Launch checklist for AI-generated code
Move an AI-generated Cloudflare project from “looks runnable” to verified APIs, permissions, tests, cost, and rollback.
Edited and verified by Orange Book Editorial Team ·
An AI completion claim is not acceptance evidence
“Fixed,” “deployed,” and “Workers-compatible” require a command, response, or current primary-source API page. An assistant cannot know your final Dashboard state without evidence you provide.
Six gates
| Gate | Evidence to retain |
|---|---|
| APIs | A current official source for every Wrangler field and Runtime API |
| Authorization | Minimum token, resource scope, and clean secret scan |
| Correctness | Success, invalid input, 404, and downstream-failure tests |
| Runtime | A real workerd or preview result |
| Cost | Gzip bundle size, CPU, request, and downstream-operation model |
| Rollback | Known-good version, data compatibility, and trigger conditions |
Execution order
Read configuration instead of guessing
Check each field against the current Wrangler reference. Verify compatibility date, bindings, and environments. Remove real IDs, tokens, and broad permissions generated by AI.
Search for server assumptions
Inspect filesystem, resident memory, listening sockets, native modules, and Node stubs. Use Runtime versus Node.js.
Run failure paths
Cover empty and malicious input, missing resources, absent bindings, and downstream failure. Return stable client errors without stack traces.
Build and exercise workerd
Run lint, types, and tests, then a production build and Wrangler dry run. Finally observe status, headers, and real data boundaries at a preview URL.
Review change and rollback
Read the diff manually and list architecture changes and irreversible actions. D1 migrations, DNS, WAF, and published routes always require separate confirmation.
Primary sources
Did this page help you complete your goal?
Beta feedback is generated in this browser and is never uploaded automatically.
From keyword search to AI Search
Choose keywords, Vectorize, or managed AI Search from user intent, data scale, explainability, and maintenance cost.
Recipe: production R2 delivery, CORS, and private uploads
Separate custom domains, CORS, and presigned URLs to deliver images, PDFs, and attachments safely in production.