Runtime and delivery
Deployments and approvals
The immutable deployment chain, approval invalidation, readiness checks, and code rollback.
v1 design baseline. This page specifies intended behavior. Delivery and validation are tracked in the implementation plan; it is not a claim that the platform is already implemented.
Immutable chain
source revision
→ build
→ signed artifact
→ deployment
→ environment activation
Each production deployment records:
organization
application
environment
source revision
artifact digest
builder image
runtime contract
migration set
snapshot
policy version
capability set
requester
approver(s)
agent/client if applicable
activation time
health result
Never deploy a branch name as a moving target.
Deployment states
Draft
Awaiting Build
Building
Build Failed
Awaiting Approval
Approved
Migrating
Activating
Healthy
Failed
Rolled Back
Cancelled
State transitions are validated centrally and idempotent.
Approvals
An approval includes:
approver
role
scope
artifact digest
source revision
policy version
capability changes
migration classification
timestamp
decision
comment
Changing the source, artifact, migration set, capability set, or material policy after approval invalidates that approval.
Health checks
A production revision must pass:
- Sandbox startup
- Artifact-signature validation
- Binding initialization
- Internal readiness endpoint
- Optional app-defined health handler
- Basic request smoke test
Only then does the route switch.
Rollback
Artifact rollback:
- Select prior healthy deployment.
- Confirm database compatibility.
- Start or re-enable prior workload.
- Health-check.
- Switch route.
- Drain current revision.
- Audit.
If schema compatibility is uncertain, flag the rollback for manual review rather than pretending code and data are independent.