القائمة
Use when inspecting or repairing desired-state reconciliation, latest-only state, pending or failed retries, superseded deployments, target locks, and pull-agent status.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Use when central deployment automation is unavailable and an approved operator must recover a target through direct SSH, signed manifests, forced-command deploy keys, and explicit rollback evidence.
Use when running deployment migration rehearsals in NixOS VM tests or Incus/LXC topology simulations, including check-env, check-runtime, dry-run, runtime launch, failure injections, and production evidence gates.
Use when inspecting Attic or Cachix deployment cache health, proving closure substitute coverage, repairing cache misses, or handling cache token and signing-key boundaries.
Use when performing normal deployment operations, confirming deployment health, running direct SSH deployment wrappers, or deciding whether to fall back to rollback.
Use when investigating a failed, stuck, superseded, or ambiguous deployment across GitHub Actions, deployment event artifacts, mcl status summaries, target journals, cache health, and post-switch health checks.
| name | deployment-reconciler |
| description | Use when inspecting or repairing desired-state reconciliation, latest-only state, pending or failed retries, superseded deployments, target locks, and pull-agent status. |
mcl deploy-reconcile --state-dir "$STATE_DIR" --event-log "$EVENTS_JSONL" --dry-run
mcl deploy-reconcile --state-dir "$STATE_DIR" --target "$TARGET" \
--target-host "$TARGET=$SSH_HOST" --ssh-user deploy \
--identity-file "$MCL_DEPLOY_SSH_IDENTITY" --ssh-option BatchMode=yes
mcl deploy-agent --target "$TARGET" --manifest-dir "$MANIFEST_DIR" \
--trusted-manifest-public-key "$MCL_DEPLOY_MANIFEST_PUBLIC_KEY" --dry-run
systemctl status mcl-deployment-reconciler.service mcl-deployment-reconciler.timer
systemctl status mcl-deploy-agent.service mcl-deploy-agent.timer
journalctl -u mcl-deployment-reconciler.service -u mcl-deploy-agent.service -b --no-pager -n 200
targets/<target>.json to identify the latest desired deployment.desired/, current/, failed/, superseded/, converged/, and
agent-status/ entries for the same deployment id.accepted and pending as retryable states unless a newer sequence
has superseded them.superseded as terminal; do not apply it after a higher sequence was
accepted.failed as retryable only when the event or agent status says
retryable: true and the retry budget is not exhausted.converged or succeeded as terminal unless the target health check
later proves false.flock -n lock ownership before starting another reconciler.State is latest-only per target. A lower sequence must not replace a higher
sequence. A same-sequence deployment with a different deployment id is
ambiguous for the pull agent and must be non-retryable. Retry state is bounded
by maxAttempts; exhausted retries become non-retryable. Already converged
deployments should short-circuit rather than restore or switch again.
current, failed, superseded, converged, and
agent-status.activate-requested, target apply phases, and final
status.Stop before deleting state files, rewriting sequences, forcing a superseded
deployment, clearing a non-retryable state, bypassing flock, increasing retry
budgets, or changing target-host mappings for production targets.
The reconciler does not invent rollback. It follows the signed manifest
rollbackPolicy and target-side apply result. If rollback must be manual, use
the break-glass skill and preserve the reconciler state files for audit.