Add apply preflight gate

This commit is contained in:
jwinterm
2026-07-06 12:29:08 -04:00
parent a921f158c3
commit fbfddbf2bf
9 changed files with 272 additions and 30 deletions
+4 -3
View File
@@ -40,6 +40,7 @@ Current managed defaults:
AMPG must never delete sensitive contract paths without an explicit destructive command.
`apply --dry-run --write-artifacts` prints `AMPG_APPLY_STATE_COPY` rows that show which
reviewed artifacts would be copied into managed state and `AMPG_APPLY_SUPERVISOR` rows
for the services that would be registered or started. Live apply should perform those
reviewed copies, start daemons, capture public addresses, and then run published health
checks.
for the services that would be registered or started. The accompanying
`AMPG_APPLY_PREFLIGHT` verdict includes those rows so live apply can refuse mutation when
state or supervisor inputs still need review. Live apply should perform reviewed copies,
start daemons, capture public addresses, and then run published health checks.