amadan

carlos / platform Public

← Branches

zdd-6-surfaces

Zero-downtime deploys, plan 6: the member surfaces. Dormant: CARLOS_SWAP stays off. Built from plan 6 on design-zero-downtime-deploys against spec rev 17. origin/main was merged at 5157c1e7.

What it adds:

  • the app swap policy: a console card, a person-only PUT .../swap door, and carlos apps set
  • carlos ship/deploy --swap hold, with a 409 on a changed re-ship and an echo check
  • carlos instances retry: an operate door, a retry kind on the restart-scope log, and the agent handing it to RetryHost
  • carlos instances list gains INSTALLED, SERVING and REASON
  • the console instance page gains a failure hold and Retry
  • the deploy watch follows each box's rollout of the watched build, and runs today's watch when no box reports a rollout
  • carlos sidecars ls reads ServingVersion
  • event and refusal wording goes through internal/rolloutwords
  • docs, and roll notes in docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md

Copy is APPROVED by Paul (2026-10-11). It covers 149 strings, two of them edited by Paul. The strings are applied and pinned by the record docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-copy.json and approvedcopyzdd_test.go. No TODO-COPY markers remain.

Astra's final review is ACCEPT WITH FIXES for a dormant merge, after two fix waves (CODEX-FINDINGS-ZDD-IMPL-6*.md).

Q4, Paul's ruling (2026-10-11): host retries stay on the unsigned restart-scope log for now, with the same trust as carlos restart. Console signing of retries, as promote --retry has, is owed before the flag goes on anywhere hold mode is used (#272).

Also owed before the flag goes on: skipped record reads can drop a fleet from the deploy watch's completeness check (Astra R3). It is listed in the roll notes.

Merging waits for Paul.

Commits 42
Discussions 0 0 open
Tasks 0/0 done

Discussions

  • No discussions on this branch yet.

All discussions →

Tasks

  • No tasks yet.

All tasks →

Activity