| name | worker-operations |
| description | Use when handling day-to-day worker operations such as health checks, log triage, incident response, and rollback |
Worker Operations Runbook
When To Use
Use this skill for production support and incident response, not feature implementation.
Scope
Use this skill for active operations, not feature development.
- health checks
- production diagnostics
- tailing logs
- deploy verification
- rollback decisions
Quick Operational Checks
curl -s https://ccr-router.jonathan-mohrbacher.workers.dev/health
Expected: ok
Authenticated check:
curl -s -o /tmp/worker_sessions.json -w "%{http_code}" \
-H "Authorization: Bearer $(cat /run/secrets/ccr_api_key)" \
"https://ccr-router.jonathan-mohrbacher.workers.dev/sessions"
Expected: HTTP 200
Incident Triage Sequence
- Confirm worker health endpoint.
- Confirm auth path (
/sessions with valid bearer).
- Confirm webhook auth behavior:
- wrong secret ->
401
- correct secret ->
200
- Confirm notification path with a test session.
- Confirm daemon is polling (check
machines table for recent last_poll_at).
Logs
cd ~/projects/pigeon/packages/worker
export CLOUDFLARE_API_TOKEN="$(cat /run/secrets/cloudflare_api_token)"
wrangler tail --format=pretty
When reading logs, prioritize:
- auth failures (401)
- webhook parse/validation failures
- Telegram API failures
- queue retry spikes
Deploy Verification Checklist
After deploy:
GET /health returns ok.
- Authenticated
/sessions returns 200.
- Webhook secret check behaves as expected.
- Notification send returns
{ ok: true, messageId, token }.
Safe Rollback Guidance
Use rollback if:
- health/auth paths regress,
- notification send fails broadly,
- webhook processing breaks for valid traffic.
Then:
- Roll back worker using Cloudflare tooling.
- Re-run quick operational checks.
- Capture incident notes and root-cause breadcrumbs before re-deploy.
Guardrails
- Do not rotate secrets during active incidents unless confirmed compromised.
- Keep D1 schema migrations backward-compatible across deploys.
- Prefer reading secrets from
/run/secrets/ files over manual exports or shell history.
Verify
curl -s https://ccr-router.jonathan-mohrbacher.workers.dev/health
Expected: ok