القائمة
Use when performing normal deployment operations, confirming deployment health, running direct SSH deployment wrappers, or deciding whether to fall back to rollback.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
| name | deployment-operation |
| description | Use when performing normal deployment operations, confirming deployment health, running direct SSH deployment wrappers, or deciding whether to fall back to rollback. |
ATTIC_SUBSTITUTER is paired with ATTIC_TRUSTED_PUBLIC_KEY when
Attic restore is required before activation.just deploy-machine "$TARGET"
just deploy-machine-direct-ssh "$TARGET" "$SSH_HOST" deploy
mcl cache push-closure --backend attic --cache "$CACHE" --target "$TARGET" \
--transport ssh --substituter "$ATTIC_SUBSTITUTER" \
--trusted-public-key "$ATTIC_TRUSTED_PUBLIC_KEY" --require-substitute "$SYSTEM_PATH"
mcl deploy-plan --target "$TARGET" --desired-system-path "$SYSTEM_PATH" \
--git-revision "$GIT_REVISION" --sequence "$SEQUENCE" \
--signing-key "$MCL_DEPLOY_MANIFEST_SIGNING_KEY" --output "$MANIFEST"
mcl deploy-ssh "$TARGET" --manifest "$MANIFEST" --ssh-host "$SSH_HOST" \
--ssh-user deploy --identity-file "$MCL_DEPLOY_SSH_IDENTITY" \
--ssh-option BatchMode=yes --ssh-option StrictHostKeyChecking=yes
mcl deploy-status summarize "$EVENTS_JSONL"
Prefer the repository wrapper when it exists, because it keeps build, cache push, manifest signing, deploy, and state directory choices together. During M8, the Attic/direct path is the cutover candidate and Cachix Deploy is legacy fallback. Do not treat a fallback activation as evidence that the new path is ready.
mcl deploy-status summarize output.agent-restore, switch, healthcheck, and complete events
when the direct apply path is used.Stop before deploying when the target group is broader than approved, the cache cannot prove substitute coverage, the signing key identity is unexpected, host key verification is disabled, the manifest target differs from the target being contacted, or Cachix fallback is no longer available during migration.
just rollback-machine-direct-ssh "$TARGET" "$SSH_HOST" deploy
ssh -t "deploy@$SSH_HOST" 'sudo nixos-rebuild switch --rollback'
Use rollback only with explicit approval unless the written rollout procedure already authorizes automatic rollback for the failing health check.
Use when central deployment automation is unavailable and an approved operator must recover a target through direct SSH, signed manifests, forced-command deploy keys, and explicit rollback evidence.
Use when running deployment migration rehearsals in NixOS VM tests or Incus/LXC topology simulations, including check-env, check-runtime, dry-run, runtime launch, failure injections, and production evidence gates.
Use when inspecting Attic or Cachix deployment cache health, proving closure substitute coverage, repairing cache misses, or handling cache token and signing-key boundaries.
Use when investigating a failed, stuck, superseded, or ambiguous deployment across GitHub Actions, deployment event artifacts, mcl status summaries, target journals, cache health, and post-switch health checks.
Use when inspecting or repairing desired-state reconciliation, latest-only state, pending or failed retries, superseded deployments, target locks, and pull-agent status.