Skip to content
Cockpit0.29.0
A snapshot: read at commit 707a04c7ce8 on 2026-10-18T00:06:01Z by majordomus 0.29.0. Nothing on this page is read again. See it live

I0917

A bad deployment can be undone deterministically

Where it stands

devtask.issue
Readiness
cancelled withdrawn
Status
CANCELLED
Can start
not now
Milestone
fly-deployment
Milestone status
ACTIVE
Wave
5
Waiting on
I0914
Holds back
I0931
Behind it in all
3
Evidence
0 of 2
In the waySubjectDetail
issueI0914I0914 is not DONE

Moves

plan.transition
A move writes the repository: it stamps one field of this issue's record and appends one event to the ledger, and a commit will carry both.
The same moves from a terminal

majordomus plan start I0917

majordomus plan verify I0917

majordomus plan done I0917

What it is

Objective
Record the deployed image reference before changing production and provide a rollback that rests on what the provider actually supports, so that a failed smoke run has an exit.
Why
Autostop and a single machine mean a bad image is the only image. Knowing the previous reference before the change is what makes recovery a command instead of an investigation.
Now
Nothing is deployed and nothing records what was deployed before.
Wanted
The previous image reference is captured before every deploy, a failed smoke run reports both references safely, and one documented command returns production to the previous image.
Done when
Cancelled 2026-10-14 on master e28daccd9b: it rolls back the image reference deployed to a provider; the GHCR image is an immutable per-commit tag and nothing is deployed to roll back. The owner disconnected Fly.io on 2026-10-12; this repository deploys release binaries, the GHCR image and GitHub Pages (commit 9af3fa65a4 removed fly.toml).
Risk
An automatic rollback that has never run is a second failure mode during the first real incident. Either it is tested or it is a documented manual command.

Acceptance

  • The previously deployed image reference is captured before the deployment mutates anything
  • A failed post-deployment smoke run fails the deployment clearly and reports the new and previous references without exposing a credential
  • The rollback path rests on the provider's documented current behaviour, and is either executed automatically because it has been proved to work or offered as one deterministic command
  • The rollback is documented where an operator under pressure will find it
Validation
majordomus deploy doctorbash test/run.sh
Evidence required
previous_image_recordedrollback_path
Evidence present
unknown: the record carries no `evidence` entries

Scope

Touches
apps/majordomus-cli/src/deploy/rollback.rs
Not
Inventing a provider command that does not existAutomatic rollback that has never been executed successfully in a test
Depends on
I0914
Priority
p1
Profile
implementation
Parallel safe
true
Owner
unknown: the record declares no `owner`

The work so far

Branches
none
Merged
none
Commits
0
Trunk
master
Sessions
none
Created
2026-09-06
Updated
2026-10-14
Started
unknown: the record declares no `started_at`
Verified
unknown: the record declares no `verified_at`
Completed
unknown: the record declares no `completed_at`

Synchronisation

Adapter
scripts/github-sync
Repository
unknown: the derived plan's header carries no repository
External issue
unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
State there
unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it

Findings

Nothing is wrong with these records.