For AI agents: the complete documentation index is available at /llms.txt, the full documentation bundle is available at /llms-full.txt, and this page is available as Markdown at /reference/docs/decisions/0056-verified-platform-releases.md.

0056 — Verified platform releases from one deployment catalogue

Status: Proposed. Date: 22 October 2026.

Decision

Personal development retains its commands, private state, local source delivery and in-cluster builds. Official releases use the same image catalogue, build inputs, fingerprints and service manifests. Environment values select exposure, identity and installation policy; they do not define another set of Dockerfiles. CI derives its complete image matrix from gitops/manifests/images.yaml.

A protected platform-vMAJOR.MINOR.PATCH tag selects an exact main commit. Its successful main-push CI must be recorded before publication. CI builds all catalogued images, produces SBOM/provenance, signs their digests and verifies them before publishing one signed OCI package. That package retains the GitOps sources, image fingerprints, contract/migration fingerprint and service Application compositions. Private inventory and credentials never enter it.

Promotion verifies the package and image signatures and selects the entire package through a dedicated deploy/<ENV> Git branch. Each child Application keeps its owner, destination and sync policy, selecting its own manifest path at the same OCI digest. Production Argo follows that branch. CI has registry and selection-branch authority, with no Kubernetes administrator credential. Health comes from the dedicated Argo notification GitHub App, tied to the selected package and unique deployment attempt for every child.

Selection uses a non-forced Git update; concurrent writers fail closed. Unknown files and implicit removal of Applications block ordinary promotion. Rollback selects an existing signed package without rebuilding; automatic rollback is limited to unchanged contract/migration fingerprints. Data recovery and a qualified incompatible-schema transition remain separate operations.

Reuse and activation

The package and selection mechanisms adapt architecture-reset at 77c61208f, particularly devops/release/dev_vm_package.py, dev_vm_select.py and its release workflow. Their old image lists, monolith contracts and target names are replaced by the current catalogue and service Application boundaries. The existing optional development-image workflow remains available.

Production selection is disabled in its committed environment policy. Enabling it requires the complete external-identity/service composition deferred by 0051, reviewed Argo repository/project ownership, OCI credentials, notification App and live qualification. The foundation milestone does not gain application activation through a release tag. See the release guide.

Page source

Source snapshot · Revision f928834c8.