Skip to content

feat(workflow): add deterministic builds and signed transactional deployments - #20

Open
josh-tracey wants to merge 6 commits into
mainfrom
experiment/runkernel
Open

feat(workflow): add deterministic builds and signed transactional deployments#20
josh-tracey wants to merge 6 commits into
mainfrom
experiment/runkernel

Conversation

@josh-tracey

@josh-tracey josh-tracey commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

Summary

Completes Sailr's Runkernel-backed workflow delivery path.

Adds:

  • deterministic phase-level build graphs
  • enforced build concurrency
  • cache input exclusions and force-cache bypass
  • post-settlement service finalizers
  • immutable Kubernetes deployment bundles
  • trusted Ed25519 approval
  • environment deployment approval policy
  • successful-mutation rollback journals
  • deployment audit evidence in workflow reports
  • Kind-based signed deployment and rollback validation

Architecture

Sailr owns application delivery and Kubernetes semantics.
Runkernel remains the generic local DAG executor.

The transactional deployment guarantees in this PR apply to
sailr workflow run. Legacy sailr deploy and sailr go retain
their existing deployment path.

Non-goals

  • GitOps reconciliation
  • Argo CD or Flux
  • artifact promotion
  • scheduled CI configuration
  • distributed Runkernel execution

@vercel

vercel Bot commented Jul 27, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
sailr Error Error Jul 28, 2026 8:27am

@josh-tracey josh-tracey changed the title Experiment/runkernel feat(workflow): add deterministic builds and signed transactional deployments Jul 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant