Cloudflare Worker Deployment Record

GCA Worker Routes Deployment

The token-protected /gca/service-requests, /gca/service-request-reviews, /gca/service-request-followups, and /gca/credit-usage routes are production-live. A matched device-key account can answer a public more-information prompt, record one receipt after completed delivery, or cancel only while a request remains queued with no operator review. 0014_service_request_cancellations.sql and 0015_service_request_followups.sql, the Worker deploy, and public and admin read-only smoke checks passed on 2026-08-10 UTC.

This page keeps the verified release result and repeatable operator gate sequence public. It does not expose user records, print admin tokens, connect wallets, request wallet signatures, or create trading permission.

API Status Service Delivery Playbook Access API Contract Operations Runbook Release Gates
Handoff ID worker-routes-handoff-v1

Public deployment record and repeatable release runbook.

Current Status Production-live and protected

Public smoke passed at 2026-08-10T13:23:22Z; anonymous reads return HTTP 401. Admin read-only smoke passed at 2026-08-10T13:23:40Z.

Deployment Gate All required gates passed

Worker version def4a0ea-fcbb-4d0e-a380-ba9656d7dc05.

Released Routes 4 operator routes

Queue, append-only review/delivery, private follow-up reads, and credit usage.

Access Model Token-protected admin

Public visitors must not be able to read ledgers.

Source Handoff docs/gca_worker_pending_routes_deploy_handoff.md

Keep the docs copy as the operator source of truth.

Already Live Routes

Public healthGET /health
Access configGET /gca/access-config
Email registrationPOST /gca/email-registrations
Contact suppressionPOST /gca/contact-suppressions
Wallet verificationPOST /gca/wallet-verifications with read-only balanceOf
Member accessPOST /gca/member-access for eligible ledger records.
Account statusPOST /gca/account-status for device-key protected redacted reads.
Device key rotationPOST /gca/account-status/rotate for credential-only rotation with a 15-minute same-rotation retry window.
Account service requestPOST /gca/account-service-requests for device-key protected manual-review queueing without credit reservation or deduction.
Account request historyPOST /gca/account-service-requests/status for redacted history with public prompts plus follow-up time and count.

Newly Released Routes

Service request queueGET/POST /gca/service-requests; production-live and token-protected.
Service review and deliveryGET/POST /gca/service-request-reviews; append-only, public prompt required for more information, approval required before delivery, and at-most-once settlement.
Account follow-upPOST /gca/account-service-requests/follow-ups; device-key protected, more-information only, account-scoped, bounded to five, and idempotent.
Operator follow-up readGET /gca/service-request-followups; token-protected response text that is never returned in public account history.
Account delivery receiptPOST /gca/account-service-requests/delivery-receipts; completed delivery only, account-scoped, idempotent, and no credit or wallet effect.
Account request cancellationPOST /gca/account-service-requests/cancellations; queued before review only, account-scoped, permanent, idempotent, and no credit, wallet, token, or audit-deletion effect.
Credit usage ledgerGET/POST /gca/credit-usage; production-live and token-protected.
Access boundaryAnonymous reads return HTTP 401; operator reads require ADMIN_READ_TOKEN.

Required Gate Order

1. Read-only readinessRun the deploy-readiness checker and require cloudflare-auth-session, D1 visibility, and Worker deploy permission to pass.
2. Remote D1 migrationsApply pending migrations through 0015_service_request_followups.sql only after Gate 1 passes.
3. Worker deployDeploy the updated Worker only after remote migrations complete successfully.
4. Post-Deploy Public SmokeConfirm health/config versions, CORS, and unauthenticated admin-read rejection with --include-pending-routes.
5. Post-Deploy Admin SmokeUse the local admin token file to check token-protected response shape without printing tokens or user records.
6. Status updateOnly after Gates 1-5 pass, update public API status pages from prepared to live token-protected status.

Gate 1 Command

Safe before deploy. It does not write D1 data, deploy Workers, read user ledgers, or print secrets.

cd /Users/abc/Desktop/gca_token
python3 tools/check_gca_worker_deploy_readiness.py --run-wrangler --run-cloudflare --require-deploy-auth

Gate 2 Command

Run only after the read-only readiness gate passes.

cd /Users/abc/Desktop/gca_token/cloudflare/gca-registration-worker
npx wrangler d1 migrations apply gca_registration --remote

Gate 3 Command

Run only after remote D1 migrations succeed.

cd /Users/abc/Desktop/gca_token/cloudflare/gca-registration-worker
npx wrangler deploy

Gate 4 Command

Public route check; no admin token required and no write test record.

cd /Users/abc/Desktop/gca_token
python3 tools/check_gca_registration_api.py --public-only --timeout 30 --include-pending-routes

Gate 5 Command

Local operator check. Keep ADMIN_READ_TOKEN in the ignored token file and do not paste it into chat, commits, logs, or public pages.

cd /Users/abc/Desktop/gca_token
python3 tools/check_gca_registration_api.py --token-file cloudflare/gca-registration-worker/.env.admin.local --limit 5 --include-pending-routes

Optional Export After Success

Internal operator artifact only. Do not publish full user records.

cd /Users/abc/Desktop/gca_token
python3 tools/export_cloudflare_member_access.py --token-file cloudflare/gca-registration-worker/.env.admin.local --limit 100 --include-pending-routes --output .gca_access_data/cloudflare_member_access_export.json

Safe To Say

  • The service-request, review, follow-up, and credit-usage routes are production-live.
  • The deployment record and repeatable gate sequence are published.
  • Remote migration, deploy, public smoke, and admin read-only smoke checks passed.
  • The routes are operator-only and token-protected, not public user ledgers.
  • The workflow does not request wallet signatures and does not create trading permission.

Do Not Claim Yet

  • Do not say production self-service service delivery is live.
  • Do not say credits are automatically deducted before operator review.
  • Do not say these routes connect wallets or request wallet signatures.
  • Do not say the workflow sends transactions, transfers GCA, or creates trading permission.
  • Do not publish full user records, admin tokens, private evidence, or local export files.

Stop Conditions

Cloudflare auth errorStop if Wrangler is not logged in or readiness returns Authentication error [code: 10000].
Migration failureStop if remote D1 migrations fail or if the expected migration IDs are not applied.
Deploy failureStop if wrangler deploy fails or deploy history cannot be read.
Health mismatchStop if /health does not expose the service, review, request-follow-up, delivery-receipt, and request-cancellation packet versions.
Auth boundary failureStop if unauthenticated reads do not return authorization errors.
Secret exposureStop if any command prints secrets or user record contents.

Copy-Ready Status Summary

GCA has released the account request, more-information follow-up, queued-request cancellation, manual service review, approved delivery, credit settlement, and completed-delivery receipt routes. The latest Worker deploy and public/admin read-only smoke checks passed on 2026-08-10 UTC. Public history never returns follow-up response text; reviews are append-only, one request can settle credits at most once, and neither cancellation nor receipt creates a wallet action or trading permission.