The one path that touches a customer's server, and the one the platform cannot
undo. It is human-triggered, confirmed and audited; there is deliberately no
code path from a pipeline run into it (D13).
- deploy_ssh.py: SshDeployer. Release lands in releases/<ts>-<sha7>/, the
post-deploy command runs with cwd there, and only then does `current` move —
atomically (relative symlink + mv -T). A failed hook or extraction never moves
it, so the previous release keeps serving. Host key is pinned on first success
(TOFU); a mismatch is a hard failure. Prunes to the newest five.
- deploy_ftp.py: FtpDeployer. FTP has no atomic switch and no rollback except a
backup, so a backup is mandatory: every file about to be overwritten is
archived under ARTIFACTS_ROOT before anything is uploaded. The artifact is
extracted, then the build dir (dist/build/public/out) is chosen — a static
deploy must not publish the repository. Archive members are sanitised: absolute
paths, `..` and escaping links are refused.
- deploy_target.py: the tester that dispatches on `kind`.
- deploy_service.py + production_deploys (migration a3b4c5d6e7f4) + 4 routes.
One deploy per project at a time; the org slug must be typed back; the target
summary reports has_secret, never the secret.
Tests: 499 API (+26) with fake SSH/FTP transports; ruff, mypy, alembic clean.
Report: docs/plan/reports/agent-3-phase-5.md
A push to `dev` now becomes a live demo, and a failed build never takes the
demo down.
- Four tables (pipeline_runs, pipeline_steps, releases, app_runtimes) and their
migration; alembic upgrade/downgrade/check all clean.
- DeliveryService implements DeliveryHooks: on_app_created provisions the demo
port + host + first build (idempotently); on_branch_pushed queues a run for
`dev` and supersedes older *queued* runs, leaving a running one alone.
- The 8-step pipeline. Blue/green is real: the replacement starts on a staging
port, is healthchecked, and only then does the route move — then the previous
container is stopped. A failure removes the replacement, releases its port and
leaves the old container serving.
- The demo port ledger is the DATABASE, not the router adapters' in-memory maps:
the API and the delivery worker are separate processes.
- Runs are claimed with a conditional UPDATE, so two workers never build the
same run.
- Live logs are batched (1 event / 500 ms, 200 lines) and redacted as a whole
tail — per-chunk redaction misses a secret split across pipe reads, and the
*stored* tail leaked until this was fixed.
- delivery worker: drain the queue, then poll remotes for pushes made outside
the engine.
- 7 routes; reads need membership, actions need projects.manage and are audited.
Tests: 415 API (+21, 1 docker-marked skipped); ruff, mypy, alembic check clean.
Report: docs/plan/reports/agent-3-phase-3.md
mjalmoudy94