I0929 — Production deploys from CI with a token scoped to one application

BLOCKED wave 8 · p1 · implementation profile · parallel safe

Part of fly-deployment — A deployment is a projection of the repository model, and a reachable URL is its evidence.

Objective

Deploy production from CI on the repository's existing branch policy, using an application-scoped deploy token rather than an account-wide one, with concurrency that stops two pushes racing the same application.

Why

An account-wide token in a CI secret is a key to everything the account owns, held by every workflow that can read the secret. A scoped token limits an incident to one application, and concurrency control keeps two deploys from interleaving on one machine.

Current state

No deployment workflow exists and no token has been created.

Desired state

The production workflow deploys through the same core the CLI uses, holds only a scoped token, serialises deployments, and its token is installed without ever appearing in a log or a file.

Scope

• .github/workflows

Out of scope

• An account-wide token in CI
• A CI-only container build implementation separate from the canonical one
• Weakening the token model because a tool was unavailable

Dependencies

• I0918BLOCKED The bootstrap credential is used once and belongs to nothing
• I0931BLOCKED The application exists, one machine runs it, and the URL answers

What waits on this

• I0932BLOCKED The milestone is accepted on its evidence

Acceptance criteria

• The deployment token is scoped to the application, has a deliberate expiry and a descriptive name
• The token is installed as a repository secret without being echoed, printed or written to any file, or the exact one-time command is provided instead when that cannot be done safely
• The workflow deploys through the same deployment core the CLI uses, with no second build implementation
• Concurrency is configured deliberately so two pushes cannot deploy the same application at once, and the choice about cancellation is stated
• External actions are pinned and the provider tool version is deliberate rather than floating

Validation

• bash test/run.sh

Evidence required

• deploy_workflow
• scoped_token
• concurrency

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Risk

Cancelling an in-progress deployment can leave a machine half-updated. Whether cancellation is safe is a decision to make explicitly, not a default to inherit.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I0929.yaml. Read it back with majordomus plan show I0929.