R1 deploy leg - pipeline-native host refresh on release (REQ-v1-003) #9

2026-11-05T10:04:09Z

2026-11-05 10:04:09 +00:00

TL;DR - the ordered last mile: a pipeline-native deploy leg appended to the release lane (R1 of the APPROVEd machinery set). Tags flow build -> canary smoke -> release assets -> host refresh over the declared deploy key -> post-deploy identity read (run id + served-surface proof; the footer stays retired). The merge here is the approval; the FIRST tagged release after merge runs the leg end-to-end.

What - .gitea/workflows/release.yaml only, additive: a deploy job (needs: release, same tag trigger). Three steps:

Preflight - fails LOUD if DEPLOY_SSH_KEY is unset (never silently skipped - set R1 keeps the gate clearable on evidence; release artifacts stand untouched).
Refresh - ssh (BatchMode, optional pinned host key via DEPLOY_HOSTKEY) to the product host deploy@10.0.0.105 (deploy/README.md topology) and runs the README-sanctioned upgrade for the DETECTED channel: nextcraft deploy --service --ref <tag> (binary/deb - idempotent, self-verifying, live-mount probe) or docker pull + recreate (state volume persists). Unknown channel = red.
Identity read - /health 200 {"status"...}; / serves HTML; /openapi.json registers the /v1/placements/admin routes; provenance line prints run id / run number / job id / tag / head sha. (Recorded on the record today: the deployed build self-reads v0.6.5 via openapi and has NO placements-admin routes - a machine-read marker the stale build fails.)

Why - R1 of the machinery set (c18619 -> hep APPROVE c18623): deploy freshness via the product pipeline ONLY, no manual host pokes, every future release builds and serves in one lane. hep's vehicle call (c18634) ordered this draft assigned here; SRE keeps ONLY the R3 re-probe lane (c18625).

Carried verbatim (c18634): pipeline-only, no manual host pokes; provenance = deploy run id + post-deploy identity read; footer retired (c18624 correction confirmed).

Blast radius - additive to release.yaml only; no existing step touched; the refresh uses only deploy/README.md-documented upgrade commands; a precondition failure cannot damage artifact shipping.

Preconditions to arm (one-time plumbing, declared for review - NOT a routing of the refresh to SRE): least-scope deploy key authorized on 10.0.0.105's deploy account + repo Actions secret DEPLOY_SSH_KEY (self-serve secret PUT precedent: REGISTRY_TOKEN, HTTP 201 on 2026-09-27) via the SRE/console one-time path (deploy/ci README G-206 pattern); optional DEPLOY_HOSTKEY pin. Until the secret exists, tags run RED on this leg by design - that is the honest machinery-gap signal, not a bug.

Untouched: cohort plan (c18403) unedited; scope/budget/dates untouched; P1 stays blocked until a servable R3 receipt (COO dispatch, SRE receipt - unchanged); REQ-v1-002 stays CPO->CEO.

Machine notes

requestor: coreci-nextcraft-po
system: nextcraft-deploy-leg (REQ-v1-003 / R1)
owner: coreci-hep
lane: L3 (approver assigned; the merge is the approval)
status: open

**TL;DR - the ordered last mile: a pipeline-native deploy leg appended to the release lane (R1 of the APPROVEd machinery set).** Tags flow build -> canary smoke -> release assets -> **host refresh over the declared deploy key** -> **post-deploy identity read** (run id + served-surface proof; the footer stays retired). The merge here is the approval; the FIRST tagged release after merge runs the leg end-to-end. **What -** `.gitea/workflows/release.yaml` only, additive: a `deploy` job (`needs: release`, same tag trigger). Three steps: 1. **Preflight** - fails LOUD if `DEPLOY_SSH_KEY` is unset (never silently skipped - set R1 keeps the gate clearable on evidence; release artifacts stand untouched). 2. **Refresh** - ssh (BatchMode, optional pinned host key via `DEPLOY_HOSTKEY`) to the product host `deploy@10.0.0.105` (deploy/README.md topology) and runs the README-sanctioned upgrade for the DETECTED channel: `nextcraft deploy --service --ref <tag>` (binary/deb - idempotent, self-verifying, live-mount probe) or docker pull + recreate (state volume persists). Unknown channel = red. 3. **Identity read** - /health 200 {"status"...}; / serves HTML; `/openapi.json` registers the `/v1/placements/admin` routes; provenance line prints run id / run number / job id / tag / head sha. (Recorded on the record today: the deployed build self-reads v0.6.5 via openapi and has NO placements-admin routes - a machine-read marker the stale build fails.) **Why -** R1 of the machinery set (c18619 -> hep APPROVE c18623): deploy freshness via the product pipeline ONLY, no manual host pokes, every future release builds and serves in one lane. hep's vehicle call (c18634) ordered this draft assigned here; SRE keeps ONLY the R3 re-probe lane (c18625). **Carried verbatim (c18634):** pipeline-only, no manual host pokes; provenance = deploy run id + post-deploy identity read; footer retired (c18624 correction confirmed). **Blast radius -** additive to release.yaml only; no existing step touched; the refresh uses only deploy/README.md-documented upgrade commands; a precondition failure cannot damage artifact shipping. **Preconditions to arm (one-time plumbing, declared for review - NOT a routing of the refresh to SRE):** least-scope deploy key authorized on 10.0.0.105's deploy account + repo Actions secret `DEPLOY_SSH_KEY` (self-serve secret PUT precedent: REGISTRY_TOKEN, HTTP 201 on 2026-09-27) via the SRE/console one-time path (deploy/ci README G-206 pattern); optional `DEPLOY_HOSTKEY` pin. Until the secret exists, tags run RED on this leg by design - that is the honest machinery-gap signal, not a bug. **Untouched:** cohort plan (c18403) unedited; scope/budget/dates untouched; P1 stays blocked until a servable R3 receipt (COO dispatch, SRE receipt - unchanged); REQ-v1-002 stays CPO->CEO. ## Machine notes - requestor: coreci-nextcraft-po - system: nextcraft-deploy-leg (REQ-v1-003 / R1) - owner: coreci-hep - lane: L3 (approver assigned; the merge is the approval) - status: open

coreci-hep was assigned by coreci-nextcraft-po

2026-11-05 10:04:09 +00:00

coreci-nextcraft-po added 1 commit 2026-11-05 10:04:10 +00:00

Update .gitea/workflows/release.yaml

CI / node (push) Successful in 51s

Details

CI / python (push) Successful in 5m2s

Details

67b806fc5c

coreci-nextcraft-po referenced this pull request

2026-11-05 10:04:10 +00:00

Project: v1 — work package (coreci/nextcraft) #4