Operational: dspack-studio (exhibit) Worker appears to auto-deploy on every push to main

[ryandmonk]

Recorded at the ledger-v2 production deployment closeout (2026-08-04). No change has been made to the Cloudflare integration — this is an operational decision requiring review.

Observation

The exhibit Worker dspack-studio receives a new version upload a couple of minutes after every push to main, with no such command in the release procedure:

Event	Timestamp (UTC)
#31 merge push → CI run started	2026-08-04T14:00:46Z
dspack-studio version f671c8d1-eae8-4759-9e55-7e3ae23437c5 created	2026-08-04T14:02:53Z
#29 merge push → CI run started	2026-08-03T23:43:23Z
dspack-studio version ee8e7cfb-e2bb-435d-be7b-773b20c14ae4 created	2026-08-03T23:46:02Z

During the ledger-v2 release the only Cloudflare write command executed was npx wrangler deploy --config wrangler.composer.jsonc at 2026-08-04T14:11:35Z, which uploaded 8 files to the composer Worker (dspack-studio-composer, version ca1af622). The exhibit version predates it by ~9 minutes.

No repository workflow deploys

grep -rln "wrangler deploy\|cloudflare/wrangler-action" .github/ returns nothing. .github/workflows/ci.yml builds the static export as an artifact ("Static export (the deploy artifact)") but never deploys it, and release-style deploy workflows do not exist in this repo. The consistent ~2–3 minute lag after each push to main is the signature of a Cloudflare Workers Builds Git integration configured on the dspack-studio Worker in the Cloudflare dashboard. Notably the composer Worker (dspack-studio-composer) shows no equivalent uploads — its only versions come from explicit wrangler deploy runs — so if the integration exists it is scoped to the exhibit Worker only.

Why it was harmless this time

The exhibit's entire consumed source surface is byte-identical between the Phase 2 deploy source 177b9ae and merged main 1a56872:

git diff --stat 177b9ae 1a56872 -- apps/web packages/a2ui-ingest packages/replay \
  packages/scenarios packages/contracts packages/astryx-renderers packages/shadcn-renderers
# (empty)

apps/web has no dependency on @aestheticfunction/dspack-export, so the ledger-v2 dependency bump could not reach it. Exhibit production smoke after the merge: 86/86 green.

Operational risk

Any future merge to main that touches apps/web or its consumed packages will redeploy the exhibit without an explicit deployment decision, without the pre-deploy rollback anchor being recorded, and without the exhibit production smoke being run as a gate. That contradicts the deployment discipline documented in docs/deployment.md (explicit wrangler deploy per Worker, anchor first, smoke after) and means a red smoke would be discovered after the fact rather than before rollout. It also makes "the exhibit Worker remains untouched" unverifiable as a release criterion, since a merge alone can change it.

Choices (no action taken)

1. Retain deliberately — document the auto-deploy in docs/deployment.md as the intended exhibit path, and add a post-merge exhibit smoke (scheduled or workflow-triggered) so a bad rollout is caught automatically. Keeps merges fast; accepts deploy-on-merge.
2. Scope by paths, if supported — restrict the Workers Builds trigger to apps/web/** plus the packages the exhibit consumes, so unrelated merges (like this one) stop redeploying it. Reduces noise without giving up automation; needs confirmation that path filters are available for this integration.
3. Disable and make exhibit deployment explicit — remove the Git integration so the exhibit deploys only via npx wrangler deploy --config wrangler.jsonc, matching the composer's discipline and the documented anchor→deploy→smoke sequence. Most control, least automation.

Deciding requires dashboard access to confirm the integration exists and how it is configured (Workers → dspack-studio → Settings → Build).

🤖 Generated with Claude Code

[ryandmonk]

Third data point, observed deliberately during the #35 merge closeout — integration unchanged.

The #35 merge was used as a controlled observation: the exhibit Worker's latest version was recorded before merging, and the diff was known not to touch apps/web.

Event	Timestamp (UTC)
Baseline recorded — latest dspack-studio version was f671c8d1	2026-08-04T16:35:25Z
#35 merged to main (ab5030f) → CI run created	2026-08-04T16:35:38Z
New dspack-studio version da062964-6c6f-4750-a148-37fba8481a6a created	2026-08-04T16:37:24Z

~1m46s after the push, with no wrangler deploy executed by anyone and none present in .github/. This matches the two earlier occurrences (#29 merge → 23:46:02Z; #31 merge → 14:02:53Z) and confirms the behavior is systematic rather than incidental.

The redeployed build carries no exhibit source change:

git diff --stat 1a56872 ab5030f -- apps/web
# (empty)

The #35 diff is apps/composer, e2e/, the Playwright configs, and .github/workflows/ci.yml only.

Post-redeploy verification: exhibit production smoke 86/86 green against https://studio.aesthetic-function.com (HTTP/2 200). So the auto-deploy was again harmless — but it again happened without an explicit deployment decision, without a rollback anchor recorded first, and without the smoke acting as a gate rather than an after-the-fact check.

Also worth noting for whichever option is chosen: the composer Worker did not auto-deploy from this same push (still on ca1af622 from the explicit 14:11:41Z release), even though the merge changed apps/composer substantially. That asymmetry supports the reading that the integration is configured on the dspack-studio Worker alone, and it means composer releases stay explicit while exhibit releases do not.

No change made to the Cloudflare configuration.

🤖 Generated with Claude Code

[ryandmonk]

Fourth data point — #36 merge closeout. Integration unchanged.

Event	Timestamp (UTC)
Baseline recorded — latest dspack-studio version was da062964	2026-08-04T18:54:32Z
#36 merged to main (5834b47)	2026-08-04T18:54:4x
New dspack-studio version 981593ca-d961-4780-a624-88214ff0b061 created	2026-08-04T18:56:54Z

~2m20s after the push, again with no wrangler deploy run by anyone. Post-redeploy exhibit production smoke 86/86 green (HTTP/2 200).

Running tally of the pattern, now four for four: #29 → 23:46:02Z · #31 → 14:02:53Z · #35 → 16:37:24Z · #36 → 18:56:54Z, each ~1m45s–2m30s after its merge push.

#36 does touch apps/composer and docs/, but not apps/web:

git diff --stat ab5030f 5834b47 -- apps/web packages/contracts
# (empty)

So the exhibit was rebuilt and redeployed from a commit that changed nothing it consumes — the third such no-op redeploy in a row. Composer remains explicitly released (still 6edef285 from the 16:43:47Z deploy; #36 is not deployed), which continues to show the integration is scoped to the dspack-studio Worker alone.

Worth noting for option 2 (path scoping): three of the four observed auto-deploys carried no exhibit-consumed change, so a path filter — if the integration supports one — would have suppressed all three while preserving the one case where it might matter.

No change made to the Cloudflare configuration.

🤖 Generated with Claude Code

[ryandmonk]

Data points five and six — the #37/#38 merge closeout. Integration unchanged; the explicit path is now merged and awaiting your two actions.

Event	Timestamp (UTC)
Baseline: latest dspack-studio version 981593ca	2026-08-04T19:41:12Z
#37 merged (ded5b7c — the explicit deploy-exhibit workflow + docs)	~19:41
Auto version 8d97eb12-b022-40cd-8b83-b84cbffd3d7e	19:43:35Z
#38 merged (132fae2 — the contracts prepare hook)	~19:42
Auto version da068611-16ee-4ffb-8dc3-6884e59d4fc8	19:45:03Z

Six for six, ~2 minutes each. Neither commit touches apps/web; both redeploys are no-ops content-wise. Post-redeploy exhibit production smoke: 86/86 green. Composer untouched (still e448ad84).

The repository side of this issue is now on main: CI verifies every merge, and .github/workflows/deploy-exhibit.yml is the explicit, reviewable deployment path (frozen install → gates → build → anchor capture → wrangler deploy --config wrangler.jsonc → production smoke). It is inert until the two owner actions in #37's description:

1. Disconnect the integration — Workers & Pages → dspack-studio → Settings → Build → disconnect the Git repository.
2. Create the deploy credential — API token (Account → Workers Scripts → Edit, single account), then gh secret set CLOUDFLARE_API_TOKEN --repo aestheticfunction/dspack-studio.

Verification once disconnected: merge any PR, wait 5 minutes, npx wrangler versions list --config wrangler.jsonc must show no new version (all six data points arrived within ~2m30s); then one deploy-exhibit dispatch should produce anchor + version + green smoke in its run summary.

🤖 Generated with Claude Code

[ryandmonk]

Resolved. Final operational verification, 2026-08-04:

Owner actions completed: the Workers Builds Git integration was disconnected in the dashboard, and CLOUDFLARE_API_TOKEN was added as a repository secret (confirmed present by name via gh secret list at 19:56:27Z — value never read or exposed).

Negative test — merges no longer deploy: PR #39 merged to main at 20:10:13Z (339969f). At T+6m30s (20:16:50Z), wrangler versions list still showed da068611 (19:45:03Z) as the newest version — no new version created, against six consecutive prior data points that each arrived within ~2m30s of a push.

Positive test — the explicit path works: deploy-exhibit dispatched once with the typed confirmation → run 30947148162 — every step green: frozen install, contract gates, pnpm build:deploy, rollback-anchor capture in the run summary, deploy through the checked-in wrangler.jsonc, and the complete 86-spec exhibit production smoke as the gate. Result: version 691b4f76 created at 20:18:39Z and serving 100% — the only exhibit version created since the disconnect, and it came from the workflow. The composer Worker's deployment history is byte-untouched (active: e448ad84).

Rollback: documented in docs/deployment.md, independently executable, composer-independent: npx wrangler rollback --config wrangler.jsonc targeting the anchor recorded in the run summary.

The target model is fully in effect: CI verifies every merge; production deploys only through the named, reviewable workflow using the checked-in configuration, with the smoke as a gate; exhibit and composer deployments are independent; composer-only changes no longer redeploy the exhibit.

🤖 Generated with Claude Code