Skip to content

Spine deploy — raw notes

The engine went off disk 2026-07-03. Proof job 0dda7509-595f-414f-b727-82c12bfea3ce ran gate→engine→signed-envelope to terminal on the deployed Cloudflare spine.

Auth (every wrangler command)

set -a; . ~/projects/ucca-project/.credentials/cloudflare.env; set +a   # UCCA token → e5a98302
The machine's wrangler OAuth default is the RTOpacks account (f95d4537) — sourcing the vault token (UCCA-scoped, can't touch f95d4537) is mandatory. All engine wrangler.toml files carry an account_id pin. See [[reference-engine-deploy-prereqs]].

Deploy sequence

# 1. keys worker (plain Worker) — carries the /v1/sign content_hash change
cd engine/ucca-engine/workers/keys && npx wrangler deploy            # ucca-keys 61aa8427

# 2. reasoner (container) — needs Docker daemon up (open -a Docker); token needs Containers:Edit
cd engine/ucca-engine/reasoner && npm install && npx wrangler deploy # ucca-reasoner (container image)

# 3. sign secret on the reasoner (piped from vault, never printed)
printf '%s' "$UCCA_SIGN_SECRET" | npx wrangler secret put UCCA_SIGN_SECRET --name=ucca-reasoner

# 4. gate worker (queue producer)
cd engine/ucca-engine/workers/gate && npx wrangler deploy            # ucca-gate 7afd429c

Verify (by bytes)

curl -s https://ucca-gate.round-union-555d.workers.dev/_health                 # {"status":"ok"}
# reject smoke (no spend): malformed → GATE_* structural code, no job row
curl -s -X POST .../v1/jobs -d '{"job_type":"generation"}'                     # GATE_SCHEMA_VERSION
# proof: POST a conformed triumvirate; poll GET /v1/jobs/{id} → completed + envelope
npx wrangler d1 execute ucca-input-path --remote --command "SELECT ... FROM cognitive_cost WHERE job_id=..."
npx wrangler r2 object get "ucca-artefacts/default/diagnostics/{id}/failure.json" --remote --pipe  # on failure
npx wrangler tail ucca-reasoner --format=pretty                                # live debugging

Infra deltas for TERRAFORM-RECONCILE (all account e5a98302, wrangler-managed not TF)

  • Worker ucca-gate (queue producer of ucca-jobs; bindings JOBS_QUEUE/JOBS_DB/ARTEFACTS/AI).
  • Worker ucca-reasoner + Container ucca-reasoner-reasoner (standard-1, max 2; DO class Reasoner + migration v1; bindings JOBS_DB/ARTEFACTS/AI/KEYS; secret UCCA_SIGN_SECRET).
  • Worker ucca-keys — redeployed (added content_hash to /v1/sign; added account_id pin).
  • Already provisioned: D1 ucca-input-path (a1fa9d09-6e20-46c0-a387-a4bb8f936639), R2 ucca-artefacts (oc), Queue ucca-jobs (eb43044a…).
  • Container image registry now in use: registry.cloudflare.com/e5a98302…/ucca-reasoner-reasoner.

Live-integration fixes that were invisible to mocked tests (commit ea8ba3f)

ContainerProxy export · outboundByHost via setter-assignment not static field · enableInternet=false · force GLM model in the throat · jsonschema validator-instance (frozen $id has a fragment) · coerce internal_outcome_number to int · with_retry carries inner cause + assembly attempts=1.

Known follow-ups (provenance refinements, not integrity issues)

  • Cost ledger model field records the generator's config default (claude-sonnet-4), not the actual GLM-5.2 that ran — thread the real model from the completion result into ledger.record.
  • Neurons not captured from the Workers AI usage — real token counts recorded (2104 in / 3265 out for the proof job), neuron figure is a capture refinement.
  • Physical engine/ucca-engine/worlds/ deletion — build brief Step 5 reviewed diff (runtime already severed).