{
  "uid": "cogitave.learn.ci-cd-pipelines.deploy-and-deliver",
  "kind": "moduleUnit",
  "href": "/modules/ci-cd-pipelines/deploy-and-deliver/",
  "title": "Deploy and deliver",
  "summary": "",
  "type": null,
  "products": [],
  "roles": [],
  "levels": [],
  "subjects": [],
  "headings": [
    "One artifact, promoted forward",
    "GitOps: pull-based, not pushed",
    "Progressive delivery and rollback",
    "The prod gate is a human, and it fails closed"
  ],
  "source": "A green pipeline produces a **signed artifact**. The\n[deployment-and-delivery standard](../../../../standards/docs/standards/deployment-and-delivery.md)\ngoverns the **outer loop** - how that artifact becomes a running workload. This\nis where a deploy becomes auditable change evidence.\n\n## One artifact, promoted forward\n\nCogitave runs a **linear promotion pipeline** plus ephemeral preview\nenvironments per pull request. The path is `dev` to `staging` to `prod`:\n\n- **preview** - ephemeral, per-PR, auto spun-up and auto torn-down on PR close;\n  data-isolated (never prod data).\n- **dev** - promotes from `main` on merge, automatically.\n- **staging** - persistent and prod-like; the release candidate lands here,\n  gated on smoke and integration green.\n- **prod** - promotes from `staging` by **manual** promote, behind a human\n  approval gate.\n\nTwo rules make this trustworthy. Promotion is **forward-only and monotone**: an\nartifact reaches `prod` only after it was observed healthy in `staging`. And you\npromote the **same signed digest** across every environment - never rebuild per\nenvironment, because a rebuilt binary is a different, unverified artifact. Only\nconfig and feature flags differ between environments; the artifact is identical.\n\n## GitOps: pull-based, not pushed\n\nThe default delivery mechanism is **GitOps**. Git is the single source of\ndesired state, and an in-cluster reconciler (the Argo CD or Flux class) **pulls**\nthat state and converges the cluster to it. CI does **not** run `kubectl apply`\nor push to a cluster. Promotion is a commit to the environment overlay, pinned by\nimmutable digest, and the reconciler applies it. This means **no long-lived\ncluster credentials live in CI** - the promotion job mints a short-lived, scoped\ntoken to commit desired state; the cluster credential lives only with the\nreconciler.\n\n## Progressive delivery and rollback\n\nThe standard's recommended progressive rollout is **canary**: the progressive-delivery controller shifts\ntraffic in graduated steps (for example 5%, 25%, 50%, 100%) and **promotes or\naborts on SLO metrics** - error rate and p99 latency against the service's SLO -\nnot on a human eyeballing a dashboard. A window that breaches the threshold\ntriggers an **automatic rollback**; the controller owns the abort path, and it\nkeeps working even if CI is offline. Every deployment must be reversible, and\nevery service must ship a **rollback runbook** - a service without one is not\nproduction-ready.\n\n> [!IMPORTANT]\n> **Deploy is not release.** New behavior ships **dark** behind a feature flag\n> and is released by flipping the flag, not by redeploying. A kill-switch flag\n> needs no deployment, so canary (infrastructure) and flags (application) can\n> each roll back independently.\n\n## The prod gate is a human, and it fails closed\n\nTwo gates stand before production. First, the deploy **verifies the signature and\nprovenance** of the artifact; an unsigned or unverifiable digest **fails closed**\nand cannot be promoted. Second, `prod` is a protected environment: at least one\nrequired reviewer, a wait timer, prevent-self-review, and **admin bypass\ndisabled**. The identity that authored or merged a change must not be the sole\nidentity that approves its prod deploy - separation of duties. As ADR 0017 and\nthe AGENTS floor state, **an agent never self-approves promotion to prod**; agents\nand CI propose, a human enacts. Every deployment is recorded as immutable change\nevidence bound to the digest, the approver, the environment, and the outcome.\n",
  "partOf": "cogitave.learn.ci-cd-pipelines",
  "durationInMinutes": 7,
  "quiz": null
}