Everything is automated through two GitHub Actions workflows; production is a single Railway service with a persistent volume.

Jobs are selected by commit-message markers or workflow_dispatch. The full marker set, as parsed by the workflow, is:

[test] · [deploy] · [publish] · [probe] · [drain] · [paytest] · [purl] · [bazaar-refresh] · [bazaar-register] · [bazaar-solana]

• Every 15 min (scheduled): probe production - /health, catalog ≥400, a real PoW-paid call, MCP initialize. Three consecutive failures → a Heartbeat: production DOWN issue (auto-closed on recovery).
• Revenue tracking is no longer a heartbeat job. The old 6-hourly "External customer payments detected" issue-comment loop is retired: it was a good first-customer alarm but every new buy became another comment on one issue, which stops being readable at volume. The canonical sources are now the /__operator dashboard, /api/stats, and on-chain history.

/api/stats and the operator dashboard (/__operator) break served calls into three rails so a maintainer can see real external demand at a glance, not just total volume:

• USDC - settled on-chain via x402; the X-PAYMENT-RESPONSE header presence is authoritative.
• Proof-of-work - the PoW gate accepted a valid X-Pow-Solution; the operator sees how much of the free-tier traffic is real.
• Heartbeat - Agent402's own 15-minute production probe. Gated on a POW_SECRET-signed X-Heartbeat-Token (HMAC of the current UTC minute, ±5 min skew) so it can't be impersonated by a spoofed User-Agent. Lets the operator subtract internal noise from external demand.

There's also a charged-but-failed counter: any non-200 response that left an X-PAYMENT-RESPONSE header is recorded - the buyer paid on-chain but the handler errored, so the operator can chase it down before they complain.

• Railway, single service, Docker (Node 22 + Chromium + ffmpeg), persistent volume at /data (SQLite: stats, memory, PoW replay). Without the volume, counters and paid memory reset on every redeploy - this was a real incident; the volume is now asserted by the deploy job.
• Graceful SIGTERM: in-flight (already-paid) requests drain before exit.
• Env that matters: WALLET_ADDRESS, NETWORK, CDP_API_KEY_ID/SECRET (facilitator), BASE_URL, BRAVE_API_KEY (search), POW_SECRET (durable PoW + heartbeat-token signer), X402_INDEX_SEEDS (extra origins for the Index, optional), FREE_MODE (never in production).

1. A heartbeat issue opened? Check the linked run for which probe failed, then the probe job for Railway build/deploy logs.
2. Redeploy = push a [deploy] commit (or dispatch the workflow with mode deploy).
3. Catalog regressions are caught pre-deploy by the test job; production checks tolerate ~2 min of rollout race before declaring failure.