feat(#2680): add mint delete command to tear down mint infrastructure

[fullsend-ai-coder]

Summary

Add fullsend mint delete command — the inverse of mint deploy — to tear down mint infrastructure across all three deployment shapes:

• GCP (--platform=gcp): Deletes Cloud Function, PEM secrets, service account, and WIF pool/providers
• Cloudflare durable (--platform=cloudflare): Deletes the Worker script and all bindings/secrets
• Cloudflare preview (--platform=cloudflare --preview=<alias>): Abandons the preview alias without affecting the durable Worker

Changes

• Add DeleteFunction, DeleteServiceAccount, DeleteWIFPool methods to the GCFClient interface with LiveGCFClient REST API implementations
• Add DeleteMintFunction, DeleteMintServiceAccount, DeleteMintWIFPool provisioner wrapper methods
• Extend CF Provisioner.Teardown to support durable Worker deletion via wrangler delete (previously rejected durable mode)
• Implement newMintDeleteCmd() with --platform, --project, --region, --worker-name, --preview, --dry-run, --yolo flags
• GCP delete order: function → PEM secrets → service account → WIF pool. Non-critical resource failures (SA, WIF) are warnings, not hard errors
• Confirmation prompt requires typing "delete" (skippable with --yolo), consistent with mint unenroll

Testing

• 12 new CLI-level tests covering flag validation, dry-run, full teardown, mint-not-found, CF durable/preview, and confirmation prompt
• 3 CF provisioner tests updated to verify durable teardown calls Delete instead of rejecting
• All new tests pass with -race
• go vet ./... clean

---

Closes #2680

Post-script verification

• Branch is not main/master (agent/2680-mint-delete)
• Secret scan passed (gitleaks — 236cf9501b8cea35985463e345cc92270f1a21a2..HEAD)
• PR body secret scan passed (gitleaks — no-git)

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:15 AM UTC · Completed 6:35 AM UTC

Commit: 8b91b03 · View workflow run →

[codecov]

Codecov Report

❌ Patch coverage is 88.11881% with 36 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/cli/mint_delete.go	90.13%	15 Missing and 7 partials ⚠️
internal/dispatch/gcf/gcp.go	75.00%	6 Missing and 6 partials ⚠️
internal/dispatch/cf/provisioner.go	77.77%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Looks good to me

Previous run

Review

Findings

Low

• [coherence-stale-comment] internal/dispatch/cf/provisioner.go:312 — The validate() comment says "Teardown routes on DeployMode (DeployDurable → rejected)" but the PR changes Teardown to accept DeployDurable (calling wrangler.Delete). The guard itself (preventing DeployDurable + non-empty PreviewAlias) is still valid, but the stated rationale is now misleading.
  Remediation: Update the comment to reflect the new Teardown semantics — e.g., DeployDurable now triggers Worker deletion, so the mismatch would cause a preview deploy followed by a destructive full-Worker deletion.

• [coherence-stale-description] internal/cli/mint.go:374 — The parent mint command's Long description enumerates infrastructure subcommands as "deploy, enroll, unenroll, status, add-role, remove-role" but does not include "delete". Since the PR adds delete as a new infrastructure subcommand, this enumeration is now incomplete.
  Remediation: Add "delete" to the enumerated list.

• [api-shape-pattern] internal/cli/mint_delete.go:23 — The delete command introduces a testability mechanism (var cfResolveAuth = cf.ResolveCloudflareAuth) that diverges from the deploy command, which calls cf.ResolveCloudflareAuth(ctx) directly while tests set CLOUDFLARE_ACCOUNT_ID + CLOUDFLARE_API_TOKEN env vars. Both approaches work correctly; the inconsistency is cosmetic but creates two patterns for the same concern within the same package.
  Remediation: Either follow the deploy path (env var manipulation in tests) or apply the closure-override pattern consistently across both deploy and delete.

Previous run (2)

Review

Findings

Medium

• [test-inadequate] internal/cli/mint_test.go — TestMintDeleteGCP_FullTeardown only asserts PEM secrets were deleted but does not verify that DeleteFunction, DeleteServiceAccount, or DeleteWIFPool were called. A test for a delete command should verify the delete operations actually happened.
  Remediation: Assert that the fake client's calls list includes DeleteFunction, DeleteServiceAccount, and DeleteWIFPool.

• [test-inadequate] internal/cli/mint_test.go — TestMintDeleteCloudflare_DurableTeardown does not verify wrangler.Delete was called. The fakeCFWranglerRunner.Delete method returns nil without recording the call, so a no-op Teardown implementation would pass this test.
  Remediation: Add a deleteCalls field to fakeCFWranglerRunner, record in Delete, and assert len(fakeCF.deleteCalls) == 1.

• [missing-doc] docs/cli/mint.md:9 — The Commands table lists all mint subcommands but does not include mint delete. This is the primary CLI reference page.
  Remediation: Add a mint delete row and a dedicated ## mint delete section.

• [missing-doc] docs/guides/infrastructure/mint-administration.md:6 — The command summary table and IAM role table do not include mint delete.
  Remediation: Add mint delete to both tables and document the delete workflow.

• [missing-doc] docs/guides/dev/cli-internals.md:17 — The CLI command tree omits delete from the mint section.
  Remediation: Add delete to the mint section of the command tree.

• [missing-doc] docs/guides/getting-started/operations.md:105 — The standalone commands and IAM role breakdown tables omit mint delete.
  Remediation: Add mint delete rows to both tables.

• [missing-doc] docs/guides/infrastructure/infrastructure-reference.md:7 — The "Managed by" annotation for the Token Mint omits mint delete.
  Remediation: Add fullsend mint delete to the list.

Low

• [error-handling] internal/cli/mint_delete.go:246 — Summary unconditionally says "All mint infrastructure has been removed" even when service account or WIF pool deletion failed as warnings. Operators seeing warnings followed by this message get a contradictory signal.
  Remediation: Track whether warnings occurred and adjust the summary.

• [naming-convention] internal/cli/mint_delete.go:186 — Dry-run message uses -- instead of em-dash —. Every other dry-run message in the codebase (18+ occurrences) uses Dry run — no changes will be made. Two occurrences in this file.
  Remediation: Replace -- with — in both dry-run messages.

• [missing-validation] internal/dispatch/cf/provisioner.go:281 — Teardown() does not call validate() before executing, unlike Provision(). Mitigated by NewProvisioner defaults and CLI-layer validation, but the asymmetry is a defense-in-depth gap.
  Remediation: Add a validate() call at the top of Teardown().

• [stale-doc] docs/cli/mint.md:62 — Preview teardown description does not cross-reference mint delete as the explicit teardown command.
  Remediation: Add a cross-reference to mint delete.

---

Labels: PR adds new mint CLI subcommand and modifies mint provisioner infrastructure

[ifireball]

/fs-fix the review comments, and do not assume docs are out of scope

[fullsend-ai-coder]

🤖 Finished Fix · ✅ Success · Started 8:18 AM UTC · Completed 8:31 AM UTC

Commit: 8b91b03 · View workflow run →

[fullsend-ai-coder]

🔧 Fix agent — iteration 1 (human-triggered)

Addressed all 11 review findings: 2 test-inadequate (added GCF delete operation assertions and CF wrangler.Delete tracking), 6 missing-doc (added mint delete to all 5 referenced doc files), 1 stale-doc (cross-reference), 1 error-handling (conditional summary), 1 naming-convention (em-dash), 1 missing-validation (validate in Teardown).

Fixed (11):

1. TestMintDeleteGCP_FullTeardown only asserts PEM secrets deleted, not DeleteFunction/DeleteServiceAccount/DeleteWIFPool (internal/cli/mint_test.go): Added RecordedCalls accessor to fake GCF client and assertions verifying DeleteFunction, DeleteServiceAccount, and DeleteWIFPool were called
2. TestMintDeleteCloudflare_DurableTeardown does not verify wrangler.Delete was called (internal/cli/mint_test.go): Added deleteCalls field to fakeCFWranglerRunner, recorded calls in Delete method, and asserted exactly one Delete call with correct worker name
3. docs/cli/mint.md Commands table does not include mint delete (docs/cli/mint.md): Added mint delete row to Commands table and a dedicated mint delete section with GCP, CF durable, CF preview modes, flags table, and required IAM roles
4. docs/guides/infrastructure/mint-administration.md missing mint delete in command summary and IAM role tables (docs/guides/infrastructure/mint-administration.md): Added mint delete to command summary table and IAM role matrix with appropriate role markings
5. docs/guides/dev/cli-internals.md CLI command tree omits delete from mint section (docs/guides/dev/cli-internals.md): Added delete entry to the mint section of the CLI command tree
6. docs/guides/getting-started/operations.md standalone commands and IAM role tables omit mint delete (docs/guides/getting-started/operations.md): Added mint delete to standalone commands table and per-command IAM role breakdown matrix
7. docs/guides/infrastructure/infrastructure-reference.md Token Mint managed-by annotation omits mint delete (docs/guides/infrastructure/infrastructure-reference.md): Added fullsend mint delete to the managed-by annotation list
8. Summary unconditionally says 'All mint infrastructure has been removed' even when warnings occurred (internal/cli/mint_delete.go): Added hadWarnings tracking and conditional summary message that reports partial removal when non-critical resources failed
9. Dry-run messages use -- instead of em-dash (internal/cli/mint_delete.go): Replaced -- with em-dash in both GCP and Cloudflare dry-run messages to match codebase convention
10. Teardown() does not call validate() before executing, unlike Provision() (internal/dispatch/cf/provisioner.go): Added validate() call at the top of Teardown() for defense-in-depth parity with Provision()
11. Preview teardown description does not cross-reference mint delete (docs/cli/mint.md): Added cross-reference to mint delete --platform=cloudflare --preview= in the preview deploy description

Tests: passed

Next steps:

• /fs-review — request a re-review of the changes
• /fs-fix <your instruction> — run another fix pass with specific guidance
• Push commits directly — review re-runs automatically on push
  _{Updated by fullsend fix agent}

[fullsend-ai-review]

🤖 Review · ❌ Terminated · Started 8:32 AM UTC · Ended 8:50 AM UTC

Commit: 2bdfa17 · View workflow run →

[github-actions]

Site preview

Preview: https://3b204bb6-site.fullsend-ai.workers.dev

Commit: 664cb5aa912720886f64e6bab9eac2d6e38a8bf5

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:32 AM UTC · Completed 8:50 AM UTC

Commit: 2bdfa17 · View workflow run →

[ifireball]

/fs-fix fix the additional comments, and get coverage to 80% or above for this PR

[fullsend-ai-coder]

🤖 Finished Fix · ✅ Success · Started 8:58 AM UTC · Completed 9:15 AM UTC

Commit: 2bdfa17 · View workflow run →

[fullsend-ai-coder]

🔧 Fix agent — iteration 2 (human-triggered)

Addressed all 3 review findings (stale comment, missing 'delete' in description, inconsistent testability pattern) and boosted test coverage with 35+ new tests covering delete operations across CLI, provisioner, LiveGCFClient, and fake client layers.

Fixed (8):

1. validate() comment says 'DeployDurable → rejected' but Teardown now accepts DeployDurable (internal/dispatch/cf/provisioner.go): Updated comment to reflect new Teardown semantics: DeployDurable now triggers full Worker deletion, so the mismatch would cause a preview deploy followed by a destructive full-Worker deletion
2. Parent mint command Long description missing 'delete' in subcommand enumeration (internal/cli/mint.go): Added 'delete' to the enumerated infrastructure subcommands list
3. Delete command uses closure-override pattern (var cfResolveAuth) diverging from deploy command's env-var approach (internal/cli/mint_delete.go): Removed cfResolveAuth closure variable, now calls cf.ResolveCloudflareAuth(ctx) directly to match deploy command pattern. Updated all three CF delete tests to use env var manipulation (CLOUDFLARE_ACCOUNT_ID/CLOUDFLARE_API_TOKEN) instead of closure override
4. Patch coverage at 55.63%, needs 80%+ (internal/cli/mint_test.go): Added 11 new CLI tests covering uncovered paths: invalid region, discovery failure, DeleteFunction failure, SA/WIF warning paths, invalid worker name, invalid preview alias, auth failure, dry-run preview, default worker name, CF confirmation required, and unsupported platform
5. gcf/provisioner.go delete wrappers at 0% coverage (internal/dispatch/gcf/provisioner_test.go): Added 9 unit tests for DeleteMintFunction, DeleteMintServiceAccount, DeleteMintWIFPool, and DeleteWIFProvider wrapper methods covering success and error paths
6. gcf/gcp.go LiveGCFClient delete methods at 0% coverage (internal/dispatch/gcf/gcp_test.go): Added httptest-based tests for DeleteFunction (4 subtests), DeleteServiceAccount (3 subtests), and DeleteWIFPool (3 subtests) covering success, not-found idempotency, and error paths
7. gcf/fakeclient.go delete operations and accessor methods at 0% coverage (internal/dispatch/gcf/fakeclient_test.go): Added tests for fake client delete operations (DeleteFunction, DeleteServiceAccount, DeleteWIFPool), error injection, and RecordedCalls/ProjectIAMBindingCount/DeletedSecretIDs with non-fake clients
8. cf/provisioner.go Teardown validation and error paths uncovered (internal/dispatch/cf/provisioner_test.go): Added Teardown tests for validation failure (missing AccountID) and wrangler delete error propagation

Tests: passed

Next steps:

• /fs-review — request a re-review of the changes
• /fs-fix <your instruction> — run another fix pass with specific guidance
• Push commits directly — review re-runs automatically on push
  _{Updated by fullsend fix agent}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:17 AM UTC · Completed 9:29 AM UTC

Commit: 664cb5a · View workflow run →

[ifireball]

Approving after local tests indicate this is working both o GCP and on CF.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 10:18 AM UTC · Completed 10:32 AM UTC

Commit: 664cb5a · View workflow run →

[fullsend-ai-retro]

Retro: PR #6022 — mint delete command

Timeline

1. Issue mint delete: add command to tear down mint infrastructure (GCP + Cloudflare) #2680 created 2026-06-26 requesting fullsend mint delete command
2. Triage completed 2026-08-09 (run 31334977258, run 31336578255)
3. Code agent (run 31359650298) produced PR feat(#2680): add mint delete command to tear down mint infrastructure #6022 at 06:14 UTC — 1,332 additions across 17 files
4. Review agent (run 31361249369) found 11 findings at 06:35 (2 medium test-inadequate, 6 medium missing-doc, 3 low)
5. Human triggered /fs-fix at 08:17 with note: "do not assume docs are out of scope"
6. Fix agent (run 31369433373) addressed all 11 findings
7. Review agent (run 31370446162) re-review at 08:50 found 3 remaining low findings, approved
8. Human triggered second /fs-fix at 08:57 requesting coverage >= 80%
9. Fix agent (run 31372367108) addressed 3 remaining findings + added 35 tests
10. Review agent (run 31373791383) final approval at 09:29 — clean
11. Human approved at 10:01 after local GCP + CF testing
12. Merged at 10:15 — ~4 hours total, 2 human interactions, 3 review cycles

Workflow Quality

Review quality was excellent. All 14 findings across 3 review runs were legitimate (100% precision, 0 false positives). Severity ratings were well-calibrated — mediums for real test and doc coverage gaps, lows for cosmetic and consistency issues. The human reviewer added runtime verification value (local GCP + CF testing) but surfaced no code-level findings the agent missed.

The main rework driver was missing documentation. 6 of 11 initial findings were about mint delete not being added to doc files that enumerate mint subcommands. The code agent implemented the feature correctly but didn't update any of the 5 relevant doc files. The pattern was discoverable — grep -r "mint deploy" docs/ returns all files that needed updating. AGENTS.md covers doc updates for command removal/rename but not additions, which likely contributed. See proposal below.

Test assertions were incomplete. The code agent built fake client recording infrastructure (f.record() calls) but didn't assert on the recorded calls in tests. The assertion pattern is ubiquitous in the same test files — existing tests consistently use assert.Contains(t, fake.calls, ...). This overlaps with existing issues.

Evidence for Existing Issues

• Code agent should proactively update documentation when implementing user-facing features #1733 (code agent should proactively update docs for user-facing features): Direct evidence — the code agent produced a new CLI command without touching any of 5 relevant doc files.
• Triage agent should enumerate documentation touchpoints for CLI changes agents#452 (triage agent should enumerate documentation touchpoints for CLI changes): Had the triage output listed the doc files, the code agent would have had explicit targets.
• Code agent should verify new tests exercise the specific code path being changed, not just adjacent mock logic #4057 (code agent should verify tests exercise the specific code path being changed): The test-inadequate findings demonstrate this — recording infra was built but assertions were omitted.
• Code agent should validate patch coverage meets repo threshold before opening PR #2810 (code agent should validate patch coverage meets repo threshold): The human had to explicitly request "get coverage to 80%" in the second /fs-fix.

Autonomy Readiness

The review agent achieved 100% precision across 14 findings with accurate severity calibration. The human reviewer's approval added runtime verification (local GCP + CF testing) but no code-level findings beyond what the agent already surfaced. This is a positive signal for the review agent's capability on feature-addition PRs in Go CLI code.

Proposals filed

• AGENTS.md: add doc-update guidance for new CLI command additions (in fullsend-ai/fullsend)