change
• New feature/fix verified on staging — covered by executable workflow-shell tests; staging deploy not run yet
• Infrastructure verification completed — N/A: no cloud-init, VM agent, DNS record logic, TLS, or scripts/deploy VM provisioning paths changed
• Mobile and desktop verification notes added for UI changes — N/A: no UI changes

Staging Verification Evidence

Not run before PR creation. This PR is marked do-not-merge per task instruction; staging can be run before any later merge decision if desired.

UI Compliance Checklist (Required for UI changes)

• N/A: no UI changes
• N/A: no UI changes
• N/A: no UI changes
• N/A: no UI changes

End-to-End Verification (Required for multi-component changes)

• Data flow traced from workflow step to shell outcome with code path citations
• Capability test exercises the relevant happy/error branches of the workflow shell block
• All spec/doc assumptions about existing behavior verified against code
• Manual verification gaps documented below

Data Flow Trace

• .github/workflows/deploy-reusable.yml step Ensure workers.dev Subdomain calls Cloudflare PUT /accounts/${CF_ACCOUNT_ID}/workers/subdomain.
• The step now treats HTTP 2xx as ready and HTTP 409 as already configured.
• Any other HTTP status emits ::error:: and exits 1, blocking subsequent deploy steps.
• scripts/quality/deploy-reusable-workflow.test.ts extracts and executes that shell block with fake Cloudflare responses for 200, 409, and 403.

Untested Gaps

No live Cloudflare API mutation was performed locally. The behavior changed is the workflow shell branch after receiving Cloudflare response codes; that is covered by the executable static test.

Post-Mortem (Required for bug fix PRs)

What broke

Deployments could continue after workers.dev subdomain setup failed, leaving cron trigger prerequisites potentially unconfigured.

Root cause

The deploy workflow logged a warning for non-2xx/non-409 Cloudflare responses instead of failing closed.

Class of bug

Fail-open deployment prerequisite handling.

Why it wasn't caught

Existing workflow quality tests did not exercise the workers.dev subdomain setup shell branches.

Process fix included in this PR

Added executable workflow-shell regression tests in scripts/quality/deploy-reusable-workflow.test.ts.

Post-mortem file

tasks/active/2026-07-29-workersdev-cron-fail-closed.md

Specialist Review Evidence (Required for agent-authored PRs)

• All local reviewers completed and findings addressed before merge
• If any reviewer did NOT complete: needs-human-review label added and merge deferred to human — N/A; all completed

Reviewer	Status	Outcome
cloudflare-specialist	PASS	Fail-closed Cloudflare prerequisite behavior is appropriate; 2xx and 409 success paths preserved; no D1/KV/R2/wrangler binding side effects.
security-auditor	PASS	No credential exposure added; token remains sourced from secret env and is not logged; change reduces fail-open risk for cron prerequisite.
test-engineer	PASS	Tests execute the extracted workflow shell block with fake Cloudflare responses for success, 409, and hard failure.
task-completion-validator	PASS	Task checklist maps to diff and tests; no UI/backend or multi-resource path applies.

Exceptions (If any)

• Scope: No degraded-mode override implemented.
• Rationale: Fail-closed default directly satisfies the remediation and avoids adding new operator behavior or docs.
• Expiration: N/A

Agent Preflight (Required)

• Preflight completed before code changes

Classification

• external-api-change
• cross-component-change
• business-logic-change
• public-surface-change
• docs-sync-change
• security-sensitive-change
• ui-change
• infra-change

External References

N/A: no external API contract or SDK usage changed; this PR changes local shell handling of response codes from an existing workflow call.

Codebase Impact Analysis

Affected paths:

• .github/workflows/deploy-reusable.yml — workers.dev subdomain setup now fails closed on hard failure.
• scripts/quality/deploy-reusable-workflow.test.ts — executable regression tests for shell branches.
• tasks/active/2026-07-29-workersdev-cron-fail-closed.md — task record.

Documentation & Specs

N/A: no public operator docs changed because no degraded-mode override or new configuration was added. Default successful deploy behavior is preserved; failed prerequisite behavior now blocks deployment.

Constitution & Risk Check

Checked fail-closed security policy and no-hardcoded-values principle. The main deploy risk is intentional: a real Cloudflare prerequisite failure now blocks deploy instead of silently shipping cron-risky infrastructure. Successful 2xx and 409 behavior remains unchanged.

[codspeed-hq]

Merging this PR will not alter performance

✅ 6 untouched benchmarks

---

_{Comparing sam/workersdev-cron-fail-closed (a4434a5) with main (090b237)}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[simple-agent-manager]

Closing in favor of #1697, which integrates this fix (workers.dev fail-closed setup) and is being completed and merged tonight per Raphaël's backlog-cleanup authorization (SAM task 01KZ9YVKD8FD6JT15FCWRD7TY4). Branch preserved; reopen if #1697 stalls.