31 lines
1.1 KiB
Markdown
31 lines
1.1 KiB
Markdown
# ADR 0002: Remote publication remains unimplemented and fail-closed
|
|
|
|
- Status: Accepted
|
|
- Date: 2026-07-25
|
|
|
|
## Context
|
|
|
|
The control-plane UI models SSH/rsync targets, but there is no production-ready
|
|
remote deployment implementation. Returning simulated connectivity or success
|
|
would allow operators and reviewers to mistake a UI model for a verified
|
|
publication path.
|
|
|
|
## Decision
|
|
|
|
Remote publication and remote connectivity tests return an explicit
|
|
`E_REMOTE_PUBLICATION_NOT_IMPLEMENTED`/HTTP 501 response. The store contains a
|
|
compile-time false capability constant and checks it before reading target or
|
|
build configuration. No configuration field, credential, target state, or
|
|
environment variable can enable shell execution or rsync.
|
|
|
|
Local staging and activation continue to operate only on checksum-verified,
|
|
immutable release directories.
|
|
|
|
## Consequences
|
|
|
|
- The control plane cannot deploy a release to a remote host.
|
|
- Target records remain descriptive UI state only.
|
|
- Implementing SSH/rsync requires a new ADR, an explicit capability boundary,
|
|
host-key verification, credential isolation, atomic remote promotion, and
|
|
end-to-end tests.
|