AkurAI-Build

public
Latest change db3fe9caf9ed5f9da4cf8a8543f0a65b73921a53 - plan: enforce suite deployment through AkurAI Build by Ólafur Búi Ólafsson
# Task: Enforce Suite Deployment Contract

- **Epic:** [suite-deployment-governance](../.plan/epics/suite-deployment-governance.md)
- **Status:** backlog
- **Updated:** 2026-09-02

## What
Make AkurAI Build enforce one production delivery contract for every active app in `AkurAI-Framework/AKURAI_APPS.toml`, then prove all 13 registered apps conform.

## Notes
- Audit baseline: 13 apps; 12 have `.akurai.yml`; AkurAI-VPNSite has none.
- AkurAI-MailAPI lacks a distinct immutable `package` job.
- AkurAI-Monitor production job does not declare exact `environment: production`.
- All 13 catalog `deploy` fields still name direct `akurai-ec2 release` commands instead of Build promotion/run evidence.
- Do not create a second deploy engine. Extend AkurAI Build pipeline validation and each repository-owned `.akurai.yml`.

## Steps
- [ ] Define machine-readable suite policy in AkurAI Build: canonical hosted Git, immutable commit, `verify` then `package` then production deploy, same-artifact deployment, production environment policy, host-agent checksum/health/rollback, migration recovery metadata, secret redaction, persisted `succeeded`, and app-specific post-deploy verification.
- [ ] Add fleet audit command/API using `AKURAI_APPS.toml`; report every app and exact violation.
- [ ] Reject non-conforming production pipelines before queue/promotion while preserving non-production CI use.
- [ ] Add `.akurai.yml` to AkurAI-VPNSite.
- [ ] Add immutable package stage to AkurAI-MailAPI.
- [ ] Normalize AkurAI-Monitor production environment declaration.
- [ ] Replace stale direct-deploy catalog commands with AkurAI Build run/promotion contract.
- [ ] Add focused parser/policy tests plus fixtures for conforming and each failing shape.
- [ ] Run repository checks and validate every app pipeline at exact hosted commit.
- [ ] Publish through AkurAI Build, obtain persisted successful run, deploy Build safely, and verify public health plus fleet audit showing 13/13 conformant.

## Deployment contract
All production delivery must pass through AkurAI Build:

- [ ] Canonical source is AkurAI Build hosted Git; local and hosted branch SHAs match.
- [ ] `.akurai.yml` has ordered `verify`, immutable `package`, and production deployment jobs.
- [ ] Production consumes package output from same exact commit; no rebuild or ad hoc file copy.
- [ ] Production job declares `environment: production` and required approval policy.
- [ ] Deployment goes through root-owned host agent with checksum verification, bounded restart, public health gate, and automatic binary rollback.
- [ ] Database change is reversible/additive and has verified backup/recovery path before activation.
- [ ] Secrets enter through protected Build/environment contracts and never logs, source, artifacts, or arguments.
- [ ] Persisted AkurAI Build run reaches `succeeded`; queued, running, waiting, verify-only, and package-only states are incomplete.
- [ ] Post-deploy public health and app-specific behavior are verified against exact deployed commit.