Zdůvodnění
A Dockerfile, its ignore file and a provider's Procfile written by hand restate what the repository
already knows — the port the server binds, the routes it registers, the binary the
workspace names, the paths a build reads — and every one of those pairs drifts the first
time one half changes. The failure is silent and it is discovered in production: an image
that runs a binary under a name nobody builds any more, a health check pointed at a route
that was renamed, a machine sized for a memory figure a release outgrew.
Repozitář už takový tvar odmítá všude jinde. Schopnost se deklaruje jednou a promítá do CLI, HTTP, MCP, OpenAPI, dokumentace a webu a generate --check selže, když projekce zastará. Nasazení je fakt stejného druhu a přichází stejně, nebo nepřichází vůbec.
Druhý důvod jsou peníze a zveřejnění. Nasazení uvádí, kolik toho běží a jak dlouho, takže popis musí být tam, kde ho recenzent čte, ne v dashboardu providera, který nikdo nediffuje. A nikdy nesmí obsahovat pověření, které ho autorizuje: smlouva pro něj nemá žádné pole a token propašovaný do pole, které existuje, je zde odmítnut.
Požadované chování
A deployment is a *.yaml object under the layer's deployments section, valid against
share/schemas/majordomus/deployment/deployment.v1.schema.json (deployment/v1). It states the application, the
package and binary shipped, the port and the interface the process listens on, the
liveness and readiness routes, the resources, the machine count, the region and the build
inputs — each exactly once.
A deployment names no hosting provider unless it names one the contract knows (ADR 0219).
Today that is gigalixir; another name is refused like any other value outside the
contract. A named provider states its application, its stack and the URL the deployment
answers on, and that URL is https://. A hosted process binds every interface, so a
provider beside listen.interface: loopback is refused. The credential that authorises a
push to the provider is never a field: the contract has no key for one, and a token
smuggled into a field that does exist is refused below.
Klíče uzavírá share/allow/deployment.txt, generované ze schématu: neznámý klíč je chyba, nikdy se nepřenáší. Dva objekty si nesmějí nárokovat jednu identitu. min_running nesmí přesáhnout count. Trasa health je cesta, ne URL. Port je neprivilegovaný, protože nasazený proces neběží jako root.
Every artifact built from it — the container image definition, its ignore file and every
file the named provider reads, under deploy/<provider>/ (for Gigalixir the Procfile and
the inline buildpack's bin/detect, bin/compile and bin/release) — is
written by majordomus generate from this object, carries a provenance
header naming its source and its regeneration command, and is compared by
generate --check. A contributor who edits a generated artifact is told which file to
change instead.
Chování při selhání
Porušení je nález FAIL v kategorii deployment, jmenující objekt, klíč, nalezenou hodnotu a nápravu; příkaz, který ho našel, skončí s kódem 10 a pod watch je to drift a příkaz skončí s kódem 11.
Ověření
mj_validate_deployments decides it, dispatched from doctor, watch. The behavioural
case test/cases/84_deployment_contract.sh proves it by mutation: an unknown key, an
unknown provider name, a provider URL that is not https, a provider beside a loopback
interface, an unknown schema version, a missing required field, a privileged port, a
min_running above count, a health route that is not a path, a duplicate identity and
a credential in a field that exists — each refused by name; and a valid object, with and
without a known provider, accepted. test/cases/86_deployment_projections.sh holds the
generated files of the Majordomus repository's own object, the provider's among them, to their
header, their port and generate --check, and
test/cases/3820_a_deployment_renders_its_providers_files.sh renders a provider's files
from a fixture object.