Deploy Agent

---
name: deploy-agent
description: Ship the current branch to Fly.io using the repo's
  ./deploy/Dockerfile and ./deploy/fly.toml, then verify the deployment
  is live via /api/health. Use when the user says "deploy", "ship it",
  "push to prod", or "deploy to fly".
---

# deploy-agent

Purpose: take the user from a green branch to a verified live URL with
no manual clicking, and refuse to deploy if any of the safety gates fail.

## When to fire

- User says: "deploy", "ship it", "deploy to fly", "push to prod",
  "release this".
- Deploy target defaults to Fly.io. If the user says "Render" / "Cloud
  Run" / "Vercel", stop and explain this skill only covers Fly today.

## Safety gates — RUN IN ORDER, HALT ON FAILURE

1. **Clean git tree.** `git status --porcelain` must be empty.
2. **Right branch.** Confirm with the user before deploying anything
   that isn't `main`.
3. **Type check.** `npm run typecheck`.
4. **Evals pass.** `npm run eval:ci`. If a case fails, stop and
   surface it — do not deploy a red suite.
5. **Fly CLI logged in.** `fly auth whoami`. If not, stop and instruct
   the user to run `fly auth login`.
6. **App exists on Fly.** `fly status --app <name from fly.toml>`.
   If the app doesn't exist, ask the user before creating it with
   `fly launch --no-deploy --copy-config`.
7. **Secrets present.** `fly secrets list --app <name>` must include at
   minimum `OPENAI_API_KEY`. Warn (don't halt) if Langfuse keys are
   missing — the agent works without them, just without traces.

If any gate fails, print exactly what failed and stop. Do not "just try
the deploy anyway".

## Steps

1. **Deploy.**
   ```bash
   fly deploy --dockerfile deploy/Dockerfile --config deploy/fly.toml
   ```
   Stream the output. If the build fails, surface the last 30 lines and
   stop.

2. **Wait for health.** Poll the app URL's `/api/health` endpoint for up
   to 90 seconds, once per 3 seconds:
   ```bash
   URL="https://$(fly status --app <name> --json | jq -r .Hostname)"
   for i in $(seq 1 30); do
     if curl -sf "$URL/api/health" > /dev/null; then
       echo "healthy after ${i}x3=${i}s"
       break
     fi
     sleep 3
   done
   ```

3. **Smoke test.** POST a trivial request to `/api/chat`:
   ```bash
   curl -sf -X POST "$URL/api/chat" \
     -H "content-type: application/json" \
     -d '{"messages":[{"role":"user","content":"reply with the word OK"}]}' \
     | head -c 200
   ```
   Fail loudly if this returns non-200 or an empty stream.

4. **Report.** Print the app URL, the deployed image tag
   (`fly image show`), the git SHA that was deployed, and the release
   ID. Nothing else.

## Definition of done

- All safety gates passed.
- `fly deploy` exited 0.
- `/api/health` returned 200 within 90 s.
- Smoke test to `/api/chat` returned a streamed token.
- Report printed with URL + image tag + git SHA + release ID.

## Rollback

If any post-deploy check fails, roll back immediately:

```bash
fly releases --app <name>          # find the previous release id
fly deploy --image <previous-tag>  # OR: fly releases rollback <id>
```

Then diagnose. Never leave a broken release running while you debug.