Fix follow-up cron wiring

Author: MaxLinCode

README.md

@@ -92,7 +92,7 @@ For local-only test credentials, prefer `apps/web/.env.test.local`, which is git
 - `GOOGLE_OAUTH_REDIRECT_URI`: OAuth callback URL for Google Calendar linking
 - `GOOGLE_LINK_TOKEN_SECRET`: secret used only for one-time Telegram-to-browser Google link handoff tokens
 - `GOOGLE_CALENDAR_TOKEN_ENCRYPTION_KEY`: base64-encoded 32-byte key used to encrypt stored Google access and refresh tokens
-- `CRON_SECRET`: bearer token required for protected cron routes such as Google Calendar reconciliation
+- `CRON_SECRET`: bearer token required for protected cron routes such as Google Calendar reconciliation and follow-up dispatch
 
 To register the production Telegram webhook once those values are set, also export `ATLAS_WEBHOOK_URL` as the full deployed route URL and run `pnpm telegram:webhook:set`.
 
@@ -106,6 +106,8 @@ Atlas no longer exposes public planner/debug mutation routes. The intended exter
 - `GET /api/google-calendar/oauth/callback`
 - protected cron routes that require `Authorization: Bearer $CRON_SECRET`
 
+The production deployment schedules follow-up dispatch on Vercel every 10 minutes via `GET /api/cron/send-followups`.
+
 ## How We Work
 
 This repo is designed for human-plus-agent collaboration.

apps/web/src/app/api/cron/send-followups/route.test.ts

@@ -1,6 +1,6 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
-import { POST } from "./route";
+import { GET, POST } from "./route";
 
 const { runBundledFollowUpsMock } = vi.hoisted(() => ({
   runBundledFollowUpsMock: vi.fn()
@@ -24,7 +24,7 @@ describe("send followups cron route", () => {
   it("rejects unauthenticated cron requests", async () => {
     process.env.CRON_SECRET = "cron-secret";
 
-    const response = await POST(new Request("http://localhost/api/cron/send-followups", { method: "POST" }));
+    const response = await GET(new Request("http://localhost/api/cron/send-followups"));
 
     expect(response.status).toBe(401);
     await expect(response.json()).resolves.toMatchObject({
@@ -34,7 +34,7 @@ describe("send followups cron route", () => {
   });
 
   it("fails closed when the cron secret is not configured", async () => {
-    const response = await POST(new Request("http://localhost/api/cron/send-followups", { method: "POST" }));
+    const response = await GET(new Request("http://localhost/api/cron/send-followups"));
 
     expect(response.status).toBe(503);
     await expect(response.json()).resolves.toMatchObject({
@@ -43,7 +43,24 @@ describe("send followups cron route", () => {
     });
   });
 
-  it("runs followups for authorized cron requests", async () => {
+  it("runs followups for authorized GET cron requests", async () => {
+    process.env.CRON_SECRET = "cron-secret";
+
+    const response = await GET(
+      new Request("http://localhost/api/cron/send-followups", {
+        headers: { authorization: "Bearer cron-secret" }
+      })
+    );
+
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toMatchObject({
+      accepted: true,
+      sentBundles: 0
+    });
+    expect(runBundledFollowUpsMock).toHaveBeenCalledTimes(1);
+  });
+
+  it("also accepts authorized POST requests", async () => {
     process.env.CRON_SECRET = "cron-secret";
 
     const response = await POST(

apps/web/src/app/api/cron/send-followups/route.ts

@@ -31,7 +31,7 @@ function isAuthorized(request: Request) {
   return { ok: true as const };
 }
 
-export async function POST(request: Request) {
+async function handleRequest(request: Request) {
   const auth = isAuthorized(request);
 
   if (!auth.ok) {
@@ -40,3 +40,11 @@ export async function POST(request: Request) {
 
   return jsonOk(await runBundledFollowUps());
 }
+
+export async function GET(request: Request) {
+  return handleRequest(request);
+}
+
+export async function POST(request: Request) {
+  return handleRequest(request);
+}

apps/web/src/lib/server/follow-up.test.ts

@@ -6,7 +6,8 @@ import {
   listTasksForTests,
   resetInboxProcessingStoreForTests,
   resetIncomingTelegramIngressStoreForTests,
-  seedInboxItemForProcessingTests
+  seedInboxItemForProcessingTests,
+  type FollowUpRuntimeStore
 } from "@atlas/db";
 
 import { runBundledFollowUps } from "./follow-up";
@@ -187,4 +188,87 @@ describe("runBundledFollowUps", () => {
       taskIds: [...initialTaskIds, ...laterTaskIds]
     });
   });
+
+  it("deduplicates identical follow-up bundles across repeated runner attempts", async () => {
+    const reservedKeys = new Set<string>();
+    const deliveryStore = {
+      reserveOutgoingIfAbsent: vi.fn(async (event) => {
+        if (reservedKeys.has(event.idempotencyKey)) {
+          return { status: "duplicate" as const };
+        }
+
+        reservedKeys.add(event.idempotencyKey);
+        return { status: "reserved" as const, eventId: "event-1" };
+      }),
+      updateOutgoing: vi.fn(async () => undefined)
+    };
+    const sender = vi.fn().mockResolvedValue({
+      ok: true,
+      result: {
+        message_id: 88,
+        date: 1_700_000_000,
+        chat: {
+          id: "123",
+          type: "private"
+        },
+        text: "sent"
+      }
+    });
+    const dueTask = {
+      id: "task-1",
+      userId: "123",
+      sourceInboxItemId: "inbox-a",
+      lastInboxItemId: "inbox-a",
+      title: "Review launch checklist",
+      lifecycleState: "scheduled" as const,
+      externalCalendarEventId: null,
+      externalCalendarId: null,
+      scheduledStartAt: "2026-03-20T16:00:00.000Z",
+      scheduledEndAt: "2026-03-20T17:00:00.000Z",
+      calendarSyncStatus: "in_sync" as const,
+      calendarSyncUpdatedAt: null,
+      rescheduleCount: 0,
+      lastFollowupAt: null,
+      followupReminderSentAt: null,
+      completedAt: null,
+      archivedAt: null,
+      priority: "medium" as const,
+      urgency: "medium" as const,
+      createdAt: "2026-03-20T16:00:00.000Z",
+      dueType: "initial" as const
+    };
+    const store: FollowUpRuntimeStore = {
+      listDueFollowUpTasks: vi.fn(async () => [dueTask]),
+      listOutstandingFollowUpTasks: vi.fn(async () => []),
+      hasInFlightInboxItem: vi.fn(async () => false),
+      markFollowUpSent: vi.fn(async () => undefined),
+      markFollowUpReminderSent: vi.fn(async () => undefined)
+    };
+
+    await runBundledFollowUps("2026-03-20T19:00:00.000Z", {
+      store,
+      deliveryStore,
+      sender
+    });
+    await runBundledFollowUps("2026-03-20T19:00:00.000Z", {
+      store,
+      deliveryStore,
+      sender
+    });
+
+    expect(sender).toHaveBeenCalledTimes(1);
+    expect(deliveryStore.reserveOutgoingIfAbsent).toHaveBeenCalledTimes(2);
+    expect(deliveryStore.reserveOutgoingIfAbsent).toHaveBeenNthCalledWith(
+      1,
+      expect.objectContaining({
+        idempotencyKey: "telegram:followup:inbox-item:initial:task-1"
+      })
+    );
+    expect(deliveryStore.reserveOutgoingIfAbsent).toHaveBeenNthCalledWith(
+      2,
+      expect.objectContaining({
+        idempotencyKey: "telegram:followup:inbox-item:initial:task-1"
+      })
+    );
+  });
 });

apps/web/src/lib/server/follow-up.ts

@@ -51,14 +51,14 @@ export async function runBundledFollowUps(
     const outstanding = await store.listOutstandingFollowUpTasks(userId);
     const initialTaskIds = new Set(initialTasks.map((task) => task.id));
     const reminderTaskIds = new Set(reminderTasks.map((task) => task.id));
-    const bundleTasks = mergeFollowUpBundleTasks(outstanding, initialTasks);
+    const bundleTasks = mergeFollowUpBundleTasks(outstanding, initialTasks, reminderTasks);
 
     if (bundleTasks.length === 0) {
       continue;
     }
 
     const bundle = buildFollowUpBundle(bundleTasks, initialTasks.length > 0 ? "initial" : "reminder");
-    const delivery = await sendFollowUpBundle(userId, bundle, now, dependencies);
+    const delivery = await sendFollowUpBundle(userId, bundle, dependencies);
 
     if (delivery.status === "failed") {
       continue;
@@ -84,7 +84,8 @@ export async function runBundledFollowUps(
 
 function mergeFollowUpBundleTasks(
   outstanding: Task[],
-  initialTasks: FollowUpDueTask[]
+  initialTasks: FollowUpDueTask[],
+  reminderTasks: FollowUpDueTask[]
 ) {
   const tasksById = new Map<string, Pick<Task, "id" | "title" | "scheduledEndAt">>();
 
@@ -98,6 +99,12 @@ function mergeFollowUpBundleTasks(
     }
   }
 
+  for (const task of reminderTasks) {
+    if (!tasksById.has(task.id)) {
+      tasksById.set(task.id, task);
+    }
+  }
+
   return Array.from(tasksById.values());
 }
 
@@ -138,7 +145,6 @@ export function buildFollowUpBundle(tasks: Pick<Task, "id" | "title" | "schedule
 async function sendFollowUpBundle(
   userId: string,
   bundle: RenderedFollowUpBundle,
-  now: string,
   dependencies: FollowUpRunnerDependencies
 ) {
   const chatId = userId;
@@ -148,7 +154,7 @@ async function sendFollowUpBundle(
       userId,
       chatId,
       text: bundle.text,
-      idempotencyKey: `${buildTelegramFollowUpIdempotencyKey(`${bundle.kind}:${bundle.taskIds.join(",")}:${now}`)}:${bundle.taskIds.length}`,
+      idempotencyKey: buildTelegramFollowUpIdempotencyKey(`${bundle.kind}:${bundle.taskIds.join(",")}`),
       bundle
     },
     {

docs/workflows/production-deploy-checklist.md

@@ -109,8 +109,11 @@ curl "https://api.telegram.org/bot$TELEGRAM_BOT_TOKEN/getWebhookInfo"
 
 ### Cron protection
 
-1. Call the reconcile route without `Authorization: Bearer $CRON_SECRET` and confirm it is rejected.
-2. Call the same route with the correct bearer token and confirm it succeeds.
+1. Confirm Vercel Cron Jobs includes `/api/cron/send-followups` on the production deployment.
+2. Call the follow-up cron route without `Authorization: Bearer $CRON_SECRET` and confirm it is rejected.
+3. Call the follow-up cron route with the correct bearer token and confirm it succeeds.
+4. Call the reconcile route without `Authorization: Bearer $CRON_SECRET` and confirm it is rejected.
+5. Call the reconcile route with the correct bearer token and confirm it succeeds.
 
 ### Basic safety checks
 

vercel.json

@@ -1,5 +1,11 @@
 {
   "$schema": "https://openapi.vercel.sh/vercel.json",
+  "crons": [
+    {
+      "path": "/api/cron/send-followups",
+      "schedule": "*/10 * * * *"
+    }
+  ],
   "buildCommand": "pnpm build",
   "installCommand": "pnpm install --frozen-lockfile"
 }