ci(ag-ui): verify the deployed runtime mounts every topic after deploy - #925
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![github-actions[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
blove
enabled auto-merge (squash)
September 1, 2026 06:04
blove
force-pushed
the
blove/ag-ui-post-deploy-verify
branch
from
September 1, 2026 06:05
0a0b37c to
2ca4711
Compare
Contributor
The boot gate added in #899 proves the aggregated server imports with the pinned deps. It cannot prove the rollout took: `railway up --detach` returns at upload time, and when a new image fails to start Railway keeps serving the last good one. From CI a broken deploy is indistinguishable from a healthy one, and /ok is no help — a stale image answers it happily. That combination hid a dead capability for two and a half months: /agent/subagents was 404 in production from 2026-06-16 until 2026-08-31 while every deploy reported success. Poll the endpoints the SPAs actually call until each topic answers, and fail the deploy if any does not. An empty POST is a token-free canary — the request model rejects it before any graph or LLM call runs, so 422 means mounted, 404 means missing, 401 means internal-token mismatch. Probing goes through the public Vercel proxy because the FastAPI middleware requires X-Internal-Token, which is deliberately not a CI secret. The topic list mirrors collectTopics() in the deployment generator, so it asserts exactly what the deployment was generated to mount and a new topic is covered with no edit here. URLs are product-aware: 'ag-ui' and 'runtimes' capabilities share the runtime but the examples route table has a separate rule per product. Verified against production: 9/9 topics mounted, exit 0. Against the outage it was written for, it named the failing topic and pointed at the Railway build log. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
blove
force-pushed
the
blove/ag-ui-post-deploy-verify
branch
from
September 1, 2026 06:11
2ca4711 to
0cd8914
Compare
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the gap that hid the subagents outage for two and a half months.
The boot gate from #899 proves the aggregated server imports with the pinned deps. It can't prove the rollout took:
railway up --detachreturns at upload time, before the image builds or starts./okis no help — a stale image answers it happily.So from CI, a broken deploy is indistinguishable from a healthy one.
/agent/subagentswas 404 in production from 2026-06-16 to 2026-08-31 while every deploy reported success, and today's runtime topics couldn't appear either.The check
Poll the endpoints the SPAs actually call until each topic answers; fail the deploy if any doesn't.
An empty POST is a token-free canary — the FastAPI request model rejects it before any graph or LLM call runs:
422404401AG_UI_INTERNAL_TOKENmismatchProbing goes through the public Vercel proxy because the middleware requires
X-Internal-Token, which is deliberately not a CI secret.The topic list mirrors
collectTopics()in the deployment generator, so it asserts exactly what the deployment was generated to mount — a new topic is covered with no edit here. URLs are product-aware:ag-uiandruntimesshare the runtime, but the examples route table has a separate rule per product, so probing a runtime under/ag-uiwould pass through the wrong rule and stop reflecting what the SPA calls.Verification
Against production right now — 9/9 mounted, exit 0:
Against the outage it was written for, it named the failing topic and pointed at the Railway build log rather than reporting green.
Unit spec: 11 pass, pinning the status semantics (a well-meaning "simplify to
status < 500" would silently reintroduce the blind spot) and the per-product URL mapping.eslintreports one@nx/enforce-module-boundarieserror for the relative registry import — identical to the existingscripts/generate-ag-ui-deployment-config.ts, and rootscripts/isn't in any lint target.🤖 Generated with Claude Code