Launch workflow
Lock the project contract
[capabilities], release-mode checks, and
the configured health path before remote build work begins. Keep generated
directories, compiled artifacts, and secrets out of deploy archives.Dry-run before creating a build
missingConfig, requiredFixes, enabled and disabled
capabilities, meterPlan, limits, usage, and billingEstimate. Do not
deploy until the dry-run output matches the intended service shape.Set caps for expected load
billingEstimate.lineItems to pick the
meters that match the service. Set hard caps before load tests, media
imports, queue fan-out, or paid usage.Prepare runtime dependencies
accountUsage, billingEstimate,
and next actions. Add secrets with tovuk env set, create required
service resources, and verify custom domains before traffic depends on
them.Deploy and keep ids
build_job.id, and final_build.status from the
deploy response. If a newer deploy supersedes queued work, cancel the stale
deploy with tovuk deploy cancel <deploy_id> --json.Separate platform status from project failures
/health, /healthz, and /v1/status only to check Tovuk API
availability. When the API is available but a project build or runtime
fails, inspect build, deploy, and service logs before changing code.Readiness checks
| Area | Production Check | Source |
|---|---|---|
| Project Contract | tovuk check --json passes, tovuk.toml names the kind and explicit capabilities, and the worker health path is configured. | tovuk.toml |
| Deploy Plan | tovuk deploy --dry-run --json returns the intended capabilities, meters, meterPlan, limits, and billingEstimate. | Deploy |
| Cost Guardrails | tovuk pricing --json and tovuk usage --json are reviewed, then caps are set for expected traffic and resource usage. | Usage Caps |
| Runtime Resources | SQLite, Object Storage, KV, Queues, Cron, State, and Service Bindings are created only when the Service needs them, then verified with tovuk service show <service> --json. | Service Resources |
| Secrets | Secrets are stored with tovuk env set, listed only as metadata, and never printed, committed, or exposed to browser code. | Secrets |
| Hostnames | Custom domains are added and verified with the returned DNS record. Do not point A records at Tovuk origin hosts. | Custom Domains |
| Deploy Evidence | The deploy id, build_job.id, final_build.status, service URL, and first actionable log line are preserved for recovery. | Logs and Builds |
| Platform Status | /health, /healthz, and /v1/status are used for Tovuk API availability, not project debugging. | Status |