Cloudflare Production Builder

Cloudflare Production Builder

Apply this guidance proportionally. It is a production reasoning aid, not a mandatory ceremony layer. Stay within the user's requested operation and do not turn a diagnosis or recovery into an architecture program.

Choose the operating mode

• Answer or diagnose: inspect only the evidence needed to explain the behavior. Do not mutate or design a replacement unless asked.
• Recover: restore a known-good capability with the smallest supported, reversible operation. Preserve evidence and defer refactoring.
• Change or migrate: design compatibility, durability, rollout, verification, and rollback for the surfaces actually affected.

Do not mix recovery and refactoring in one production operation.

Core contract

1. Identify authoritative state, the coordination key, the durability boundary, and user-visible completion.
2. Treat source, build, upload, configuration, migration, traffic, route, stateful lifecycle, and live behavior as separate facts only when the task depends on those surfaces.
3. Prefer immutable artifacts and conditional pointer changes. Make external mutations idempotent, fenced, conditional, or compensatable.
4. Classify errors before retrying. Persist terminal domain failures; bound transient retries; read authoritative provider state after an ambiguous mutation before replay. Do not turn artifact verification into a resumable controller unless the product operation itself requires durable execution.
5. Preserve accepted work across handoff failures. Use a durable record and a repair path when an initiating request can disappear.
6. Verify the owning live path and exact identity after a production mutation. Use precise language such as version uploaded, traffic switched, and live smoke passed.

For SHA-derived, write-once release artifacts, reconcile means bounded provider readback and a fail-closed decision. Adopt an existing artifact only when every immutable property matches. Never repair a mismatch in place, add a durable current-artifact pointer, or create another publication authority merely to make image, host, application, namespace, or version creation retryable. Traffic publication and rollback should switch one recorded immutable pointer when the topology supports it; build-time artifact preparation stays outside that publication path.

Prefer provider-native hot paths

For a measured Cloudflare bottleneck, identify the existing binding, bulk API, or authenticated REST operation before starting Wrangler or making a network round trip per item. Consider R2 bindings or direct REST uploads with an existing scoped token, D1 batch() or set-based SQL, KV bulk writes, Queue sendBatch(), direct Workers version/deployment readbacks, content-addressed asset reuse, and coalesced Durable Object writes when semantics permit.

Keep concurrency and transient retries bounded; preserve credential scope, provider limits, metadata, immutable verification, publication ordering, and rollback. Do not introduce S3 credentials, broader permissions, or a new service merely to optimize transport. Keep Wrangler for infrequent complex deployment mutations unless a supported API preserves every safety invariant; verify provider response schemas with a real canary.

Proportional workflow

1. Inspect current code and provisioned state for the touched surface. Resolve the exact account, environment, resource, bindings, and live version before mutation.
2. State the intended authority and repair/rollback path. For simple work, one sentence is enough.
3. Run focused local or remote checks that can falsify the change. Do not add unrelated global gates.
4. When authorized to deploy, upload and inspect before switching when the provider supports it. Use a verification path supported by the topology.
5. After mutation, verify only the affected rollout axes plus the user-visible capability. Record exact identities and rollback evidence.

When a cutover temporarily retains an old Worker, Durable Object namespace, or container application as the exact rollback target, leave it byte-for-byte and configuration-for-configuration unchanged through the rollback-compatibility window. Retention is temporary compatibility, not permanent dual-running. Remove the old artifact only in a separate bounded cleanup after live and rollback compatibility have been proven; do not hide that deletion inside the cutover or ordinary artifact garbage collection.

Pause when the exact production target, current state, retry safety, or rollback target cannot be resolved. A blocker in an unrelated surface is not permission to broaden the operation.