---
name: deploy-verify-watch
description: >-
  Background-watch live-verify PRs: classify auth/multi-SPA/deploy changes,
  auto-dispatch Deploy Organization (or configured workflow) on each new head
  SHA, and wake the agent when the deploy finishes so a human can re-smoke
  before Approve/merge. Use when opening or pushing to PRs that need host
  verification, or when the user asks to watch deploy-verify.
---

# Deploy verify watch (live smoke before land)

**Some PRs cannot be trusted on CI alone.** Auth handoffs, logout/`redirect_uri`,
cookie SSO, multi-SPA cutovers, and Deploy Org wiring need a real **dev** host
smoke after each push — before Approve/merge.

This skill closes the gap where PR Checks re-run on push but **no deploy**
fires until a human asks in chat.

## When a PR is "live-verify"

Arm this watcher when any of these are true (script `--classify` encodes the
same heuristics):

| Signal | Examples |
| ------ | -------- |
| Label | `verify-live` or `live-verify` |
| Paths | `accounts-frontend`, `AccountsAuthRedirect`, `accounts-redirect`, `return-to`, `session-expiry`, `deploy-organization.yml`, `frontend-accounts-stack`, `frontend-app.ts` |
| Title/body | `redirect_uri`, logout, cookie, SSO, Phase 0e, cutover, post-login, `accounts.dev` / `admit.dev` |

When unsure, arm anyway and/or add the `verify-live` label.

## Hard rules

1. After opening or pushing to a live-verify PR (or when the user asks), start
   `.claude/skills/deploy-verify-watch/scripts/watch-deploy-verify.sh` in the **background** with agent
   `notify_on_output` on `^AGENT_LOOP_WAKE_deploy_verify`.
2. Do **not** redirect watcher stdout away from the monitored terminal.
3. Prefer `--dispatch-on-arm` (or default `--auto-dispatch`) so the **current**
   head gets a deploy without waiting for another push.
4. On `deploy_green`: tell the human the SHA/environment is ready to re-smoke;
   do **not** merge on green alone — Approve remains the merge proceed signal
   (`pr-approve-watch`).
5. On `deploy_failed`: remediate (logs → fix → push). The watcher re-dispatches
   on the new SHA.
6. After any fix that invalidates a prior smoke, **do not wait for chat** —
   push and keep this watcher armed (auto-dispatch handles the redeploy).
7. Pair with `pr-approve-watch` for Approve → triage → merge.

## Launch template

```bash
# From workspace root (paths work after team-setup update-config)
bash .claude/skills/deploy-verify-watch/scripts/watch-deploy-verify.sh \
  --interval 30 \
  --activate ~/.config/rosetta/github-app-activate.sh \
  --workflow "Deploy Organization" \
  --environment dev \
  --frontend \
  --dispatch-on-arm \
  --kickoff \
  Rosetta-Foundation/rosetta_dev-scripts#1
```

Classify only:

```bash
bash .claude/skills/deploy-verify-watch/scripts/watch-deploy-verify.sh \
  --classify Rosetta-Foundation/rosetta_dev-scripts#1
# exit 0 = needs live verify
```

Optional: `--activate ~/.config/<workspace>/github-app-activate.sh` for a
consumer workspace.
`--no-auto-dispatch` if you will dispatch manually but still want completion wakes.

## On wake

1. `eval "$(bash ~/.config/rosetta/github-app-activate.sh)"` by default, or
   use the consumer workspace's `~/.config/<workspace>/github-app-activate.sh`.
2. Read the wake JSON (`reason`, `sha`, `runUrl`, `target`).
3. Act by reason:
   - `kickoff` / `deploy_dispatched` / `head_pushed`: wait for deploy outcome
     unless remediation is already needed; do not ping the human to smoke yet.
   - `deploy_green`: notify human — re-smoke on the live hosts for this SHA;
     link the Actions run. Keep `pr-approve-watch` armed for Approve.
   - `deploy_failed`: `gh run view <id> --log-failed`, fix, commit, push.
   - `pr_merged` / `pr_closed`: brief report; drop this target.
4. Never treat deploy green as permission to merge.

## Anti-patterns

- Assuming PR Checks = deployed to `admit.dev` / `accounts.dev`.
- Waiting for the human to ask "is it redeployed?" after you pushed a fix.
- Merging on deploy green without Approve + review-comment triage.
- Swallowing wake sentinels by redirecting watcher stdout.