Next-Generation Deployment Platform

ChangedBundle builders (both ZIP and SquashFS) now skip dev secret files and plaintext setup answers instead of packing them in.

WhyBundles get uploaded and shared. A secret baked into an artifact is a credential leak — close it before any large refactor begins.

ChangedAdded a doctor secret-leak scanner plus a CI gate that greps the raw archive bytes and fails the build if a secret shape appears.

WhyOne fix isn't enough — a later change could quietly reintroduce the leak. The gate makes that regression impossible to merge.

ChangedNon-secret config is still written where the current runtime reads it, but that path is now marked deprecated with a one-time warning.

WhyWe're relocating config. Deprecate gradually so existing components keep working until the new config channel exists (Phase C).

ChangedBefore extracting a bundle, reject absolute paths, .., symlinks/hardlinks that escape the folder, and duplicate paths.

WhyExtracting an untrusted bundle could otherwise overwrite files anywhere on disk — the classic "zip-slip" attack.

ChangedNew crate greentic-deploy-spec holds every new type — Environment, Revision, TrafficSplit, BundleDeployment, Credentials — with validators (e.g. traffic weights must sum to 100%).

WhyThree repos were each inventing their own idea of "environment". One shared definition stops them drifting apart and becomes the single source of truth.

ChangedAn EnvironmentStore with a local-filesystem implementation: atomic writes (temp file + rename), a per-environment lock, and a backup before every change.

WhyThose types are useless if a crash mid-save corrupts them or two operators overwrite each other. This makes the state durable and concurrency-safe.

ChangedBuilt the full gtc-dev op surface — 8 nouns (env, env-packs, bundles, revisions, traffic, config, credentials, secrets) × their verbs — and dropped the old hard-coded --provider aws admin subcommands.

WhyOperators need one consistent way to drive the new model, not cloud-specific one-offs scattered across the CLI.

ChangedFirst gtc-dev setup <bundle> auto-creates the local environment with 5 sensible default env-packs (local-process, dev-store, stdout, in-memory sessions + state) before the bundle wizard runs.

WhyNobody should hand-write JSON to get started. Run one command against a real bundle, get a working local environment.

ChangedNew gtc-dev op env init verb exposes the A4 helper directly — creates the local env if missing, fills in any missing default slots if it already exists, and is idempotent (returns "created" / "healed" / "untouched"). Audit-recorded per A7.

WhyA4's helper was only reachable as a side-effect of setup_or_update (which needs a valid bundle) or run_start (which needs to actually start). From an empty directory there was no clean path. init closes that gap — one verb, no bundle, no hack.

ChangedA migrate-dev command scans for legacy dev usage and migrates it; if migration isn't safe, it keeps a temporary dev alias that warns and can be hard-disabled with an env var.

WhyOld installs say dev everywhere. We want one canonical name (local) but can't yank it out from under live setups.

ChangedA lifecycle state machine (staged → warming → ready → draining → inactive → archived) with a validated transition matrix; you cannot archive a revision that still serves traffic.

WhyRollout state must stay coherent. Routing traffic to a half-warmed revision, or archiving a live one, would silently break deployments.

ChangedA one-shot migrate-state that moves the legacy state/deploy/<provider> tree into the new layout and fails loudly if anything is left behind.

WhyReading half-old, half-new state silently would cause subtle, hard-to-trace bugs. Migrate once; refuse to proceed on leftovers.

ChangedAn append-only audit log for every mutating command, plus a local authorization gate; changes to non-local environments fail closed.

WhyYou must be able to answer "who changed this, and when". And until real access control exists, refusing risky operations is safer than allowing them unguarded.

ChangedWire types + docs for a future remote store: compare-and-swap with ETags, idempotent retries, an integrity (corruption-detection) hash, RBAC decision and backup/restore shapes. No remote server yet — just the contract.

WhyProduction won't use local files. Pinning the contract now means the local path and the eventual cloud path behave identically — no surprises later.

ChangedAn env-pack registry that maps a descriptor like greentic.deployer.local-process@0.1.0 to a real handler, with built-ins for the 5 local defaults and a plug-in registration hook (EnvPackHandler trait, EnvPackRegistry::register). op env doctor already consults the registry.

WhyThis is the seam every cloud plugs into later. Without it, the descriptor strings are just labels with no code behind them.

Changed5-repo PR train threading env_id through every wizard runtime: qa-lib got the foundation (WizardRunConfig.env_id, SecretsSink trait + NoopSecretsSink, qa-cli --env), then greentic-bundle / greentic-setup / greentic-operator / greentic-dw each threaded it through their wizards. 4 Codex follow-ups closed in-train; /simplify pass shaved (A10) tags out of --help text.

WhyEach environment has its own secrets backend. Until wizards know which env they're answering for, secret routing can't work. Secret persistence reroute itself is deferred to C7 — A10 ships the seam.

ChangedNew tool_check.rs module + gtc op env tool-check verb. Generic primitives (binary-present, version probe) + named catalog for the 9 production tools (terraform, tofu, kubectl, helm, docker, podman, aws, gcloud, az) + typed auth probes (aws-caller-identity, gcloud-auth-list, az-account-show, kubectl-can-i). Each env-pack handler exposes a preflight() seam; built-in local handlers report no external tools.

WhyA clear up-front "install terraform with apt|brew|scoop" saves hours versus a confusing failure halfway through provisioning a cloud. Verify versions, credentials, and reachability — not just binary presence.

ChangedAll four host images cut to gcr.io/distroless/static-debian12:nonroot with MUSL-static binaries, USER 65532:65532, strip = true on release. Verified: each <30 MB, ldd reports "not a dynamic executable", image's User field is 65532. Dropped the unsquashfs shell-out + squashfs-tools install in favor of the backhand Rust crate. Codex follow-up added a shebang-helper preflight + ELF-only contract for path extractors.

WhyDistroless = no shell to exploit, no package manager, no root. Standard production hardening for what ships to customers.

ChangedNew runtime_config.rs in greentic-start: locates ~/.greentic/environments/<env>/runtime-config.json, deserializes the deploy-spec RuntimeConfig, validates schema + env-match + non-empty revisions + per-block weight_bps ≤ 10000, resolves each block's pack refs through the existing path_safety::normalize_under_root helper, and enforces TrafficSplit invariants per deployment_id (one bundle per deployment, no duplicate revision ids, weights sum to 10,000 bps).

WhyUntil now greentic-start only knew how to boot from a single bundle directory. This is the first read-side support for the new world where one env hosts many deployments × revisions. Codex review caught a symlink-escape via raw is_file() — fixed by canonicalize-then-contain.

ChangedNew revision_dispatcher.rs: per-deployment_id traffic split held in ArcSwap, selection order = trusted header → HMAC cookie → session pin → weighted random over basis points. HMAC-SHA256 cookies bind {env_id, tenant, deployment_id, revision_id, generation, expires_at}; bounded in-memory pin map (MAX_PINS = 16384) with sweep-expired + evict-soonest. apply_traffic_split serialized on a write lock so concurrent operators can't tear state.

WhyThis is the brain of "1% to v2, 99% to v1" — a pure state machine isolated from HTTP plumbing so it can be tested deterministically. 4 Codex findings closed in-PR: write-race, silent bundle rebind, pins outliving generation bumps, unbounded pin map.

ChangedActivePacks re-keyed from HashMap<String, …> (tenant only) to HashMap<RuntimeKey, …> where RuntimeKey { tenant, deployment_id, bundle_id, revision_id }. Typed IDs from greentic-deploy-spec. Two read methods (load_pack legacy / load_revision full), three mutators (insert_pack, replace_legacy, replace) all serialized on a write lock; reads stay lock-free via ArcSwap. Codex finding closed: wholesale reload would have evicted revision entries — fixed by partitioning legacy vs revision-keyed state.

WhyOne tenant can host many concurrent revisions of many deployments. The old single-key index can't represent that. B3 will be the consumer that actually puts revision-keyed entries in.