cpflow 6.0.0.rc.0 → 6.0.0

data/docs/secrets-and-env-values.md

@@ -11,6 +11,48 @@ set these values directly at the GVC or workload levels, so none of these ENV va
 
 ## Review app secrets
 
+For credentials and initialization scripts created by the PostgreSQL template, see
+[PostgreSQL for disposable review apps](./postgres-review-apps.md).
+
+For same-repository review apps that need only disposable credentials, opt in on
+the dynamically matched review-app entry in `.controlplane/controlplane.yml`:
+
+```yaml
+apps:
+  my-app-review:
+    match_if_app_name_starts_with: true
+    generated_review_secret_keys:
+      - SECRET_KEY_BASE
+      - RENDERER_PASSWORD
+```
+
+`cpflow setup-app` then creates a separate `APP_NAME-secrets` dictionary and
+policy for each PR app, tags both resources with the exact app name, fills each
+configured key with a random 256-bit hex value, and never prints the values.
+`--refresh-templates` fills missing keys without rotating existing values.
+Initial template application skips templates named for the generated dictionary
+and policy, so templates cannot replace its values or broaden its access.
+Refresh also skips the generated policy template.
+Setup refuses to reuse a dictionary without the exact app tag or a policy that
+targets another secret or binds another principal; it rechecks the policy
+immediately before granting the app identity. Keep this
+setting off persistent apps and do
+not combine it with custom `secrets_name` or `secrets_policy_name`. Templates
+that use `{{APP_SECRETS}}` automatically point at the PR-specific dictionary.
+`cpflow delete` and delete-mode stale cleanup remove that dictionary and policy
+before removing the app, provided the policy still targets the dictionary and
+has no other bindings. Generated dictionaries carry an app marker; if a prior
+attempt removed the policy first, cleanup can use that marker to remove only the
+matching disposable dictionary. An unmarked policy is also left for inspection
+if its dictionary is already gone. If the GVC was removed separately before disposable credential cleanup finished, rerun
+`cpflow delete` with the same app name to finish secret cleanup. The generated
+delete action calls that same recovery path when the GVC is already absent.
+Cleanup still checks the app-specific names and tag if the key-generation option
+was later removed. Unexpected grants or unmarked secrets leave those resources
+for inspection.
+This generates credentials only; external licenses, database accounts, and
+provider tokens still require their own review-only provisioning.
+
 Review apps run application code from pull requests. For repositories with external contributors, do not put sensitive
 production or long-lived staging secrets in review apps. A secret reference such as `cpln://secret/...` protects the
 value while it is stored in Control Plane configuration, but the value becomes readable by application code after it is

data/docs/sidebars.ts

@@ -44,6 +44,7 @@ const sidebars: SidebarsConfig = {
       label: 'Data Services',
       items: [
         'postgres',
+        'postgres-review-apps',
         'rds-private-networking',
         'redis',
       ],

data/lib/command/ai_github_flow_prompt.rb

@@ -32,9 +32,9 @@ module Command
       <<~PROMPT
         Set up Control Plane GitHub Flow for this repo. First make sure the `cpflow` CLI is available: use the repo's existing `bundle exec cpflow` if present, otherwise install the published `cpflow` Ruby gem with `gem install cpflow`; if neither is possible, stop and report that blocker. Use the same `cpflow` invocation for the rest of the rollout. Start with `cpflow github-flow-readiness` and stop on any reported blockers. The repo must be deployable from a clean clone: published package versions, complete runtime scaffold, and a production Dockerfile that can build the app. If any package version is unpublished, inaccessible from CI, or requires credentials that are not already modeled in the repo or GitHub settings, stop and report the blocker instead of generating workflow files. If the repo is a legacy sample pinned to an obsolete Ruby or Bundler toolchain, if it does not even have a production Dockerfile yet, or if it is a monorepo without an already-decided single app boundary for this flow, stop and report that as a prerequisite instead of forcing the rollout.
 
-        If `.controlplane/` is missing, run `cpflow generate`. Treat the generated app names as the repo-name default (`#{inferred_app_prefix}`) and rename them only if the project needs a different prefix. Then run `cpflow generate-github-actions` (or `cpflow generate-github-actions --staging-branch BRANCH` when staging should deploy from a branch other than `main`/`master`), keep review apps opt-in via `+review-app-deploy`, make sure any `STAGING_APP_BRANCH` repository variable is also present in the generated staging workflow's `on.push.branches` filter, and list the GitHub secrets and variables that must be configured. Do not hand-edit duplicated upstream refs into the generated wrappers. Keep every generated Control Plane Flow source pin synchronized at the same `vX.Y.Z`: each reusable-workflow `uses: ...@vX.Y.Z` ref, the production promotion `.cpflow` checkout ref, and its `control_plane_flow_ref` setup input. By default, `cpflow generate-github-actions` derives these values from the installed `cpflow` gem version; temporary explicit ref overrides are for unreleased testing and must keep all three values synchronized. Keep the generated `.github/actions/cpflow-*` files from that same gem unchanged; upstream reusable workflows invoke those checked-in local actions and separately check out the matching runtime source at `.cpflow`. When bumping the `cpflow` gem in a downstream repo, run `cpflow update-github-actions` (or `bundle exec cpflow update-github-actions`) and validate with `bin/test-cpflow-github-flow` in the same PR so the checked-in workflows and local actions move together. Keep the normal generated review-app setup simple: review apps require only `CPLN_TOKEN_STAGING` when the generated review app config can be inferred. For public demos, starter staging apps, and long-lived review apps, keep the app workload `type: standard` with one warm replica, set its autoscaling metric to `disabled`, and enable `capacityAI: true` so Control Plane can right-size CPU and memory allocation at that fixed replica count. Shared Postgres and other stateful workloads are the usual exceptions and should stay manually sized; Capacity AI is for supported stateless app/service workloads. If true idle scale-to-zero is explicitly required, create a separate `serverless` workload before first deploy or plan a delete/recreate migration because Control Plane will not change an existing `standard` workload to `serverless` in place. For shared review-app resources such as one staging database, use `shared_secret_grants` and `{{SHARED_SECRET_DATABASE}}` placeholders instead of hardcoding the base app secret name; this keeps review-app policy binding and cleanup automatic while avoiding per-PR database cost. Document the one-time Control Plane bootstrap command for persistent staging and production apps with `cpflow setup-app --skip-post-creation-hook`; for existing apps or later template updates, document `cpflow apply-template` and the need for the app identity to have `reveal` on the app secret policy. Do not imply the staging deploy or promotion workflows create those persistent GVCs. For production promotion, document a protected `production` GitHub Environment with required reviewers, prevent self-review, and `CPLN_TOKEN_PRODUCTION` stored as an environment secret, not as a repository or organization secret.
+        If `.controlplane/` is missing, run `cpflow generate`. Treat the generated app names as the repo-name default (`#{inferred_app_prefix}`) and rename them only if the project needs a different prefix. Then run `cpflow generate-github-actions` (or `cpflow generate-github-actions --staging-branch BRANCH` when staging should deploy from a branch other than `main`/`master`), keep review apps opt-in via `+review-app-deploy`, make sure any `STAGING_APP_BRANCH` repository variable is also present in the generated staging workflow's `on.push.branches` filter, and list the GitHub secrets and variables that must be configured. Do not hand-edit duplicated upstream refs into the generated wrappers. Keep every generated Control Plane Flow source pin synchronized at the same `vX.Y.Z`: each reusable-workflow `uses: ...@vX.Y.Z` ref, the production promotion `.cpflow` checkout ref, and its `control_plane_flow_ref` setup input. By default, `cpflow generate-github-actions` derives these values from the installed `cpflow` gem version; temporary explicit ref overrides are for unreleased testing and must keep all three values synchronized. Keep the generated `.github/actions/cpflow-*` files from that same gem unchanged; upstream reusable workflows invoke those checked-in local actions and separately check out the matching runtime source at `.cpflow`. When bumping the `cpflow` gem in a downstream repo, `cpflow update-github-actions` refreshes local actions and helpers while preserving all top-level workflows, including their refs and triggers. Use `cpflow update-github-actions --workflows FILE...` to explicitly select wrappers for replacement, then review the diff and reapply downstream customizations. A differing existing validator blocks all writes: preserve its downstream checks in executable `bin/test-cpflow-github-flow-custom`, then remove or rename the old generated validator before retrying. The generated validator invokes that preserved extension and propagates its failures. Follow `docs/ci-automation.md` for the migration procedure, keep source pins compatible with the updated actions, and run `bin/test-cpflow-github-flow` in the same PR (or `bin/test-cpflow-github-flow bundle exec cpflow` when using Bundler). Keep the normal generated review-app setup simple: review apps require only `CPLN_TOKEN_STAGING` when the generated review app config can be inferred. For public demos, starter staging apps, and long-lived review apps, keep the app workload `type: standard` with one warm replica, set its autoscaling metric to `disabled`, and enable `capacityAI: true` so Control Plane can right-size CPU and memory allocation at that fixed replica count. Shared Postgres and other stateful workloads are the usual exceptions and should stay manually sized; Capacity AI is for supported stateless app/service workloads. If true idle scale-to-zero is explicitly required, create a separate `serverless` workload before first deploy or plan a delete/recreate migration because Control Plane will not change an existing `standard` workload to `serverless` in place. For shared review-app resources such as one staging database, use `shared_secret_grants` and `{{SHARED_SECRET_DATABASE}}` placeholders instead of hardcoding the base app secret name; this keeps review-app policy binding and cleanup automatic while avoiding per-PR database cost. Document the one-time Control Plane bootstrap command for persistent staging and production apps with `cpflow setup-app --skip-post-creation-hook`; for existing apps or later template updates, document `cpflow apply-template` and the need for the app identity to have `reveal` on the app secret policy. Do not imply the staging deploy or promotion workflows create those persistent GVCs. For production promotion, document a protected `production` GitHub Environment with required reviewers, prevent self-review, and `CPLN_TOKEN_PRODUCTION` stored as an environment secret, not as a repository or organization secret.
 
-        Keep Node available in the final image if asset compilation or SSR depends on ExecJS, Yarn, `pnpm`, or npm after the main install layer. Make sure the generated Dockerfile uses a Ruby base image compatible with the app's declared Ruby requirement. Preserve repo-defined frontend build hooks: if `config/shakapacker.yml` defines a `precompile_hook`, or React on Rails enables `config.auto_load_bundle = true`, confirm the generated Dockerfile runs that codegen step before `rails assets:precompile`. If `config/database.yml` shows SQLite in production, confirm that the generated scaffold uses persistent `db` and `storage` volumes plus a release script that runs `rails db:prepare`; otherwise keep the default Postgres workload. If the public workload is not named `rails`, set `PRIMARY_WORKLOAD` or adjust the generated workflows. Inspect the Dockerfile and package sources for private GitHub dependencies or `RUN --mount=type=ssh`; if present, wire `DOCKER_BUILD_SSH_KEY`, optionally set `DOCKER_BUILD_SSH_KNOWN_HOSTS` for non-GitHub SSH hosts, and keep `DOCKER_BUILD_EXTRA_ARGS` to newline-delimited single tokens such as `--build-arg=FOO=bar`.
+        Keep Node available in the final image if asset compilation or SSR depends on ExecJS, Yarn, `pnpm`, or npm after the main install layer. Make sure the generated Dockerfile uses a Ruby base image compatible with the app's declared Ruby requirement. Preserve repo-defined frontend build hooks: if `config/shakapacker.yml` defines a `precompile_hook`, or React on Rails enables `config.auto_load_bundle = true`, confirm the generated Dockerfile runs that codegen step before `rails assets:precompile`. If `config/database.yml` shows SQLite in production, confirm that the generated scaffold redirects every production database file into persistent `/app/data` (or keeps it under persistent `/app/storage`) without mounting over the image's `/app/db` migrations, stores Active Storage under `/app/storage`, and runs `rails db:prepare`; otherwise keep the default Postgres workload. If the public workload is not named `rails`, set `PRIMARY_WORKLOAD` or adjust the generated workflows. Inspect the Dockerfile and package sources for private GitHub dependencies or `RUN --mount=type=ssh`; if present, wire `DOCKER_BUILD_SSH_KEY`, optionally set `DOCKER_BUILD_SSH_KNOWN_HOSTS` for non-GitHub SSH hosts, and keep `DOCKER_BUILD_EXTRA_ARGS` to newline-delimited single tokens such as `--build-arg=FOO=bar`.
 
         Run the real local validations you can: Docker build if feasible, repo tests or smoke checks, YAML validation, and any CI-equivalent build steps. Push the branch and check the GitHub Actions results. Only stop early for a real external blocker or a product decision that changes scope.
       PROMPT

data/lib/command/apply_template.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../core/disposable_postgres_helpers"
+
 module Command
   class ApplyTemplate < Base # rubocop:disable Metrics/ClassLength
     NAME = "apply-template"
@@ -10,7 +12,9 @@ module Command
       location_option,
       skip_confirm_option,
       add_app_identity_option,
-      preserve_existing_runtime_option
+      preserve_existing_runtime_option,
+      exclude_secret_template_option,
+      exclude_policy_template_option
     ].freeze
     DESCRIPTION = "Applies application-specific configs from templates"
     LONG_DESCRIPTION = <<~DESC
@@ -19,6 +23,7 @@ module Command
       - Picks templates from the `.controlplane/templates` directory
       - Templates are ordinary Control Plane templates but with variable preprocessing
       - Use `--preserve-existing-runtime` to retain each workload container's configured app image, even when the workload is unready, and skip existing secret resources entirely while applying other template changes
+      - Use `--exclude-secret-template NAME` and `--exclude-policy-template NAME` to exclude exact named templates without changing workload image handling
       - Missing or invalid workload images use only an unambiguous app image from ready workloads; refresh fails before applying templates when no safe fallback exists
 
       **Preprocessed template variables:**
@@ -61,7 +66,8 @@ module Command
       @skipped_templates = []
 
       templates = @template_parser.parse(@names_to_filenames.values)
-      templates = preserve_existing_runtime(templates) if config.options[:preserve_existing_runtime]
+      templates = filter_existing_resources(templates)
+      DisposablePostgresHelpers.new(config, cp).prepare_templates!(templates)
       pending_templates = confirm_templates(templates)
       add_app_identity_template(pending_templates) if config.options[:add_app_identity]
       pending_templates.each do |template|
@@ -77,6 +83,27 @@ module Command
 
     private
 
+    def filter_existing_resources(templates)
+      templates = preserve_existing_runtime(templates) if config.options[:preserve_existing_runtime]
+      templates = exclude_named_template(templates, :exclude_secret_template, "secret")
+      exclude_named_template(templates, :exclude_policy_template, "policy")
+    end
+
+    def exclude_named_template(templates, option, kind)
+      name = config.options[option]
+      return templates unless name
+      raise "--#{option.to_s.tr('_', '-')} requires a #{kind} name." if name.empty?
+
+      templates.filter_map do |template|
+        if template["kind"] == kind && template["name"] == name
+          report_skipped(template)
+          next
+        end
+
+        template
+      end
+    end
+
     def template_kind(template)
       case template["kind"]
       when "gvc"
@@ -154,13 +181,18 @@ module Command
       cache_existing_workloads(templates)
       ready_fallback_image = unambiguous_ready_app_image
 
+      skip_existing_secret_resources(templates).each do |template|
+        preserve_workload_images(template, ready_fallback_image) if template["kind"] == "workload"
+      end
+    end
+
+    def skip_existing_secret_resources(templates)
       templates.filter_map do |template|
         if template["kind"] == "secret" && cp.fetch_secret(template["name"])
           report_skipped(template)
           next
         end
 
-        preserve_workload_images(template, ready_fallback_image) if template["kind"] == "workload"
         template
       end
     end
@@ -312,7 +344,7 @@ module Command
       return unless @skipped_templates.any?
 
       skipped = @skipped_templates.map { |template| "  - [#{template_kind(template)}] #{template['name']}" }.join("\n")
-      progress.puts("\n#{Shell.color('Skipped templates (already exist):', :blue)}\n#{skipped}")
+      progress.puts("\n#{Shell.color('Skipped templates:', :blue)}\n#{skipped}")
     end
   end
 end

data/lib/command/base.rb

@@ -483,6 +483,28 @@ module Command
       }
     end
 
+    def self.exclude_secret_template_option(required: false)
+      {
+        name: :exclude_secret_template,
+        params: {
+          desc: "Excludes one named secret template while applying templates",
+          type: :string,
+          required: required
+        }
+      }
+    end
+
+    def self.exclude_policy_template_option(required: false)
+      {
+        name: :exclude_policy_template,
+        params: {
+          desc: "Excludes one named policy template while applying templates",
+          type: :string,
+          required: required
+        }
+      }
+    end
+
     def self.skip_pre_deletion_hook_option(required: false)
       {
         name: :skip_pre_deletion_hook,
@@ -688,15 +710,46 @@ module Command
     end
 
     def shared_secret_policy_targets_secret?(grant, policy)
+      policy_targets_secret?(policy, grant.fetch(:secret_name))
+    end
+
+    def policy_targets_secret?(policy, secret_name)
       target_links = Array(policy["targetLinks"])
 
       policy["targetKind"] == "secret" &&
         target_links.one? &&
-        shared_secret_policy_target_links(grant).include?(target_links.first)
+        secret_policy_target_links(secret_name).include?(target_links.first)
     end
 
-    def shared_secret_policy_target_links(grant)
-      secret_name = grant.fetch(:secret_name)
+    def generated_review_app_tag(resource)
+      tags = resource["tags"]
+      return nil unless tags.is_a?(Hash)
+
+      tags[::Config::GENERATED_REVIEW_APP_TAG]
+    end
+
+    def generated_review_secret_owned_by_app?(secret, secret_name = config.secrets)
+      secret.is_a?(Hash) && secret["name"] == secret_name && secret["type"] == "dictionary" &&
+        generated_review_app_tag(secret) == config.app
+    end
+
+    def generated_review_policy_binding_state(policy)
+      bindings = Array(policy["bindings"])
+      return :unbound if bindings.empty?
+      return :unsafe unless generated_review_policy_bindings_for_app?(bindings)
+
+      case bindings.map { |binding| binding["permissions"] }.uniq
+      when [[]] then :unbound
+      when [["reveal"]] then :bound
+      else :unsafe
+      end
+    end
+
+    def generated_review_policy_bindings_for_app?(bindings)
+      bindings.all? { |binding| Array(binding["principalLinks"]) == [config.identity_link] }
+    end
+
+    def secret_policy_target_links(secret_name)
       [
         "//secret/#{secret_name}",
         "/org/#{config.org}/secret/#{secret_name}"

data/lib/command/delete.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../core/disposable_postgres_helpers"
+
 module Command
   class Delete < Base # rubocop:disable Metrics/ClassLength
     NAME = "delete"
@@ -14,6 +16,7 @@ module Command
       - Deletes the whole app (GVC with all workloads, all volumesets and all images) or a specific workload
       - Also unbinds the app from the secrets policy and any configured `shared_secret_grants` policies, as long as both the identity and each policy exist (and are bound)
       - For the app-specific secrets policy, removes every permission held by the app identity; for `shared_secret_grants`, removes only `reveal`
+      - Removes a marked per-app dictionary and exact-target unbound policy for generated review credentials, including after the opt-in is removed from a dynamically matched review-app entry
       - Will ask for explicit user confirmation
       - Runs a pre-deletion hook before the app is deleted if `hooks.pre_deletion` is specified in the `.controlplane/controlplane.yml` file
       - If the hook exits with a non-zero code, the command will stop executing and also exit with a non-zero code
@@ -50,8 +53,10 @@ module Command
     end
 
     def delete_whole_app
-      return progress.puts("App '#{config.app}' does not exist.") if cp.fetch_gvc.nil?
+      return handle_missing_app if cp.fetch_gvc.nil?
 
+      postgres_helpers.validate!
+      validate_disposable_review_secret_resources!
       check_volumesets
       check_images
       return unless confirm_delete(config.app)
@@ -61,11 +66,104 @@ module Command
       policy_unbinds = secret_policy_unbinds
       run_pre_deletion_hook unless config.options[:skip_pre_deletion_hook]
       unbind_identity_from_policy(policy_unbinds)
+      delete_app_resources
+    end
+
+    def handle_missing_app
+      progress.puts("App '#{config.app}' does not exist.")
+      cleanup_state = validate_disposable_review_secret_resources!
+      postgres_resources = postgres_helpers.validate!
+      return if cleanup_state == :none && postgres_resources.empty?
+      return unless confirm_delete("disposable secrets for app #{config.app}")
+
+      unbind_missing_app_disposable_policy! if cleanup_state == :own_binding
+      delete_generated_review_secret_resources
+      delete_postgres_helpers
+    end
+
+    def validate_disposable_review_secret_resources!
+      cleanup_state = disposable_review_secret_cleanup_state
+      if cleanup_state == :unsafe
+        raise "Review app secret resources have unexpected ownership, grants, or target; leaving them for inspection."
+      end
+
+      cleanup_state
+    end
+
+    def disposable_review_secret_cleanup_state
+      names = config.disposable_review_secret_resource_names
+      return :none unless names
+
+      secret_name, policy_name = names
+      policy = cp.fetch_policy(policy_name)
+      secret = cp.fetch_secret(secret_name)
+      return :none if policy.nil? && secret.nil?
+
+      classify_disposable_review_secret_resources(policy, secret, secret_name)
+    end
+
+    def classify_disposable_review_secret_resources(policy, secret, secret_name)
+      return generated_review_secret_owned_by_app?(secret, secret_name) ? :safe : :unsafe if policy.nil?
+      return :unsafe unless generated_review_secret_policy?(policy, secret_name)
+      return :unsafe unless generated_review_secret_or_absent?(secret, secret_name)
+      return :safe if unbound_review_policy?(policy)
+
+      only_app_identity_bindings?(policy) ? :own_binding : :unsafe
+    end
+
+    def generated_review_secret_or_absent?(secret, secret_name)
+      secret.nil? || generated_review_secret_owned_by_app?(secret, secret_name)
+    end
+
+    def only_app_identity_bindings?(policy)
+      generated_review_policy_binding_state(policy) == :bound
+    end
+
+    def unbound_review_policy?(policy)
+      generated_review_policy_binding_state(policy) == :unbound
+    end
+
+    def unbind_missing_app_disposable_policy!
+      secret_name, policy_name = config.disposable_review_secret_resource_names
+      policy = cp.fetch_policy(policy_name)
+      return if policy.nil?
+
+      unless generated_review_secret_policy?(policy, secret_name) &&
+             (unbound_review_policy?(policy) || only_app_identity_bindings?(policy))
+        refuse_unsafe_review_secret_resources!
+      end
+
+      remove_missing_app_policy_bindings(policy, policy_name)
+    end
+
+    def remove_missing_app_policy_bindings(policy, policy_name)
+      identity_policy_permissions(policy).each do |permission|
+        step("Unbinding deleted app identity from disposable review app policy") do
+          cp.unbind_identity_from_policy(config.identity_link, policy_name, permission: permission)
+        end
+      end
+    end
+
+    def delete_app_resources
       delete_volumesets
+      # Keep the GVC discoverable by stale-app cleanup if disposable resource deletion fails.
+      # The app identity has already been unbound from its secret policy.
+      delete_generated_review_secret_resources
+      delete_postgres_helpers
       delete_gvc
       delete_images
     end
 
+    def postgres_helpers
+      @postgres_helpers ||= DisposablePostgresHelpers.new(config, cp)
+    end
+
+    def delete_postgres_helpers
+      postgres_helpers.delete do |kind, name, &operation|
+        step("Deleting disposable PostgreSQL #{kind} '#{name}'", &operation)
+      end
+    end
+
     def check_volumesets
       @volumesets = cp.fetch_volumesets["items"]
       return progress.puts("No volumesets to delete from app '#{config.app}'.") unless @volumesets.any?
@@ -103,6 +201,53 @@ module Command
       end
     end
 
+    def delete_generated_review_secret_resources
+      names = config.disposable_review_secret_resource_names
+      return unless names
+
+      secret_name, policy_name = names
+
+      policy = cp.fetch_policy(policy_name)
+      secret = cp.fetch_secret(secret_name)
+      return delete_generated_review_secret_without_policy(secret, secret_name) if policy.nil?
+
+      delete_generated_review_secret_with_policy(policy, secret, secret_name, policy_name)
+    end
+
+    def delete_generated_review_secret_without_policy(secret, secret_name)
+      return if secret.nil?
+
+      refuse_unsafe_review_secret_resources! unless generated_review_secret_owned_by_app?(secret, secret_name)
+
+      step("Deleting orphaned disposable review app secret dictionary") { cp.delete_secret(secret_name) }
+    end
+
+    def delete_generated_review_secret_with_policy(policy, secret, secret_name, policy_name)
+      refuse_unsafe_review_secret_resources! unless disposable_review_secret_policy?(policy, secret_name)
+
+      if secret
+        refuse_unsafe_review_secret_resources! unless generated_review_secret_owned_by_app?(secret, secret_name)
+
+        step("Deleting disposable review app secret dictionary") { cp.delete_secret(secret_name) }
+      end
+      step("Deleting disposable review app secret policy") { cp.delete_policy(policy_name) }
+    end
+
+    def refuse_unsafe_review_secret_resources!
+      raise "Review app secret resources have unexpected ownership, grants, or target; " \
+            "leaving secret resources for inspection."
+    end
+
+    def disposable_review_secret_policy?(policy, secret_name)
+      generated_review_secret_policy?(policy, secret_name) && unbound_review_policy?(policy)
+    end
+
+    def generated_review_secret_policy?(policy, secret_name)
+      policy_targets_secret?(policy, secret_name) &&
+        generated_review_app_tag(policy) == config.app &&
+        %w[target targetQuery gvc].all? { |key| policy[key].nil? }
+    end
+
     def delete_workload(workload)
       step("Deleting workload '#{workload}' from app '#{config.app}'") do
         cp.delete_workload(workload)
@@ -136,10 +281,13 @@ module Command
     end
 
     def secret_policy_unbinds
-      return [] if cp.fetch_identity(config.identity).nil?
+      unless cp.fetch_identity(config.identity)
+        return [disposable_review_secret_policy_unbind(include_current: true)].compact
+      end
 
       [
         app_secret_policy_unbind,
+        disposable_review_secret_policy_unbind,
         *shared_secret_policy_unbinds
       ].compact
     end
@@ -151,6 +299,28 @@ module Command
       )
     end
 
+    def disposable_review_secret_policy_unbind(include_current: false)
+      names = config.disposable_review_secret_resource_names
+      return unless names && (include_current || names.last != config.secrets_policy)
+
+      secret_name, policy_name = names
+      policy = verified_disposable_review_secret_policy(secret_name, policy_name)
+      return unless policy
+
+      policy_unbind_for(policy_name, "Unbinding identity from disposable review app policy '#{policy_name}'", policy)
+    end
+
+    def verified_disposable_review_secret_policy(secret_name, policy_name)
+      secret = cp.fetch_secret(secret_name)
+      return if secret && !generated_review_secret_owned_by_app?(secret, secret_name)
+
+      policy = cp.fetch_policy(policy_name)
+      return unless policy && generated_review_secret_policy?(policy, secret_name) &&
+                    (unbound_review_policy?(policy) || only_app_identity_bindings?(policy))
+
+      policy
+    end
+
     def shared_secret_policy_unbinds
       config.shared_secret_grants.filter_map do |grant|
         shared_secret_policy_unbind(grant)
@@ -190,8 +360,8 @@ module Command
       )
     end
 
-    def policy_unbind_for(policy_name, message)
-      policy = cp.fetch_policy(policy_name)
+    def policy_unbind_for(policy_name, message, policy = nil)
+      policy ||= cp.fetch_policy(policy_name)
       return if policy.nil?
 
       permissions = identity_policy_permissions(policy)

data/lib/command/deploy_image.rb

@@ -145,6 +145,7 @@ module Command
 
     def update_workload_image_ref(workload, container, image)
       attempts = 0
+      mark_deployment_started
 
       loop do
         attempts += 1
@@ -158,6 +159,11 @@ module Command
       end
     end
 
+    def mark_deployment_started
+      marker_path = ENV.fetch("CPFLOW_DEPLOYMENT_STARTED_FILE", "")
+      File.write(marker_path, "started\n") unless marker_path.empty?
+    end
+
     def workload_image_update_limit(output)
       return WORKLOAD_IMAGE_UPDATE_CONFLICT_MAX_ATTEMPTS if output.match?(WORKLOAD_IMAGE_UPDATE_CONFLICT_PATTERN)