Fail startup when database migrations fail instead of logging and continuing

[N-thnI]

Description

Refuse to serve traffic against a schema that may be missing required tables.

Problem Statement

startServer swallows migration failure outright (index.js:131-136):

catch (migrationErr) {
  logger.error({ error: migrationErr.message }, '[startup] Database migrations failed — continuing');
}

The server then binds the port and accepts /github-webhook requests against a schema that may be missing the retry_state table entirely. Every subsequent initRetryState / recordRetry throws — and those throws are themselves swallowed as "non-fatal" in src/workers/event-worker.js:53-55 and :82-84.

Net effect: merged PRs are accepted with 202 { ok: true, queued: true }, then fail to register with no durable retry record — a silent, payment-affecting data-loss path.

Proposed Changes

• Rethrow (or process.exit(1)) on migration failure in startServer, so a bad deploy fails loudly and the orchestrator doesn't route traffic to it
• Apply the same to startEventWorker — a worker with no retry_state table cannot do its job
• If a partial-degradation mode is genuinely wanted, gate it behind an explicit env flag and have /health report DEGRADED while active

Technical Implementation Scaffolding

• Target Repository: vero-relayer-service
• Target Path: index.js, src/workers/event-worker.js
• Branch Naming: fix/issue--fail-startup-on-migration-failure
• Authority Context: Reliability — silent loss of merged-PR registrations

Acceptance Criteria

• With an unreachable database, npm start exits non-zero and never binds the port
• /health returns 503 whenever migration state is unknown or incomplete

Definition of Done

• Reviewed by lead maintainer
• Pull request merged via verified status check

[EmmyKay0026]

Hello there
I’d like to work on this issue.

I have strong experience with Node.js backend services, database migration workflows, process lifecycle management, and reliability engineering to prevent silent data loss.

For this task, I will:

Refactor startServer and startEventWorker in index.js and src/workers/event-worker.js to throw or execute process.exit(1) on migration failure, preventing the service from binding the port when database state is incomplete.

Update the /health endpoint to return a 503 HTTP status whenever database migration state is incomplete or unknown.

Ensure proper error logging and graceful shutdown execution on fatal startup errors.

Verify local startup behavior, health check responses, and test suites, adhering to the requested branch naming (fix/issue--fail-startup-on-migration-failure).

I look forward to delivering a clean, well-tested PR. Let me know if I can get assigned!

[grantfox-oss]

🦊 GrantFox — @EmmyKay0026 has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #219)
2. Your PR will be reviewed by the Vero-protocol maintainers

Good luck! Track your progress on GrantFox.