CTC Deployment, DB Migration And Wiki Continuity¶

Status: CANONICAL CURRENT AGENT INSTRUCTION
Durable source: Current Context §19
Decision history: Context History
Task overlay: DEPLOYMENT_DB_WIKI_REQUIREMENTS.md
Release runbook: RELEASE_GATE_RUNBOOK.md
Wiki policy: WIKI_DB_SYNC_POLICY.md
Owns: pre-deployment DB compatibility Gate, required user confirmation, same-delivery Wiki synchronization and the no-routine-restart rule
Does not own: current DB facts, exact migration code, Wiki semantics, Product scope, restriction policy or infrastructure repair

1. Immutable Defaults¶

Production outage from deployment = NOT ACCEPTABLE
QA_COMMIT_PUSH + MASTER_MERGE = ONE GIT DEPLOYMENT SET
required migration not verified applied = USER CONFIRMATION REQUIRED
impacted existing Wiki slug = UPDATE IN SAME DELIVERY BY DEFAULT
bounded new stable Wiki slug = CREATE IN SAME DELIVERY BY DEFAULT
Wiki target = deployed Production T_WIKI_PAGE, never local development DB
master auto-pull interval = 2 minutes
routine service restart = NOT REQUIRED / DO NOT PERFORM

Read this rule before any source/document package that may be committed and merged to master.

2. Deployment Preflight¶

Before starting QA_COMMIT_PUSH, record:

candidate scope and current qa/master heads
changed files and DB-consuming paths
DB dependency state
migration files/objects/required data
Production DB evidence
user-confirmation state
Wiki impact and exact slugs
non-Git effects
rollback

DB dependency state is one of:

NOT_REQUIRED
APPLIED_AND_VERIFIED
REQUIRED_NOT_APPLIED
REQUIRED_STATUS_UNKNOWN
BACKWARD_COMPATIBLE_STAGED

Production DB state discovery¶

When the user requests Production DB or runtime verification, local .env state is not sufficient evidence. Use the canonical ssh ctc path and the approved runtime credential source on that host for read-only inspection. Before any query, verify the resolved target is the expected Production DB and suppress all credential values. For scheduled DB objects, read back the required table/event, event_scheduler, privilege presence and event definer. Also verify required runtime key presence, such as CTC_SESSION_SECRET, without exposing values; a missing required key blocks deployment. If the canonical path fails, report the exact SSH/authentication/DB error; do not collapse it into UNKNOWN without the failure evidence. This discovery rule authorizes inspection only, never Production writes.

Do not classify NOT_REQUIRED only because no migration file changed. Inspect whether source now assumes a table, column, row, view, procedure, status or configuration state.

3. DB Migration Confirmation Gate¶

When state is REQUIRED_NOT_APPLIED or REQUIRED_STATUS_UNKNOWN, stop before QA_COMMIT_PUSH and return:

DB_MIGRATION_CONFIRMATION_REQUIRED

The confirmation request states:

candidate SHA or prepared scope
target environment
migration IDs/files/objects
current evidence state
known failure/outage mode
old-schema compatibility
safe options and rollback

Accepted directions:

migration already applied
apply migration before master merge
use/revise a proven backward-compatible staged candidate
postpone/cancel

A known schema-incompatible candidate is never merged to master while its required migration is absent.

If the user authorizes application:

QA_COMMIT_PUSH
-> exact migration application
-> authoritative DB readback
-> MASTER_MERGE
-> parity

DB application remains an exact named-environment write. Confirmation does not authorize unrelated schema/data work.

4. Wiki DB Default¶

Classify:

NOT_APPLICABLE
UPDATE_EXISTING_REQUIRED
CREATE_NEW_REQUIRED
CREATE_OR_RETIRE_DECISION_REQUIRED
SYNC_BLOCKED
COMPLETE

Existing mapped Production T_WIKI_PAGE content is updated, or one bounded new stable Production row is created when the slug is absent, without a second confirmation when the release changes user-facing operation and all standing-authorization conditions in WIKI_DB_SYNC_POLICY.md are met. A local DB write never completes Wiki synchronization.

The exact Task/handover must name the slug and content boundary before the write and capture absence when creating.

Rename, retirement, deletion, role/visibility change or bulk publication requires an explicit user decision.

Normal order:

MASTER_MERGE / parity
-> existing-slug Wiki update or bounded new-slug create
-> DB readback
-> rendered readback when available

Unknown-result rule:

stop replay
-> reread exact slug/row/hash
-> classify applied/missing/partial/unknown
-> resume only missing owner step

An urgent operational fix may proceed when Wiki is unavailable, but final status is DEPLOYED / WIKI_SYNC_BLOCKED, not fully complete.

5. Auto-Pull And Restart¶

The CTC server automatically pulls master every two minutes.

service restart = NOT_APPLICABLE
manual pull = NOT PERFORMED

Do not:

restart PHP/Web/worker services as routine deployment behavior;
make restart a Task acceptance Gate;
report restart absence as deployment risk;
manually pull or edit the server unless the user authorizes infrastructure recovery.

When Runtime verification is in scope, use one normal auto-pull cycle or exact deployed-source readback. Git deployment remains complete at verified qa/master parity even when Runtime verification is NOT_RUN.

6. Git Deployment Set¶

preflight and DB Gate resolved
-> one final qa commit/push
-> read back qa
-> apply/read back exact authorized DB migration when selected
-> merge exact qa candidate to current master
-> read back master
-> synchronize qa if merge commit created
-> verify qa HEAD == master HEAD
-> perform required existing-slug sync or bounded new-slug creation

A rollback uses the same Git set. Do not force refs backward as routine recovery.

7. Work Graph Contract¶

Required nodes when applicable:

DB_DEPENDENCY_DISCOVERY
PRODUCTION_DB_STATE_DISCOVERY
DB_CONFIRMATION_GATE
QA_COMMIT_PUSH
DB_MIGRATION_EFFECT_AND_READBACK
MASTER_MERGE
PARITY_READBACK
WIKI_SYNC_EFFECT
WIKI_READBACK
AUTO_PULL_RUNTIME_OBSERVATION

Required claims:

deployment.db_dependency.classified
deployment.db_migration.confirmed_when_required
deployment.no_known_schema_incompatible_master_merge
deployment.qa_master.complete
deployment.wiki_sync.complete_or_not_applicable
deployment.service_restart.not_required

DB_CONFIRMATION_GATE is a real dependency, not a report-only note.

8. Stop Conditions¶

Stop the affected deployment when:

candidate DB dependency is unclassified;
a required migration is not applied and confirmation is absent;
target DB state is unknown and the user has not decided the path;
candidate is known incompatible with the current schema;
migration rollback/readback is absent;
qa or master moved and final dependency analysis is stale;
required existing/new-slug Wiki content is unsafe, unmapped or authority-conflicted;
a retired/renamed/deleted/visibility-changing Wiki operation lacks explicit approval;
someone proposes a routine service restart or direct server edit as part of normal deployment.

Do not block independent safe analysis or a bounded urgent fix solely because a non-critical Wiki write is temporarily unavailable.

9. Completion Report¶

pre-deployment qa/master
qa commit SHA
master merge SHA/method
final parity
DB dependency state
migration confirmation/effect/readback
Wiki impact/slugs/write/readback
master auto-pull: 2 minutes
service restart: NOT_APPLICABLE / NOT PERFORMED
Runtime verification state
rollback/residue

---¶

Source: .agents/rules/DEPLOYMENT_DB_WIKI_CONTINUITY.md — ctc repository · This page is an English translation of the source document. Identifiers, file paths and code symbols are unchanged.