Skip to content

Reddit Explorer scoped deployment — 2026-10-25

The owner approved stopping unrelated deployments from rebuilding Reddit Explorer after observing live placement work. This milestone records the scoped deployment contract, implemented in source, not deployed or live-accepted. Paused placement work is left untouched; no cache data, job identifiers, or private observations are published here.

What changes

General deploy-infra keeps one ordinary conditional batch first, then pulls the Reddit source and conditionally deploys that single stack. The source on_pull repairs ownership and refreshes a private fingerprint even on a Git no-op (upstream v2 behavior confirmed). Application PR #100 (2c49ce6f) changes its release webhook default to the existing deploy-reddit-explorer Procedure; that dedicated pull-then-unconditional-deploy path remains the force retry. The application's compile, bundle, and PostgreSQL CI job passed at that commit; that is not rollout evidence or an all-checks pass.

flowchart TD
    A[General homelab deployment] --> B[Pull homelab repos]
    B --> C[Ordinary BatchDeployStackIfChanged]
    C --> D[Pull Reddit source]
    D --> E[Ownership repair and fingerprint refresh]
    E --> F[Single Reddit DeployStackIfChanged]
    F --> G[Existing later application stages]
    H[Application release or manual force retry] --> I[Dedicated Reddit PullRepo]
    I --> J[Ownership repair and fingerprint refresh]
    J --> K[Unconditional Reddit DeployStack]

The fingerprint covers application Git HEAD, this service's Compose and runtime script names/bytes, HMAC-protected rendered environment bytes, and only the canonical Reddit Stack/source-Repo configuration. Unrelated homelab commits, docs, tests, and resource blocks are excluded. A host-private ignored key prevents exposing raw secret bytes through auxiliary config tracking; no SOPS decryption, Core environment tracking, or NAS/database/network probe is added. Predeploy revalidation fails closed on mismatch; concurrent workflows or checkout changes during builds are not fully serialized.

General workflow filters add every *.md path, reviews, and tests to the existing push exclusions; mixed runtime commits still deploy. Policy validation requires the disjoint union of batch-conditional, individual-conditional, and unconditional targets to equal the auto-deploy stacks. Komodo remains self-managed.

Local verification

The integrated source passed 72 offline documentation/Komodo policy contract tests, documentation autofix/check (215 pages; autofix changed no files), explicit lint of both service READMEs, source coverage, strict MkDocs build, and built-site checks. Exact commands/results belong in the parent PR handoff. This validates local source and documentation, not installed Komodo behavior, merged-revision CI, or live publication/deployment.

Acceptance remains open

The fingerprint is desired state, not a success receipt. Successful compose up can advance the baseline before a failing smoke hook; use the unconditional Reddit Procedure after fixing the failure. First adoption or an intentional private-key rotation can legitimately deploy once.

  • [ ] Parent integrator / validator — before merge: attach exact final-revision validation and CI results to the PR, including helper input/exclusion and fail-closed fixtures alongside the documentation/policy checks above. Rerun affected checks after any further edits; local results do not establish CI.
  • [ ] Deployment operator — before merge/rollout: drain pending ResourceSync, Procedure, and old queued workflow work; confirm no old general deployment can interrupt placement. New filters do not cancel existing runs.
  • [ ] Komodo / host owner — before rollout: verify actual Core and Periphery versions and config_files behavior, Python 3.11+ or the existing local host fallback, private state permissions, and safe key backup/rotation. Upstream support since 1.19.1 and confirmation in 2.0 / 2.3.4 are not live acceptance.
  • [ ] Release owner — before application release: verify application PR #100 is merged and any webhook override targets the existing dedicated Reddit Procedure.
  • [ ] Deployment operator — after approved rollout: record terminal Update success, health, and an unchanged-input skip; keep paused placement untouched and use isolated fixtures for intentional input/failure tests.

See the rollout runbook and service input/key contract.