Deployment sets

A deployment set is a frozen release-to-target decision. It prevents a moving selector, mutable branch or changing target inventory from silently changing the rollout after approval.

Freeze the inputs

repository revision + image digest
             |
             v
target selector --resolve--> target selection snapshot
             |
             v
policy evidence + config digest -> deployment set digest
             |
             v
assign each target to exactly one wave

An immutable revision contains a Git revision, image digest, set digest and lock time. A target selection snapshot contains application, environment, selector, unique target IDs and capture time. Every assignment and wave must reference a selected target; duplicate targets are rejected by the contract.

Rollout strategies

Strategy	Operating behavior	Verification gate
DIRECT	Send the revision to the selected targets	Verify aggregate health after the set
CANARY	Release a first wave, inspect health, then continue	Minimum healthy percentage and explicit continuation
ROLLING	Replace targets in bounded waves	Each wave must verify before the next
BLUE_GREEN	Prepare the alternate group, verify, then switch	Switch only after the alternate is healthy

Each wave records a strategy, target IDs and minimumHealthyPercent. Assignments move through WAITING, READY, ROLLING, VERIFIED, FAILED or BLOCKED. The set moves through READY, ROLLING_OUT, PAUSED, SUCCEEDED, FAILED or CANCELLED.

Safety properties

Policy evidence is attached to the set as PASSED, FAILED, PENDING or WAIVED evidence with evaluation time and details. Aggregate health must reconcile exactly: healthy + unhealthy + pending equals total, and total equals the frozen target snapshot. A target cannot appear in multiple waves.

The deployment-set contract is implemented in @devopsify/contracts; a dedicated public deployment-set API and worker rollout orchestration are not yet exposed in the current app routes. Current API deployment creation is a simpler pipeline-run deployment path. Do not treat a DIRECT deployment record from that route as a fully managed deployment set.