메뉴
Use when running deployment migration rehearsals in NixOS VM tests or Incus/LXC topology simulations, including check-env, check-runtime, dry-run, runtime launch, failure injections, and production evidence gates.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Use when central deployment automation is unavailable and an approved operator must recover a target through direct SSH, signed manifests, forced-command deploy keys, and explicit rollback evidence.
Use when inspecting Attic or Cachix deployment cache health, proving closure substitute coverage, repairing cache misses, or handling cache token and signing-key boundaries.
Use when performing normal deployment operations, confirming deployment health, running direct SSH deployment wrappers, or deciding whether to fall back to rollback.
Use when investigating a failed, stuck, superseded, or ambiguous deployment across GitHub Actions, deployment event artifacts, mcl status summaries, target journals, cache health, and post-switch health checks.
Use when inspecting or repairing desired-state reconciliation, latest-only state, pending or failed retries, superseded deployments, target locks, and pull-agent status.
| name | deployment-e2e-rehearsal |
| description | Use when running deployment migration rehearsals in NixOS VM tests or Incus/LXC topology simulations, including check-env, check-runtime, dry-run, runtime launch, failure injections, and production evidence gates. |
pending-runtime result as an honest blocker only when the local
daemon or required Incus/LXC storage prerequisites are unavailable; do not
mark production enablement complete from check-env or dry-run alone.nix build .#checks.x86_64-linux.deployment-attic-push-substitute-vm
nix build .#checks.x86_64-linux.deployment-cache-corruption-vm
nix build .#checks.x86_64-linux.deployment-direct-ssh-success-vm
nix build .#checks.x86_64-linux.deployment-direct-ssh-rollback-vm
nix build .#checks.x86_64-linux.deployment-direct-ssh-attic-restore-vm
nix build .#checks.x86_64-linux.deployment-reconciler-timer-retry-vm
nix build .#checks.x86_64-linux.deployment-reconciler-lock-contention-vm
nix build .#checks.x86_64-linux.deployment-pull-agent-latest-vm
nix build .#checks.x86_64-linux.deployment-pull-agent-rejects-invalid-vm
nix build .#checks.x86_64-linux.deployment-pull-agent-lock-contention-vm
nix build .#checks.x86_64-linux.deployment-scheduled-canary-local-vm
nix build .#checks.x86_64-linux.deployment-production-cutover-simulation-vm
nix build .#checks.x86_64-linux.deployment-cachix-fallback-simulation
nix build .#checks.x86_64-linux.deployment-no-default-cachix-deploy-call
nix build .#checks.x86_64-linux.deployment-incus-rehearsal-image
nix build .#checks.x86_64-linux.deployment-incus-rehearsal-script-static
bash scripts/deployment-incus-rehearsal.sh full-topology --check-env
bash scripts/deployment-incus-rehearsal.sh full-topology --check-runtime
bash scripts/deployment-incus-rehearsal.sh full-topology --dry-run
bash scripts/deployment-incus-rehearsal.sh full-topology
bash scripts/deployment-incus-rehearsal.sh full-topology-failures --check-env
bash scripts/deployment-incus-rehearsal.sh full-topology-failures --dry-run
bash scripts/deployment-incus-rehearsal.sh full-topology-failures
bash scripts/deployment-incus-rehearsal.sh offline-latest-only --check-env
bash scripts/deployment-incus-rehearsal.sh offline-latest-only --dry-run
bash scripts/deployment-incus-rehearsal.sh offline-latest-only
bash scripts/deployment-incus-rehearsal.sh forced-command --check-env
bash scripts/deployment-incus-rehearsal.sh forced-command --dry-run
bash scripts/deployment-incus-rehearsal.sh forced-command
bash scripts/deployment-incus-rehearsal.sh break-glass --check-env
bash scripts/deployment-incus-rehearsal.sh break-glass --check-runtime
bash scripts/deployment-incus-rehearsal.sh break-glass --dry-run
bash scripts/deployment-incus-rehearsal.sh break-glass
bash scripts/deployment-incus-rehearsal.sh pull-agent --check-env
bash scripts/deployment-incus-rehearsal.sh pull-agent --dry-run
bash scripts/deployment-incus-rehearsal.sh pull-agent
--check-env to validate host tools and storage.--check-runtime to validate daemon, bridge, image, and launch
permissions.--dry-run to print topology, target roles, networks, credentials,
failure injections, and evidence paths without starting containers.pending-runtime, keep M7
partial and record the missing daemon or storage prerequisite.MCL_DEPLOYMENT_INCUS_ARTIFACT_DIR to choose it explicitly.MCL_DEPLOYMENT_INCUS_KEEP=1 only when a failed run needs prefixed
containers and networks preserved for debugging.The full topology must include these roles: controller or CI runner, Attic cache, monitoring or status collector, directly reachable server targets, NAT-like or intermittently reachable targets, and optional workstation or pull-agent targets.
The network model must include separate control, cache, home-lab-like, remote-server-like, and optional workstation segments. Failure injections must cover target network partition, stale desired state, and newer desired state while offline. It must also cover cache object missing or corruption, forced-command SSH misuse, health-check failure, rollback, and lock contention. For break-glass coverage, the topology must also represent a failed canary deploy, reject arbitrary deploy-key shell access, accept only a signed break-glass manifest through forced-command SSH, and preserve final generation evidence in target-side artifacts.
Stop before using production SSH keys, cache tokens, manifest signing keys, or hostnames in rehearsal containers; before weakening a failed check; before marking a runtime-pending result as passed; or before enabling production targets without the full evidence set. Stop before removing Cachix Deploy fallback without two successful live canary cycles.
Destroy rehearsal containers and networks after artifact capture. If a runtime scenario touches a real host by mistake, stop the rehearsal immediately and use break-glass rollback under human supervision.