Silent Release Controller Production Contract

Status: review-only implementation. Production execution remains disabled.

Trust boundary

The caller submits only release intent. A configured trusted builder owns ref validation, build, tests, artifact and manifest hashing, package closure, canary, rollback readiness, Git/Gitea consistency, and secret scanning. Caller supplied success evidence is rejected.

The resulting immutable ReleasePlan contains deployment, tag, and finalization plans. One Ed25519 owner signature binds its SHA-256 digest, candidate evidence, policy digest, owner identity, trust domain, validity window, evidence lineage, and three narrow capabilities.

Durable execution

The Saga journal is the source of truth. Every record is sequence-numbered and SHA-256 hash-chained from a fixed genesis hash. Snapshots are rebuildable caches. Journal corruption, truncation, reordering, missing records, or hash mismatch moves the release to MANUAL_OWNER_REVIEW_REQUIRED.

Capability execution uses an exclusive, leased claim. A second worker receives BUSY; an expired claim is not reassigned until a capability-specific side-effect probe reports that the operation was not applied. Runtime, tag, and finalization remain separately claimed and recoverable.

Execution order

APPROVED
  -> PRE_SWITCH_REVALIDATING
  -> SWITCH_PENDING
  -> SWITCHED
  -> RUNTIME_VERIFYING
  -> RUNTIME_VERIFIED
  -> TAG_PENDING
  -> TAG_VERIFIED
  -> BASELINE_REGISTRY_PENDING
  -> COMPLETED

The actual adapter configuration is regenerated before execution and must match the signed plan. Trusted allowlists come from controlled policy, not the request.

A failure before verified tag publication rolls the runtime back. A failure after the exact tag is verified enters RECONCILIATION_REQUIRED; the tag is never deleted or rewritten. A same-name/different-OID conflict enters MANUAL_OWNER_REVIEW_REQUIRED. Registry/Baseline finalization requires exact remote and Gitea tag proof, and Baseline is recorded last.

Action and recovery contract

submitOwnerApproval verifies and durably stores the signed plan, then moves the Saga to APPROVED. startDeployment loads that durable approval and ignores caller-supplied approval content. Enabling execution without the trusted builder, verifier, validator, policy, and orchestrator fails during service construction.

The recovery worker scans incomplete journals and resumes through the same claims and verification gates. It never automatically resumes a manual-review Saga. In shadow mode it only reports state and performs no adapter side effects.

The deployed Action factory does not enable the legacy caller-evidence path. If the trusted builder is absent, candidate creation is rejected even while execution remains in shadow mode. The compatibility path exists only through the explicit test-only SilentReleaseActionService.shadow() constructor.

Finalization is composed from separate RegistryController and BaselineController claims. Registry is verified first and Baseline is the last mutation; a retry reuses completed Registry evidence and never moves Baseline ahead of tag verification.

Governance

force_push: forbidden
tag_rewrite: forbidden
direct_main_push: forbidden
production execution default: disabled
production tag operations in this change: not executed
Baseline/Registry mutations in this change: not executed

3.4 KiB Raw Blame History