@feltdb/core 0.4.12 → 0.4.13

package/dist/create/server-source/crates/feltdb-server/src/releases.rs

@@ -0,0 +1,2563 @@
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use std::{
+    collections::BTreeMap,
+    fs,
+    path::PathBuf,
+    process::{Command, Stdio},
+    sync::{Arc, RwLock},
+    thread,
+    time::Duration,
+    time::{SystemTime, UNIX_EPOCH},
+};
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct CiAttestation {
+    pub provider: String,
+    pub run_id: String,
+    pub commit: String,
+    pub status: String,
+    pub checks: BTreeMap<String, bool>,
+    pub artifacts: BTreeMap<String, String>,
+    pub generated_at: u64,
+}
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ReleaseArtifact {
+    pub name: String,
+    pub artifact_type: String,
+    pub digest: String,
+    pub size: u64,
+}
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ReleaseManifest {
+    pub release_id: String,
+    pub version: String,
+    pub application_id: String,
+    pub revision_id: String,
+    pub bundle_id: String,
+    pub source_commit: String,
+    pub artifacts: Vec<ReleaseArtifact>,
+    pub packages: Vec<ReleaseArtifact>,
+    pub runtime: BTreeMap<String, String>,
+    pub environment: BTreeMap<String, String>,
+    pub parent_release: Option<String>,
+    pub ci_attestation: CiAttestation,
+    pub release_attestation: Option<String>,
+    pub digest: String,
+    pub created_at: u64,
+}
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "SCREAMING_SNAKE_CASE")]
+pub enum ReleaseStatus {
+    Candidate,
+    Verified,
+    Published,
+    Promoted,
+    Revoked,
+}
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Release {
+    pub manifest: ReleaseManifest,
+    pub status: ReleaseStatus,
+    pub created_by: String,
+}
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "SCREAMING_SNAKE_CASE")]
+pub enum DeploymentState {
+    Draft,
+    Validated,
+    Published,
+    Ready,
+    Planned,
+    Approved,
+    Provisioning,
+    Deploying,
+    Starting,
+    HealthChecking,
+    Active,
+    Degraded,
+    Failed,
+    Stopping,
+    RollbackPending,
+    RollingBack,
+    RolledBack,
+    Stopped,
+    Destroying,
+    Destroyed,
+}
+impl Default for DeploymentState {
+    fn default() -> Self {
+        Self::Draft
+    }
+}
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, Default)]
+#[serde(rename_all = "SCREAMING_SNAKE_CASE")]
+pub enum DesiredDeploymentState {
+    #[default]
+    Active,
+    Stopped,
+    Destroyed,
+}
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, Default)]
+#[serde(rename_all = "kebab-case")]
+pub enum DeploymentEnvironment {
+    Local,
+    Preview,
+    Staging,
+    #[default]
+    Production,
+}
+impl DeploymentEnvironment {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Local => "local",
+            Self::Preview => "preview",
+            Self::Staging => "staging",
+            Self::Production => "production",
+        }
+    }
+}
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, Default)]
+#[serde(rename_all = "kebab-case")]
+pub enum DeploymentProviderKind {
+    #[default]
+    Local,
+    Docker,
+    Fly,
+    Render,
+    Vercel,
+}
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, PartialOrd, Ord)]
+#[serde(rename_all = "snake_case")]
+pub enum DeploymentService {
+    Studio,
+    ControlPlane,
+    Worker,
+    ApplicationRuntime,
+    ArtifactStore,
+}
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, Default)]
+#[serde(rename_all = "kebab-case")]
+pub enum DeploymentProfile {
+    #[default]
+    AllInOne,
+    Split,
+    ControlPlaneOnly,
+    WorkerExpansion,
+    StudioOnly,
+    ApplicationOnly,
+    SelfHost,
+}
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct SecretReference {
+    pub name: String,
+    pub provider_reference: String,
+}
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct DomainBinding {
+    pub service: DeploymentService,
+    pub hostname: String,
+}
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ScalingPolicy {
+    pub min_instances: u32,
+    pub max_instances: u32,
+}
+impl Default for ScalingPolicy {
+    fn default() -> Self {
+        Self {
+            min_instances: 1,
+            max_instances: 1,
+        }
+    }
+}
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct ReleasePolicy {
+    pub automatic_rollback: bool,
+    pub require_certification: bool,
+}
+impl Default for ReleasePolicy {
+    fn default() -> Self {
+        Self {
+            automatic_rollback: true,
+            require_certification: true,
+        }
+    }
+}
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct DeploymentHealth {
+    pub runtime_ready: bool,
+    pub application_ready: bool,
+    pub state_store_ready: bool,
+    pub sync_ready: bool,
+    pub workers_ready: bool,
+    pub connections_ready: bool,
+    pub required_capabilities_ready: bool,
+}
+impl DeploymentHealth {
+    pub fn required() -> Self {
+        Self {
+            runtime_ready: true,
+            application_ready: true,
+            state_store_ready: true,
+            sync_ready: true,
+            workers_ready: true,
+            connections_ready: true,
+            required_capabilities_ready: true,
+        }
+    }
+    pub fn healthy(&self) -> bool {
+        self.runtime_ready
+            && self.application_ready
+            && self.state_store_ready
+            && self.sync_ready
+            && self.workers_ready
+            && self.connections_ready
+            && self.required_capabilities_ready
+    }
+}
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DeploymentPlan {
+    pub application_id: String,
+    pub release_id: String,
+    #[serde(default)]
+    pub revision_id: String,
+    pub environment: DeploymentEnvironment,
+    pub workers: Vec<String>,
+    pub connections: Vec<String>,
+    pub required_secrets: Vec<String>,
+    pub artifacts: Vec<String>,
+    pub rollback_target: Option<String>,
+    pub health_requirements: DeploymentHealth,
+    #[serde(default)]
+    pub provider: DeploymentProviderKind,
+    #[serde(default)]
+    pub profile: DeploymentProfile,
+    #[serde(default)]
+    pub services: Vec<DeploymentService>,
+    #[serde(default)]
+    pub domains: Vec<DomainBinding>,
+    #[serde(default)]
+    pub configuration: BTreeMap<String, String>,
+    #[serde(default)]
+    pub secret_references: Vec<SecretReference>,
+    #[serde(default)]
+    pub scaling_policy: ScalingPolicy,
+    #[serde(default)]
+    pub release_policy: ReleasePolicy,
+    #[serde(default)]
+    pub dependencies: BTreeMap<DeploymentService, Vec<DeploymentService>>,
+}
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Deployment {
+    pub deployment_id: String,
+    pub plan: DeploymentPlan,
+    pub state: DeploymentState,
+    pub health: DeploymentHealth,
+    pub created_at: u64,
+    pub updated_at: u64,
+    #[serde(default)]
+    pub observed: ProviderObservation,
+    #[serde(default)]
+    pub previous_known_good_release: Option<String>,
+    #[serde(default)]
+    pub desired_state: DesiredDeploymentState,
+    #[serde(default)]
+    pub failure: Option<String>,
+}
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct ProviderObservation {
+    pub services: BTreeMap<DeploymentService, String>,
+    pub endpoints: BTreeMap<DeploymentService, String>,
+    pub provider_deployment_id: Option<String>,
+    pub observed_at: u64,
+}
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DeploymentCertification {
+    pub valid: bool,
+    pub release_verified: bool,
+    pub provider_valid: bool,
+    pub secrets_are_references: bool,
+    pub health_contract_present: bool,
+    pub diagnostics: Vec<String>,
+}
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct AuthorizedDeploymentContext {
+    pub tenant_id: String,
+    pub application_id: String,
+    pub environment: DeploymentEnvironment,
+    pub release_id: String,
+    pub revision_id: String,
+    pub deployment_id: String,
+    pub desired_state: DesiredDeploymentState,
+    pub actor: String,
+    pub capabilities: Vec<String>,
+    pub expires_at: u64,
+    #[serde(default)]
+    pub credential_versions: BTreeMap<String, u64>,
+    #[serde(skip)]
+    pub credentials: BTreeMap<String, String>,
+}
+impl AuthorizedDeploymentContext {
+    fn system(plan: &DeploymentPlan, deployment_id: &str) -> Self {
+        Self {
+            tenant_id: "system".into(),
+            application_id: plan.application_id.clone(),
+            environment: plan.environment,
+            release_id: plan.release_id.clone(),
+            revision_id: plan.revision_id.clone(),
+            deployment_id: deployment_id.into(),
+            desired_state: DesiredDeploymentState::Active,
+            actor: "system".into(),
+            capabilities: vec!["deployment:execute".into()],
+            expires_at: now() + 300,
+            credential_versions: BTreeMap::new(),
+            credentials: BTreeMap::new(),
+        }
+    }
+    pub fn new(
+        tenant_id: String,
+        plan: &DeploymentPlan,
+        deployment_id: String,
+        actor: String,
+        credentials: BTreeMap<String, String>,
+        credential_versions: BTreeMap<String, u64>,
+    ) -> Self {
+        Self {
+            tenant_id,
+            application_id: plan.application_id.clone(),
+            environment: plan.environment,
+            release_id: plan.release_id.clone(),
+            revision_id: plan.revision_id.clone(),
+            deployment_id,
+            desired_state: DesiredDeploymentState::Active,
+            actor,
+            capabilities: vec!["deployment:execute".into()],
+            expires_at: now() + 300,
+            credential_versions,
+            credentials,
+        }
+    }
+    pub fn authorize(&self, plan: &DeploymentPlan) -> Result<(), String> {
+        if self.expires_at <= now() {
+            return Err("deployment execution context expired".into());
+        }
+        if self.application_id != plan.application_id
+            || self.release_id != plan.release_id
+            || self.revision_id != plan.revision_id
+            || self.environment != plan.environment
+        {
+            return Err("deployment execution context scope mismatch".into());
+        }
+        if !self
+            .capabilities
+            .iter()
+            .any(|value| value == "deployment:execute" || value == "*")
+        {
+            return Err("deployment:execute capability required".into());
+        }
+        Ok(())
+    }
+}
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DeploymentOperationAudit {
+    pub provider: DeploymentProviderKind,
+    pub deployment_id: String,
+    pub secret_references: Vec<String>,
+    pub credential_versions: BTreeMap<String, u64>,
+    pub operation: String,
+    pub actor: String,
+    pub timestamp: u64,
+    pub result: String,
+}
+pub trait DeploymentProvider: Send + Sync {
+    fn kind(&self) -> DeploymentProviderKind;
+    fn validate(&self, plan: &DeploymentPlan) -> Result<(), String> {
+        if plan.services.is_empty() {
+            return Err("deployment must select at least one service".into());
+        }
+        if self.kind() == DeploymentProviderKind::Vercel
+            && plan
+                .services
+                .iter()
+                .any(|service| *service != DeploymentService::Studio)
+        {
+            return Err("Vercel provider supports the Studio service only".into());
+        }
+        if plan.scaling_policy.min_instances > plan.scaling_policy.max_instances {
+            return Err("minimum instances cannot exceed maximum instances".into());
+        }
+        let requires_control_plane = plan.services.iter().any(|service| {
+            matches!(
+                service,
+                DeploymentService::Studio
+                    | DeploymentService::Worker
+                    | DeploymentService::ApplicationRuntime
+            )
+        });
+        if requires_control_plane
+            && !plan.services.contains(&DeploymentService::ControlPlane)
+            && !plan.configuration.contains_key("control_plane.url")
+        {
+            return Err("independent service deployment requires control_plane.url".into());
+        }
+        Ok(())
+    }
+    fn provision(&self, _: &AuthorizedDeploymentContext, _: &DeploymentPlan) -> Result<(), String>;
+    fn configure(
+        &self,
+        context: &AuthorizedDeploymentContext,
+        plan: &DeploymentPlan,
+    ) -> Result<(), String> {
+        context.authorize(plan)
+    }
+    fn deploy(
+        &self,
+        _: &AuthorizedDeploymentContext,
+        _: &DeploymentPlan,
+        _: &ReleaseManifest,
+    ) -> Result<(), String>;
+    fn status(
+        &self,
+        _: &AuthorizedDeploymentContext,
+        _: &DeploymentPlan,
+    ) -> Result<ProviderObservation, String> {
+        Ok(ProviderObservation::default())
+    }
+    fn health(
+        &self,
+        _: &AuthorizedDeploymentContext,
+        _: &DeploymentPlan,
+    ) -> Result<DeploymentHealth, String>;
+    fn scale(
+        &self,
+        _: &AuthorizedDeploymentContext,
+        _: &DeploymentPlan,
+        _: &ScalingPolicy,
+    ) -> Result<(), String> {
+        Ok(())
+    }
+    fn stop(&self, _: &AuthorizedDeploymentContext, _: &DeploymentPlan) -> Result<(), String>;
+    fn restart(&self, _: &AuthorizedDeploymentContext, _: &DeploymentPlan) -> Result<(), String> {
+        Ok(())
+    }
+    fn rollback(
+        &self,
+        _: &AuthorizedDeploymentContext,
+        _: &DeploymentPlan,
+        _: &ReleaseManifest,
+    ) -> Result<(), String>;
+    fn destroy(&self, _: &AuthorizedDeploymentContext, _: &DeploymentPlan) -> Result<(), String> {
+        Ok(())
+    }
+}
+#[derive(Default)]
+pub struct LocalDeploymentProvider;
+fn configured<'a>(plan: &'a DeploymentPlan, key: &str) -> Result<&'a str, String> {
+    plan.configuration
+        .get(key)
+        .map(String::as_str)
+        .ok_or_else(|| format!("missing deployment configuration: {key}"))
+}
+fn state_file(context: &AuthorizedDeploymentContext, suffix: &str) -> PathBuf {
+    let root = std::env::var("FELTDB_DEPLOYMENT_STATE_DIR")
+        .map(PathBuf::from)
+        .unwrap_or_else(|_| std::env::temp_dir().join("feltdb-deployments"));
+    root.join(format!(
+        "{}-{suffix}",
+        context.deployment_id.replace(['/', ':'], "_")
+    ))
+}
+fn execute_command(
+    context: &AuthorizedDeploymentContext,
+    program: &str,
+    args: &[String],
+) -> Result<String, String> {
+    let mut command = Command::new(program);
+    command.args(args);
+    for (name, value) in &context.credentials {
+        command.env(name, value);
+    }
+    let output = command
+        .output()
+        .map_err(|error| format!("unable to execute {program}: {error}"))?;
+    if !output.status.success() {
+        return Err(format!(
+            "{program} failed: {}",
+            String::from_utf8_lossy(&output.stderr).trim()
+        ));
+    }
+    Ok(String::from_utf8_lossy(&output.stdout).trim().into())
+}
+fn process_alive(pid: u32) -> bool {
+    Command::new("kill")
+        .args(["-0", &pid.to_string()])
+        .stdout(Stdio::null())
+        .stderr(Stdio::null())
+        .status()
+        .map(|status| status.success())
+        .unwrap_or(false)
+}
+fn endpoint_health(
+    context: &AuthorizedDeploymentContext,
+    plan: &DeploymentPlan,
+) -> Result<(), String> {
+    let url = plan
+        .configuration
+        .get("health.url")
+        .cloned()
+        .or_else(|| {
+            plan.domains
+                .first()
+                .map(|domain| format!("https://{}/ready", domain.hostname))
+        })
+        .ok_or("health.url or a domain binding is required")?;
+    let mut request = reqwest::blocking::Client::builder()
+        .timeout(Duration::from_secs(10))
+        .build()
+        .map_err(|error| error.to_string())?
+        .get(url);
+    if let Some(name) = plan.configuration.get("health.bearer_secret") {
+        let token = context
+            .credentials
+            .get(name)
+            .ok_or("health bearer credential unavailable")?;
+        request = request.bearer_auth(token);
+    }
+    let retries = plan
+        .configuration
+        .get("health.retries")
+        .and_then(|value| value.parse::<u32>().ok())
+        .unwrap_or(10);
+    let interval = plan
+        .configuration
+        .get("health.interval_ms")
+        .and_then(|value| value.parse::<u64>().ok())
+        .unwrap_or(500);
+    let mut last_error = "health endpoint was not attempted".to_string();
+    for _ in 0..retries.max(1) {
+        match request
+            .try_clone()
+            .ok_or("health request cannot be retried")?
+            .send()
+        {
+            Ok(response) if response.status().is_success() => return Ok(()),
+            Ok(response) => last_error = format!("health endpoint returned {}", response.status()),
+            Err(error) => last_error = format!("health request failed: {error}"),
+        }
+        thread::sleep(Duration::from_millis(interval));
+    }
+    Err(last_error)
+}
+fn start_local(context: &AuthorizedDeploymentContext, plan: &DeploymentPlan) -> Result<(), String> {
+    let program = configured(plan, "local.command")?;
+    let args: Vec<_> = plan
+        .configuration
+        .get("local.args")
+        .map(|value| value.split_whitespace().map(String::from).collect())
+        .unwrap_or_default();
+    let mut command = Command::new(program);
+    command
+        .args(args)
+        .stdout(Stdio::null())
+        .stderr(Stdio::null());
+    for (name, value) in &context.credentials {
+        command.env(name, value);
+    }
+    let mut child = command
+        .spawn()
+        .map_err(|error| format!("unable to start local deployment: {error}"))?;
+    thread::sleep(Duration::from_millis(100));
+    if let Some(status) = child.try_wait().map_err(|error| error.to_string())? {
+        return Err(format!("local deployment exited during startup: {status}"));
+    }
+    let path = state_file(context, "pid");
+    if let Some(parent) = path.parent() {
+        fs::create_dir_all(parent).map_err(|error| error.to_string())?;
+    }
+    fs::write(path, child.id().to_string()).map_err(|error| error.to_string())
+}
+impl DeploymentProvider for LocalDeploymentProvider {
+    fn kind(&self) -> DeploymentProviderKind {
+        DeploymentProviderKind::Local
+    }
+    fn validate(&self, plan: &DeploymentPlan) -> Result<(), String> {
+        configured(plan, "local.command")?;
+        if !plan.configuration.contains_key("health.url")
+            && !plan.configuration.contains_key("health.command")
+            && plan.domains.is_empty()
+        {
+            return Err("local deployment requires health.url or a domain binding".into());
+        }
+        Ok(())
+    }
+    fn provision(
+        &self,
+        context: &AuthorizedDeploymentContext,
+        plan: &DeploymentPlan,
+    ) -> Result<(), String> {
+        context.authorize(plan)?;
+        if context.actor != "system"
+            && std::env::var("FELTDB_ALLOW_LOCAL_DEPLOYMENTS").as_deref() != Ok("true")
+        {
+            return Err("local process deployments are disabled on this control plane".into());
+        }
+        configured(plan, "local.command")?;
+        Ok(())
+    }
+    fn deploy(
+        &self,
+        context: &AuthorizedDeploymentContext,
+        plan: &DeploymentPlan,
+        _release: &ReleaseManifest,
+    ) -> Result<(), String> {
+        context.authorize(plan)?;
+        start_local(context, plan)
+    }
+    fn health(
+        &self,
+        context: &AuthorizedDeploymentContext,
+        plan: &DeploymentPlan,
+    ) -> Result<DeploymentHealth, String> {
+        context.authorize(plan)?;
+        if plan.configuration.contains_key("health.url") || !plan.domains.is_empty() {
+            endpoint_health(context, plan)?;
+        } else if let Some(command) = plan.configuration.get("health.command") {
+            execute_command(context, command, &[])?;
+        }
+        let pid: u32 = fs::read_to_string(state_file(context, "pid"))
+            .map_err(|_| "local deployment pid unavailable")?
+            .parse()
+            .map_err(|_| "invalid local deployment pid")?;
+        if !process_alive(pid) {
+            return Err("local deployment is not running".into());
+        }
+        Ok(DeploymentHealth::required())
+    }
+    fn status(
+        &self,
+        context: &AuthorizedDeploymentContext,
+        plan: &DeploymentPlan,
+    ) -> Result<ProviderObservation, String> {
+        let pid: u32 = fs::read_to_string(state_file(context, "pid"))
+            .map_err(|_| "local deployment pid unavailable")?
+            .parse()
+            .map_err(|_| "invalid local deployment pid")?;
+        let mut services = BTreeMap::new();
+        for service in &plan.services {
+            services.insert(
+                *service,
+                if process_alive(pid) {
+                    "running".into()
+                } else {
+                    "missing".into()
+                },
+            );
+        }
+        Ok(ProviderObservation {
+            services,
+            endpoints: BTreeMap::new(),
+            provider_deployment_id: Some(pid.to_string()),
+            observed_at: now(),
+        })
+    }
+    fn stop(
+        &self,
+        context: &AuthorizedDeploymentContext,
+        plan: &DeploymentPlan,
+    ) -> Result<(), String> {
+        context.authorize(plan)?;
+        if let Ok(pid) = fs::read_to_string(state_file(context, "pid")) {
+            let _ = execute_command(context, "kill", &[pid.trim().into()]);
+        }
+        Ok(())
+    }
+    fn restart(
+        &self,
+        context: &AuthorizedDeploymentContext,
+        plan: &DeploymentPlan,
+    ) -> Result<(), String> {
+        self.stop(context, plan)?;
+        start_local(context, plan)
+    }
+    fn rollback(
+        &self,
+        context: &AuthorizedDeploymentContext,
+        plan: &DeploymentPlan,
+        release: &ReleaseManifest,
+    ) -> Result<(), String> {
+        self.stop(context, plan)?;
+        self.deploy(context, plan, release)
+    }
+    fn destroy(
+        &self,
+        context: &AuthorizedDeploymentContext,
+        plan: &DeploymentPlan,
+    ) -> Result<(), String> {
+        self.stop(context, plan)?;
+        let _ = fs::remove_file(state_file(context, "pid"));
+        Ok(())
+    }
+}
+
+/// Executable infrastructure adapters behind the provider-neutral Rust contract.
+/// Credentials exist only in the short-lived authorized execution context.
+pub struct DeclarativeDeploymentProvider(pub DeploymentProviderKind);
+impl DeploymentProvider for DeclarativeDeploymentProvider {
+    fn kind(&self) -> DeploymentProviderKind {
+        self.0
+    }
+    fn validate(&self, plan: &DeploymentPlan) -> Result<(), String> {
+        if plan.services.is_empty() {
+            return Err("deployment must select at least one service".into());
+        }
+        match self.0 {
+            DeploymentProviderKind::Docker => {
+                configured(plan, "image")?;
+            }
+            DeploymentProviderKind::Fly => {
+                configured(plan, "fly.app")?;
+                configured(plan, "image")?;
+            }
+            DeploymentProviderKind::Render => {
+                if !plan.configuration.contains_key("render.service_id")
+                    && !plan.configuration.contains_key("render.create_payload")
+                {
+                    return Err("Render requires render.service_id or render.create_payload".into());
+                }
+            }
+            DeploymentProviderKind::Vercel => {
+                if plan
+                    .services
+                    .iter()
+                    .any(|service| *service != DeploymentService::Studio)
+                {
+                    return Err("Vercel provider supports the Studio service only".into());
+                }
+                configured(plan, "vercel.project")?;
+            }
+            DeploymentProviderKind::Local => {}
+        }
+        if !plan.configuration.contains_key("health.url") && plan.domains.is_empty() {
+            return Err("deployment requires health.url or a domain binding".into());
+        }
+        if plan.scaling_policy.min_instances > plan.scaling_policy.max_instances {
+            return Err("minimum instances cannot exceed maximum instances".into());
+        }
+        let requires_control_plane = plan.services.iter().any(|service| {
+            matches!(
+                service,
+                DeploymentService::Studio
+                    | DeploymentService::Worker
+                    | DeploymentService::ApplicationRuntime
+            )
+        });
+        if requires_control_plane
+            && !plan.services.contains(&DeploymentService::ControlPlane)
+            && !plan.configuration.contains_key("control_plane.url")
+        {
+            return Err("independent service deployment requires control_plane.url".into());
+        }
+        Ok(())
+    }
+    fn provision(
+        &self,
+        context: &AuthorizedDeploymentContext,
+        plan: &DeploymentPlan,
+    ) -> Result<(), String> {
+        context.authorize(plan)?;
+        match self.0 {
+            DeploymentProviderKind::Docker => {
+                if context.actor != "system"
+                    && std::env::var("FELTDB_ALLOW_LOCAL_DEPLOYMENTS").as_deref() != Ok("true")
+                {
+                    return Err("Docker deployments are disabled on this control plane".into());
+                }
+                let image = configured(plan, "image")?.to_string();
+                if execute_command(
+                    context,
+                    "docker",
+                    &["image".into(), "inspect".into(), image.clone()],
+                )
+                .is_err()
+                {
+                    let build_context = configured(plan, "docker.context")?.to_string();
+                    execute_command(
+                        context,
+                        "docker",
+                        &["build".into(), "-t".into(), image, build_context],
+                    )?;
+                }
+            }
+            DeploymentProviderKind::Fly => {
+                if !context.credentials.contains_key("FLY_API_TOKEN") {
+                    return Err("FLY_API_TOKEN credential unavailable".into());
+                }
+                let app = configured(plan, "fly.app")?.to_string();
+                let result = execute_command(
+                    context,
+                    "flyctl",
+                    &["apps".into(), "create".into(), app, "--json".into()],
+                );
+                if let Err(error) = result {
+                    if !error.contains("already exists") {
+                        return Err(error);
+                    }
+                }
+            }
+            DeploymentProviderKind::Render => {
+                let payload = plan
+                    .configuration
+                    .get("render.create_payload")
+                    .or_else(|| plan.configuration.get("render.update_payload"));
+                if let Some(payload) = payload {
+                    let body: serde_json::Value = serde_json::from_str(payload)
+                        .map_err(|error| format!("invalid Render service payload: {error}"))?;
+                    if plan.configuration.contains_key("render.service_id") {
+                        render_request(context, plan, "PATCH", "", Some(body))?;
+                    } else {
+                        let base = plan
+                            .configuration
+                            .get("render.api_base")
+                            .map(String::as_str)
+                            .unwrap_or("https://api.render.com/v1");
+                        let response =
+                            render_http(context, "POST", &format!("{base}/services"), Some(body))?;
+                        let id = response
+                            .get("id")
+                            .or_else(|| response.pointer("/service/id"))
+                            .and_then(|value| value.as_str())
+                            .ok_or("Render create response omitted service id")?;
+                        let path = state_file(context, "render-service");
+                        if let Some(parent) = path.parent() {
+                            fs::create_dir_all(parent).map_err(|error| error.to_string())?;
+                        }
+                        fs::write(path, id).map_err(|error| error.to_string())?;
+                    }
+                }
+            }
+            DeploymentProviderKind::Vercel => {}
+            DeploymentProviderKind::Local => return Err("invalid local provider adapter".into()),
+        }
+        Ok(())
+    }
+    fn deploy(
+        &self,
+        context: &AuthorizedDeploymentContext,
+        plan: &DeploymentPlan,
+        release: &ReleaseManifest,
+    ) -> Result<(), String> {
+        context.authorize(plan)?;
+        match self.0 {
+            DeploymentProviderKind::Docker => {
+                let name = plan
+                    .configuration
+                    .get("docker.name")
+                    .cloned()
+                    .unwrap_or_else(|| context.deployment_id.replace(['/', ':'], "-"));
+                let _ =
+                    execute_command(context, "docker", &["rm".into(), "-f".into(), name.clone()]);
+                let mut args = vec!["run".into(), "-d".into(), "--name".into(), name];
+                if let Some(ports) = plan.configuration.get("docker.ports") {
+                    for port in ports.split(',') {
+                        args.extend(["-p".into(), port.trim().into()]);
+                    }
+                }
+                if let Some(volumes) = plan.configuration.get("docker.volumes") {
+                    for volume in volumes.split(',').filter(|value| !value.trim().is_empty()) {
+                        args.extend(["--volume".into(), volume.trim().into()]);
+                    }
+                }
+                for name in context.credentials.keys() {
+                    args.extend(["--env".into(), name.clone()]);
+                }
+                args.push(
+                    release
+                        .runtime
+                        .get("image")
+                        .cloned()
+                        .unwrap_or(configured(plan, "image")?.into()),
+                );
+                execute_command(context, "docker", &args)?;
+            }
+            DeploymentProviderKind::Fly => {
+                execute_command(
+                    context,
+                    "flyctl",
+                    &[
+                        "deploy".into(),
+                        "--app".into(),
+                        configured(plan, "fly.app")?.into(),
+                        "--image".into(),
+                        release
+                            .runtime
+                            .get("image")
+                            .cloned()
+                            .unwrap_or(configured(plan, "image")?.into()),
+                        "--remote-only".into(),
+                    ],
+                )?;
+            }
+            DeploymentProviderKind::Render => {
+                render_request(
+                    context,
+                    plan,
+                    "POST",
+                    "deploys",
+                    Some(serde_json::json!({"clearCache":"do_not_clear"})),
+                )?;
+            }
+            DeploymentProviderKind::Vercel => {
+                if !context.credentials.contains_key("VERCEL_TOKEN") {
+                    return Err("VERCEL_TOKEN credential unavailable".into());
+                }
+                let mut args = vec![
+                    "deploy".into(),
+                    "--yes".into(),
+                    "--prod".into(),
+                    "--name".into(),
+                    configured(plan, "vercel.project")?.into(),
+                ];
+                if let Some(path) = release
+                    .runtime
+                    .get("vercel.path")
+                    .or_else(|| plan.configuration.get("vercel.path"))
+                {
+                    args.push(path.clone());
+                }
+                let deployment = execute_command(context, "vercel", &args)?;
+                let path = state_file(context, "vercel-deployment");
+                if let Some(parent) = path.parent() {
+                    fs::create_dir_all(parent).map_err(|error| error.to_string())?;
+                }
+                fs::write(path, deployment).map_err(|error| error.to_string())?;
+            }
+            DeploymentProviderKind::Local => return Err("invalid local provider adapter".into()),
+        }
+        Ok(())
+    }
+    fn health(
+        &self,
+        context: &AuthorizedDeploymentContext,
+        plan: &DeploymentPlan,
+    ) -> Result<DeploymentHealth, String> {
+        endpoint_health(context, plan)?;
+        Ok(DeploymentHealth::required())
+    }
+    fn status(
+        &self,
+        context: &AuthorizedDeploymentContext,
+        plan: &DeploymentPlan,
+    ) -> Result<ProviderObservation, String> {
+        context.authorize(plan)?;
+        let provider_deployment_id = match self.0 {
+            DeploymentProviderKind::Docker => Some(execute_command(
+                context,
+                "docker",
+                &[
+                    "inspect".into(),
+                    "--format".into(),
+                    "{{.State.Status}}".into(),
+                    plan.configuration
+                        .get("docker.name")
+                        .cloned()
+                        .unwrap_or_else(|| context.deployment_id.replace(['/', ':'], "-")),
+                ],
+            )?),
+            DeploymentProviderKind::Fly => Some(execute_command(
+                context,
+                "flyctl",
+                &[
+                    "status".into(),
+                    "--app".into(),
+                    configured(plan, "fly.app")?.into(),
+                    "--json".into(),
+                ],
+            )?),
+            DeploymentProviderKind::Render => {
+                Some(render_request(context, plan, "GET", "", None)?.to_string())
+            }
+            DeploymentProviderKind::Vercel => {
+                let deployment = fs::read_to_string(state_file(context, "vercel-deployment"))
+                    .map_err(|_| "Vercel deployment identifier unavailable")?;
+                Some(execute_command(
+                    context,
+                    "vercel",
+                    &["inspect".into(), deployment.trim().into()],
+                )?)
+            }
+            DeploymentProviderKind::Local => None,
+        };
+        let services = plan
+            .services
+            .iter()
+            .map(|service| (*service, "ready".into()))
+            .collect();
+        let endpoints = plan
+            .domains
+            .iter()
+            .map(|domain| (domain.service, format!("https://{}", domain.hostname)))
+            .collect();
+        Ok(ProviderObservation {
+            services,
+            endpoints,
+            provider_deployment_id,
+            observed_at: now(),
+        })
+    }
+    fn scale(
+        &self,
+        context: &AuthorizedDeploymentContext,
+        plan: &DeploymentPlan,
+        policy: &ScalingPolicy,
+    ) -> Result<(), String> {
+        match self.0 {
+            DeploymentProviderKind::Docker if policy.max_instances > 1 => {
+                Err("Docker reference provider supports one instance per deployment".into())
+            }
+            DeploymentProviderKind::Docker => Ok(()),
+            DeploymentProviderKind::Fly => {
+                execute_command(
+                    context,
+                    "flyctl",
+                    &[
+                        "scale".into(),
+                        "count".into(),
+                        policy.min_instances.to_string(),
+                        "--app".into(),
+                        configured(plan, "fly.app")?.into(),
+                        "--yes".into(),
+                    ],
+                )?;
+                Ok(())
+            }
+            DeploymentProviderKind::Render => {
+                render_request(
+                    context,
+                    plan,
+                    "PATCH",
+                    "",
+                    Some(serde_json::json!({"numInstances":policy.min_instances})),
+                )?;
+                Ok(())
+            }
+            DeploymentProviderKind::Vercel
+                if policy.min_instances == 1 && policy.max_instances == 1 =>
+            {
+                Ok(())
+            }
+            DeploymentProviderKind::Vercel => Err("Vercel scaling is platform-managed".into()),
+            DeploymentProviderKind::Local => Ok(()),
+        }
+    }
+    fn stop(
+        &self,
+        context: &AuthorizedDeploymentContext,
+        plan: &DeploymentPlan,
+    ) -> Result<(), String> {
+        match self.0 {
+            DeploymentProviderKind::Docker => {
+                execute_command(
+                    context,
+                    "docker",
+                    &[
+                        "stop".into(),
+                        plan.configuration
+                            .get("docker.name")
+                            .cloned()
+                            .unwrap_or_else(|| context.deployment_id.replace(['/', ':'], "-")),
+                    ],
+                )?;
+            }
+            DeploymentProviderKind::Fly => {
+                execute_command(
+                    context,
+                    "flyctl",
+                    &[
+                        "scale".into(),
+                        "count".into(),
+                        "0".into(),
+                        "--app".into(),
+                        configured(plan, "fly.app")?.into(),
+                        "--yes".into(),
+                    ],
+                )?;
+            }
+            DeploymentProviderKind::Render => {
+                render_request(context, plan, "POST", "suspend", None)?;
+            }
+            DeploymentProviderKind::Vercel => {
+                let deployment = fs::read_to_string(state_file(context, "vercel-deployment"))
+                    .map_err(|_| "Vercel deployment identifier unavailable")?;
+                execute_command(
+                    context,
+                    "vercel",
+                    &["remove".into(), deployment.trim().into(), "--yes".into()],
+                )?;
+            }
+            DeploymentProviderKind::Local => {}
+        }
+        Ok(())
+    }
+    fn restart(
+        &self,
+        context: &AuthorizedDeploymentContext,
+        plan: &DeploymentPlan,
+    ) -> Result<(), String> {
+        match self.0 {
+            DeploymentProviderKind::Docker => {
+                execute_command(
+                    context,
+                    "docker",
+                    &[
+                        "restart".into(),
+                        plan.configuration
+                            .get("docker.name")
+                            .cloned()
+                            .unwrap_or_else(|| context.deployment_id.replace(['/', ':'], "-")),
+                    ],
+                )?;
+            }
+            DeploymentProviderKind::Fly => {
+                execute_command(
+                    context,
+                    "flyctl",
+                    &[
+                        "apps".into(),
+                        "restart".into(),
+                        configured(plan, "fly.app")?.into(),
+                    ],
+                )?;
+            }
+            DeploymentProviderKind::Render => {
+                render_request(context, plan, "POST", "restart", None)?;
+            }
+            DeploymentProviderKind::Vercel => {
+                let deployment = fs::read_to_string(state_file(context, "vercel-deployment"))
+                    .map_err(|_| "Vercel deployment identifier unavailable")?;
+                let next = execute_command(
+                    context,
+                    "vercel",
+                    &[
+                        "redeploy".into(),
+                        deployment.trim().into(),
+                        "--target".into(),
+                        "production".into(),
+                    ],
+                )?;
+                fs::write(state_file(context, "vercel-deployment"), next)
+                    .map_err(|error| error.to_string())?;
+            }
+            DeploymentProviderKind::Local => {}
+        }
+        Ok(())
+    }
+    fn rollback(
+        &self,
+        context: &AuthorizedDeploymentContext,
+        plan: &DeploymentPlan,
+        release: &ReleaseManifest,
+    ) -> Result<(), String> {
+        if self.0 == DeploymentProviderKind::Render {
+            let deploy_id = release
+                .runtime
+                .get("render.deploy_id")
+                .ok_or("rollback release lacks render.deploy_id")?;
+            render_request(
+                context,
+                plan,
+                "POST",
+                "rollback",
+                Some(serde_json::json!({"deployId":deploy_id})),
+            )?;
+            Ok(())
+        } else {
+            self.deploy(context, plan, release)
+        }
+    }
+    fn destroy(
+        &self,
+        context: &AuthorizedDeploymentContext,
+        plan: &DeploymentPlan,
+    ) -> Result<(), String> {
+        match self.0 {
+            DeploymentProviderKind::Docker => {
+                let _ = execute_command(
+                    context,
+                    "docker",
+                    &[
+                        "rm".into(),
+                        "-f".into(),
+                        plan.configuration
+                            .get("docker.name")
+                            .cloned()
+                            .unwrap_or_else(|| context.deployment_id.replace(['/', ':'], "-")),
+                    ],
+                );
+            }
+            DeploymentProviderKind::Fly => {
+                execute_command(
+                    context,
+                    "flyctl",
+                    &[
+                        "apps".into(),
+                        "destroy".into(),
+                        configured(plan, "fly.app")?.into(),
+                        "--yes".into(),
+                    ],
+                )?;
+            }
+            DeploymentProviderKind::Render => {
+                render_request(context, plan, "DELETE", "", None)?;
+            }
+            DeploymentProviderKind::Vercel => {
+                let deployment = fs::read_to_string(state_file(context, "vercel-deployment"))
+                    .map_err(|_| "Vercel deployment identifier unavailable")?;
+                execute_command(
+                    context,
+                    "vercel",
+                    &["remove".into(), deployment.trim().into(), "--yes".into()],
+                )?;
+                let _ = fs::remove_file(state_file(context, "vercel-deployment"));
+            }
+            DeploymentProviderKind::Local => {}
+        }
+        Ok(())
+    }
+}
+
+fn render_request(
+    context: &AuthorizedDeploymentContext,
+    plan: &DeploymentPlan,
+    method: &str,
+    suffix: &str,
+    body: Option<serde_json::Value>,
+) -> Result<serde_json::Value, String> {
+    let service = plan
+        .configuration
+        .get("render.service_id")
+        .cloned()
+        .or_else(|| fs::read_to_string(state_file(context, "render-service")).ok())
+        .ok_or("Render service id unavailable")?;
+    let base = plan
+        .configuration
+        .get("render.api_base")
+        .map(String::as_str)
+        .unwrap_or("https://api.render.com/v1");
+    let url = format!(
+        "{base}/services/{service}{}",
+        if suffix.is_empty() {
+            String::new()
+        } else {
+            format!("/{suffix}")
+        }
+    );
+    render_http(context, method, &url, body)
+}
+fn render_http(
+    context: &AuthorizedDeploymentContext,
+    method: &str,
+    url: &str,
+    body: Option<serde_json::Value>,
+) -> Result<serde_json::Value, String> {
+    let token = context
+        .credentials
+        .get("RENDER_API_KEY")
+        .ok_or("RENDER_API_KEY credential unavailable")?;
+    let client = reqwest::blocking::Client::builder()
+        .timeout(Duration::from_secs(30))
+        .build()
+        .map_err(|error| error.to_string())?;
+    let mut request = match method {
+        "POST" => client.post(url),
+        "PATCH" => client.patch(url),
+        "DELETE" => client.delete(url),
+        _ => client.get(url),
+    }
+    .bearer_auth(token)
+    .header("accept", "application/json");
+    if let Some(body) = body {
+        request = request.json(&body);
+    }
+    let response = request
+        .send()
+        .map_err(|error| format!("Render API request failed: {error}"))?;
+    let status = response.status();
+    let bytes = response.bytes().map_err(|error| error.to_string())?;
+    if !status.is_success() {
+        return Err(format!(
+            "Render API returned {status}: {}",
+            String::from_utf8_lossy(&bytes)
+        ));
+    }
+    if bytes.is_empty() {
+        return Ok(serde_json::json!({"status":status.as_u16()}));
+    }
+    serde_json::from_slice(&bytes).map_err(|error| error.to_string())
+}
+
+macro_rules! declarative_provider {
+    ($name:ident, $kind:expr) => {
+        pub struct $name;
+        impl DeploymentProvider for $name {
+            fn kind(&self) -> DeploymentProviderKind {
+                $kind
+            }
+            fn provision(
+                &self,
+                context: &AuthorizedDeploymentContext,
+                plan: &DeploymentPlan,
+            ) -> Result<(), String> {
+                DeclarativeDeploymentProvider($kind).provision(context, plan)
+            }
+            fn configure(
+                &self,
+                context: &AuthorizedDeploymentContext,
+                plan: &DeploymentPlan,
+            ) -> Result<(), String> {
+                DeclarativeDeploymentProvider($kind).configure(context, plan)
+            }
+            fn deploy(
+                &self,
+                context: &AuthorizedDeploymentContext,
+                plan: &DeploymentPlan,
+                release: &ReleaseManifest,
+            ) -> Result<(), String> {
+                DeclarativeDeploymentProvider($kind).deploy(context, plan, release)
+            }
+            fn status(
+                &self,
+                context: &AuthorizedDeploymentContext,
+                plan: &DeploymentPlan,
+            ) -> Result<ProviderObservation, String> {
+                DeclarativeDeploymentProvider($kind).status(context, plan)
+            }
+            fn health(
+                &self,
+                context: &AuthorizedDeploymentContext,
+                plan: &DeploymentPlan,
+            ) -> Result<DeploymentHealth, String> {
+                DeclarativeDeploymentProvider($kind).health(context, plan)
+            }
+            fn scale(
+                &self,
+                context: &AuthorizedDeploymentContext,
+                plan: &DeploymentPlan,
+                policy: &ScalingPolicy,
+            ) -> Result<(), String> {
+                DeclarativeDeploymentProvider($kind).scale(context, plan, policy)
+            }
+            fn stop(
+                &self,
+                context: &AuthorizedDeploymentContext,
+                plan: &DeploymentPlan,
+            ) -> Result<(), String> {
+                DeclarativeDeploymentProvider($kind).stop(context, plan)
+            }
+            fn restart(
+                &self,
+                context: &AuthorizedDeploymentContext,
+                plan: &DeploymentPlan,
+            ) -> Result<(), String> {
+                DeclarativeDeploymentProvider($kind).restart(context, plan)
+            }
+            fn rollback(
+                &self,
+                context: &AuthorizedDeploymentContext,
+                plan: &DeploymentPlan,
+                release: &ReleaseManifest,
+            ) -> Result<(), String> {
+                DeclarativeDeploymentProvider($kind).rollback(context, plan, release)
+            }
+            fn destroy(
+                &self,
+                context: &AuthorizedDeploymentContext,
+                plan: &DeploymentPlan,
+            ) -> Result<(), String> {
+                DeclarativeDeploymentProvider($kind).destroy(context, plan)
+            }
+        }
+    };
+}
+declarative_provider!(DockerDeploymentProvider, DeploymentProviderKind::Docker);
+declarative_provider!(FlyDeploymentProvider, DeploymentProviderKind::Fly);
+declarative_provider!(RenderDeploymentProvider, DeploymentProviderKind::Render);
+declarative_provider!(VercelDeploymentProvider, DeploymentProviderKind::Vercel);
+
+pub fn provider_for(kind: DeploymentProviderKind) -> Box<dyn DeploymentProvider> {
+    match kind {
+        DeploymentProviderKind::Local => Box::new(LocalDeploymentProvider),
+        DeploymentProviderKind::Docker => Box::new(DockerDeploymentProvider),
+        DeploymentProviderKind::Fly => Box::new(FlyDeploymentProvider),
+        DeploymentProviderKind::Render => Box::new(RenderDeploymentProvider),
+        DeploymentProviderKind::Vercel => Box::new(VercelDeploymentProvider),
+    }
+}
+#[derive(Debug, Default, Serialize, Deserialize)]
+struct Records {
+    releases: BTreeMap<String, Release>,
+    deployments: BTreeMap<String, Deployment>,
+    active: BTreeMap<String, String>,
+    #[serde(default)]
+    operation_audit: Vec<DeploymentOperationAudit>,
+}
+#[derive(Clone)]
+pub struct ReleaseStore {
+    path: PathBuf,
+    records: Arc<RwLock<Records>>,
+}
+fn now() -> u64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs()
+}
+fn unique_timestamp() -> u128 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_nanos()
+}
+fn digest<T: Serialize>(value: &T) -> Result<String, String> {
+    let bytes = serde_json::to_vec(value).map_err(|e| e.to_string())?;
+    Ok(format!("sha256:{:x}", Sha256::digest(bytes)))
+}
+fn manifest_digest(manifest: &ReleaseManifest) -> Result<String, String> {
+    let mut value = manifest.clone();
+    value.digest.clear();
+    value.release_attestation = None;
+    digest(&value)
+}
+impl ReleaseStore {
+    pub fn load(path: impl Into<PathBuf>) -> Result<Self, String> {
+        let path = path.into();
+        let records = if path.exists() {
+            serde_json::from_slice(&fs::read(&path).map_err(|e| e.to_string())?)
+                .map_err(|e| e.to_string())?
+        } else {
+            Records::default()
+        };
+        Ok(Self {
+            path,
+            records: Arc::new(RwLock::new(records)),
+        })
+    }
+    fn persist(&self, r: &Records) -> Result<(), String> {
+        if let Some(p) = self.path.parent() {
+            fs::create_dir_all(p).map_err(|e| e.to_string())?
+        }
+        let tmp = self.path.with_extension("tmp");
+        fs::write(
+            &tmp,
+            serde_json::to_vec_pretty(r).map_err(|e| e.to_string())?,
+        )
+        .map_err(|e| e.to_string())?;
+        fs::rename(tmp, &self.path).map_err(|e| e.to_string())
+    }
+    pub fn create(&self, mut manifest: ReleaseManifest, actor: &str) -> Result<Release, String> {
+        if !manifest
+            .ci_attestation
+            .status
+            .eq_ignore_ascii_case("success")
+            || manifest.ci_attestation.artifacts.len() < manifest.artifacts.len()
+        {
+            return Err("release requires successful CI attestation for every artifact".into());
+        }
+        for artifact in &manifest.artifacts {
+            if manifest.ci_attestation.artifacts.get(&artifact.name) != Some(&artifact.digest) {
+                return Err(format!("artifact digest mismatch: {}", artifact.name));
+            }
+        }
+        manifest.release_id = if manifest.release_id.is_empty() {
+            format!(
+                "release-{}-{}",
+                manifest.application_id,
+                digest(&manifest)?.trim_start_matches("sha256:")
+            )
+        } else {
+            manifest.release_id
+        };
+        manifest.digest = manifest_digest(&manifest)?;
+        let release = Release {
+            manifest: manifest.clone(),
+            status: ReleaseStatus::Candidate,
+            created_by: actor.into(),
+        };
+        let mut r = self
+            .records
+            .write()
+            .map_err(|_| "release store lock poisoned")?;
+        if r.releases.contains_key(&release.manifest.release_id) {
+            return Err("release already exists".into());
+        }
+        r.releases
+            .insert(release.manifest.release_id.clone(), release.clone());
+        self.persist(&r)?;
+        Ok(release)
+    }
+    pub fn get(&self, id: &str) -> Option<Release> {
+        self.records.read().ok()?.releases.get(id).cloned()
+    }
+    pub fn list(&self) -> Vec<Release> {
+        self.records
+            .read()
+            .map(|r| r.releases.values().cloned().collect())
+            .unwrap_or_default()
+    }
+    pub fn verify(&self, id: &str) -> Result<Release, String> {
+        let mut r = self
+            .records
+            .write()
+            .map_err(|_| "release store lock poisoned")?;
+        let release = r.releases.get_mut(id).ok_or("release not found")?;
+        if release.manifest.digest != manifest_digest(&release.manifest)? {
+            return Err("release manifest digest mismatch".into());
+        }
+        if !release
+            .manifest
+            .ci_attestation
+            .status
+            .eq_ignore_ascii_case("success")
+        {
+            return Err("CI attestation is not successful".into());
+        }
+        release.status = ReleaseStatus::Verified;
+        release.manifest.release_attestation = Some(manifest_digest(&release.manifest)?);
+        let out = release.clone();
+        self.persist(&r)?;
+        Ok(out)
+    }
+    pub fn promote(&self, id: &str, app: &str, environment: &str) -> Result<Release, String> {
+        let mut r = self
+            .records
+            .write()
+            .map_err(|_| "release store lock poisoned")?;
+        let release = r.releases.get_mut(id).ok_or("release not found")?;
+        if !matches!(
+            release.status,
+            ReleaseStatus::Published | ReleaseStatus::Promoted
+        ) {
+            return Err("release must be published before promotion".into());
+        }
+        release.status = ReleaseStatus::Promoted;
+        let out = release.clone();
+        let _ = release;
+        r.active.insert(format!("{app}\0{environment}"), id.into());
+        self.persist(&r)?;
+        Ok(out)
+    }
+    pub fn publish(&self, id: &str) -> Result<Release, String> {
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "release store lock poisoned")?;
+        let release = records.releases.get_mut(id).ok_or("release not found")?;
+        if release.status != ReleaseStatus::Verified {
+            return Err("release must be verified before publication".into());
+        }
+        release.status = ReleaseStatus::Published;
+        let output = release.clone();
+        self.persist(&records)?;
+        Ok(output)
+    }
+    pub fn active(&self, app: &str, environment: &str) -> Option<Release> {
+        let r = self.records.read().ok()?;
+        r.active
+            .get(&format!("{app}\0{environment}"))
+            .and_then(|id| r.releases.get(id))
+            .cloned()
+    }
+    pub fn plan(
+        &self,
+        release_id: &str,
+        environment: &str,
+        rollback_target: Option<String>,
+    ) -> Result<DeploymentPlan, String> {
+        self.plan_for(
+            release_id,
+            environment,
+            DeploymentProviderKind::Local,
+            DeploymentProfile::AllInOne,
+            rollback_target,
+        )
+    }
+    pub fn plan_for(
+        &self,
+        release_id: &str,
+        environment: &str,
+        provider: DeploymentProviderKind,
+        profile: DeploymentProfile,
+        rollback_target: Option<String>,
+    ) -> Result<DeploymentPlan, String> {
+        let release = self.get(release_id).ok_or("release not found")?;
+        if !matches!(
+            release.status,
+            ReleaseStatus::Published | ReleaseStatus::Promoted
+        ) {
+            return Err("release is not published".into());
+        }
+        let environment_value = match environment.to_ascii_lowercase().as_str() {
+            "local" => DeploymentEnvironment::Local,
+            "preview" => DeploymentEnvironment::Preview,
+            "staging" => DeploymentEnvironment::Staging,
+            "production" => DeploymentEnvironment::Production,
+            _ => return Err("environment must be local, preview, staging, or production".into()),
+        };
+        let rollback_target = rollback_target.or_else(|| {
+            self.active(&release.manifest.application_id, environment)
+                .map(|value| value.manifest.release_id)
+                .filter(|value| value != release_id)
+        });
+        let services = match profile {
+            DeploymentProfile::AllInOne
+            | DeploymentProfile::Split
+            | DeploymentProfile::SelfHost => vec![
+                DeploymentService::Studio,
+                DeploymentService::ControlPlane,
+                DeploymentService::Worker,
+                DeploymentService::ApplicationRuntime,
+                DeploymentService::ArtifactStore,
+            ],
+            DeploymentProfile::ControlPlaneOnly => vec![
+                DeploymentService::ControlPlane,
+                DeploymentService::ArtifactStore,
+            ],
+            DeploymentProfile::WorkerExpansion => vec![DeploymentService::Worker],
+            DeploymentProfile::StudioOnly => vec![DeploymentService::Studio],
+            DeploymentProfile::ApplicationOnly => vec![DeploymentService::ApplicationRuntime],
+        };
+        let plan = DeploymentPlan {
+            application_id: release.manifest.application_id,
+            release_id: release_id.into(),
+            revision_id: release.manifest.revision_id,
+            environment: environment_value,
+            workers: vec![],
+            connections: vec![],
+            required_secrets: vec![],
+            artifacts: release
+                .manifest
+                .artifacts
+                .iter()
+                .map(|a| a.name.clone())
+                .collect(),
+            rollback_target,
+            health_requirements: DeploymentHealth::required(),
+            provider,
+            profile,
+            services,
+            domains: vec![],
+            configuration: BTreeMap::new(),
+            secret_references: vec![],
+            scaling_policy: ScalingPolicy::default(),
+            release_policy: ReleasePolicy::default(),
+            dependencies: BTreeMap::from([
+                (
+                    DeploymentService::Studio,
+                    vec![DeploymentService::ControlPlane],
+                ),
+                (
+                    DeploymentService::Worker,
+                    vec![DeploymentService::ControlPlane],
+                ),
+                (
+                    DeploymentService::ApplicationRuntime,
+                    vec![DeploymentService::ControlPlane],
+                ),
+                (
+                    DeploymentService::ControlPlane,
+                    vec![DeploymentService::ArtifactStore],
+                ),
+            ]),
+        };
+        Ok(plan)
+    }
+    pub fn certify_deployment(&self, plan: &DeploymentPlan) -> DeploymentCertification {
+        let mut diagnostics = Vec::new();
+        let release_verified = self
+            .get(&plan.release_id)
+            .map(|release| {
+                matches!(
+                    release.status,
+                    ReleaseStatus::Published | ReleaseStatus::Promoted
+                )
+            })
+            .unwrap_or(false);
+        if !release_verified {
+            diagnostics.push("release is not published".into());
+        }
+        let provider_valid = match provider_for(plan.provider).validate(plan) {
+            Ok(()) => true,
+            Err(error) => {
+                diagnostics.push(error);
+                false
+            }
+        };
+        let secrets_are_references = plan.required_secrets.iter().all(|name| {
+            plan.secret_references.iter().any(|reference| {
+                &reference.name == name && !reference.provider_reference.is_empty()
+            })
+        });
+        if !secrets_are_references {
+            diagnostics.push("every required secret must use a provider reference".into());
+        }
+        let health_contract_present = plan.health_requirements.healthy();
+        if !health_contract_present {
+            diagnostics.push("deployment health requirements are incomplete".into());
+        }
+        DeploymentCertification {
+            valid: release_verified
+                && provider_valid
+                && secrets_are_references
+                && health_contract_present,
+            release_verified,
+            provider_valid,
+            secrets_are_references,
+            health_contract_present,
+            diagnostics,
+        }
+    }
+    pub fn deploy(
+        &self,
+        plan: DeploymentPlan,
+        provider: &dyn DeploymentProvider,
+    ) -> Result<Deployment, String> {
+        let deployment_id = format!(
+            "deployment://{}-{}",
+            plan.application_id,
+            unique_timestamp()
+        );
+        let context = AuthorizedDeploymentContext::system(&plan, &deployment_id);
+        self.deploy_authorized(plan, provider, context)
+    }
+    pub fn deploy_authorized(
+        &self,
+        plan: DeploymentPlan,
+        provider: &dyn DeploymentProvider,
+        context: AuthorizedDeploymentContext,
+    ) -> Result<Deployment, String> {
+        let release = self.get(&plan.release_id).ok_or("release not found")?;
+        context.authorize(&plan)?;
+        if provider.kind() != plan.provider {
+            return Err("deployment plan provider does not match controller provider".into());
+        }
+        let certification = self.certify_deployment(&plan);
+        if !certification.valid {
+            return Err(format!(
+                "deployment certification failed: {}",
+                certification.diagnostics.join("; ")
+            ));
+        }
+        let deployment = Deployment {
+            deployment_id: context.deployment_id.clone(),
+            plan,
+            state: DeploymentState::Draft,
+            health: DeploymentHealth::default(),
+            created_at: now(),
+            updated_at: now(),
+            observed: ProviderObservation::default(),
+            previous_known_good_release: None,
+            desired_state: DesiredDeploymentState::Active,
+            failure: None,
+        };
+        self.save_deployment(deployment.clone())?;
+        let id = deployment.deployment_id.clone();
+        let result = (|| {
+            self.transition(&id, DeploymentState::Validated)?;
+            self.transition(&id, DeploymentState::Published)?;
+            self.transition(&id, DeploymentState::Provisioning)?;
+            self.provider_operation(&context, &deployment.plan, "provision", || {
+                provider.provision(&context, &deployment.plan)
+            })?;
+            self.provider_operation(&context, &deployment.plan, "configure", || {
+                provider.configure(&context, &deployment.plan)
+            })?;
+            self.transition(&id, DeploymentState::Deploying)?;
+            self.provider_operation(&context, &deployment.plan, "deploy", || {
+                provider.deploy(&context, &deployment.plan, &release.manifest)
+            })?;
+            self.provider_operation(&context, &deployment.plan, "scale", || {
+                provider.scale(&context, &deployment.plan, &deployment.plan.scaling_policy)
+            })?;
+            self.transition(&id, DeploymentState::HealthChecking)?;
+            let health = self.provider_operation(&context, &deployment.plan, "health", || {
+                provider.health(&context, &deployment.plan)
+            })?;
+            if !health.healthy() {
+                return Err("deployment health contract failed".into());
+            }
+            let observed = self.provider_operation(&context, &deployment.plan, "status", || {
+                provider.status(&context, &deployment.plan)
+            })?;
+            self.observe(&id, health, observed, DeploymentState::Active)
+        })();
+        match result {
+            Ok(value) => Ok(value),
+            Err(error) => {
+                let failed = self.fail(&id, &error)?;
+                if failed.plan.release_policy.automatic_rollback
+                    && failed.plan.rollback_target.is_some()
+                {
+                    return self.rollback_authorized(&id, provider, context);
+                }
+                Ok(failed)
+            }
+        }
+    }
+    fn provider_operation<T>(
+        &self,
+        context: &AuthorizedDeploymentContext,
+        plan: &DeploymentPlan,
+        operation: &str,
+        execute: impl FnOnce() -> Result<T, String>,
+    ) -> Result<T, String> {
+        let result = execute();
+        let event = DeploymentOperationAudit {
+            provider: plan.provider,
+            deployment_id: context.deployment_id.clone(),
+            secret_references: plan
+                .secret_references
+                .iter()
+                .map(|reference| reference.provider_reference.clone())
+                .collect(),
+            credential_versions: context.credential_versions.clone(),
+            operation: operation.into(),
+            actor: context.actor.clone(),
+            timestamp: now(),
+            result: if result.is_ok() {
+                "success".into()
+            } else {
+                "failed".into()
+            },
+        };
+        if let Ok(mut records) = self.records.write() {
+            records.operation_audit.push(event);
+            let _ = self.persist(&records);
+        }
+        result
+    }
+    pub fn operation_audit(&self, deployment_id: &str) -> Vec<DeploymentOperationAudit> {
+        self.records
+            .read()
+            .map(|records| {
+                records
+                    .operation_audit
+                    .iter()
+                    .filter(|event| event.deployment_id == deployment_id)
+                    .cloned()
+                    .collect()
+            })
+            .unwrap_or_default()
+    }
+    fn save_deployment(&self, deployment: Deployment) -> Result<(), String> {
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "release store lock poisoned")?;
+        records
+            .deployments
+            .insert(deployment.deployment_id.clone(), deployment);
+        self.persist(&records)
+    }
+    fn transition(&self, id: &str, state: DeploymentState) -> Result<Deployment, String> {
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "release store lock poisoned")?;
+        let deployment = records
+            .deployments
+            .get_mut(id)
+            .ok_or("deployment not found")?;
+        deployment.state = state;
+        deployment.updated_at = now();
+        let output = deployment.clone();
+        self.persist(&records)?;
+        Ok(output)
+    }
+    fn observe(
+        &self,
+        id: &str,
+        health: DeploymentHealth,
+        observed: ProviderObservation,
+        state: DeploymentState,
+    ) -> Result<Deployment, String> {
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "release store lock poisoned")?;
+        let deployment = records
+            .deployments
+            .get_mut(id)
+            .ok_or("deployment not found")?;
+        deployment.health = health;
+        deployment.observed = observed;
+        deployment.state = state;
+        deployment.updated_at = now();
+        let output = deployment.clone();
+        self.persist(&records)?;
+        Ok(output)
+    }
+    fn fail(&self, id: &str, error: &str) -> Result<Deployment, String> {
+        let mut records = self
+            .records
+            .write()
+            .map_err(|_| "release store lock poisoned")?;
+        let deployment = records
+            .deployments
+            .get_mut(id)
+            .ok_or("deployment not found")?;
+        deployment.state = DeploymentState::Failed;
+        deployment.failure = Some(error.into());
+        deployment.updated_at = now();
+        let output = deployment.clone();
+        self.persist(&records)?;
+        Ok(output)
+    }
+    pub fn deployment(&self, id: &str) -> Option<Deployment> {
+        self.records.read().ok()?.deployments.get(id).cloned()
+    }
+    pub fn deployments(&self) -> Vec<Deployment> {
+        self.records
+            .read()
+            .map(|records| records.deployments.values().cloned().collect())
+            .unwrap_or_default()
+    }
+    pub fn reconcile(
+        &self,
+        id: &str,
+        provider: &dyn DeploymentProvider,
+    ) -> Result<Deployment, String> {
+        let deployment = self.deployment(id).ok_or("deployment not found")?;
+        let context = AuthorizedDeploymentContext::system(&deployment.plan, id);
+        self.reconcile_authorized(id, provider, context)
+    }
+    pub fn reconcile_authorized(
+        &self,
+        id: &str,
+        provider: &dyn DeploymentProvider,
+        context: AuthorizedDeploymentContext,
+    ) -> Result<Deployment, String> {
+        let deployment = self.deployment(id).ok_or("deployment not found")?;
+        context.authorize(&deployment.plan)?;
+        if provider.kind() != deployment.plan.provider {
+            return Err("deployment provider mismatch".into());
+        }
+        match deployment.desired_state {
+            DesiredDeploymentState::Stopped => self.stop_authorized(id, provider, context),
+            DesiredDeploymentState::Destroyed => {
+                self.provider_operation(&context, &deployment.plan, "destroy", || {
+                    provider.destroy(&context, &deployment.plan)
+                })?;
+                self.transition(id, DeploymentState::Destroyed)
+            }
+            DesiredDeploymentState::Active => {
+                if deployment.state == DeploymentState::Stopped {
+                    self.provider_operation(&context, &deployment.plan, "restart", || {
+                        provider.restart(&context, &deployment.plan)
+                    })?;
+                }
+                let health = self.provider_operation(&context, &deployment.plan, "health", || {
+                    provider.health(&context, &deployment.plan)
+                });
+                let observed =
+                    self.provider_operation(&context, &deployment.plan, "status", || {
+                        provider.status(&context, &deployment.plan)
+                    });
+                if health.is_err() || observed.is_err() {
+                    self.transition(id, DeploymentState::Degraded)?;
+                    self.provider_operation(&context, &deployment.plan, "recreate", || {
+                        provider.restart(&context, &deployment.plan)
+                    })?;
+                }
+                let health = provider.health(&context, &deployment.plan)?;
+                let observed = provider.status(&context, &deployment.plan)?;
+                let state = if health.healthy() {
+                    DeploymentState::Active
+                } else {
+                    DeploymentState::Failed
+                };
+                self.observe(id, health, observed, state)
+            }
+        }
+    }
+    pub fn restart(
+        &self,
+        id: &str,
+        provider: &dyn DeploymentProvider,
+    ) -> Result<Deployment, String> {
+        let deployment = self.deployment(id).ok_or("deployment not found")?;
+        let context = AuthorizedDeploymentContext::system(&deployment.plan, id);
+        self.restart_authorized(id, provider, context)
+    }
+    pub fn restart_authorized(
+        &self,
+        id: &str,
+        provider: &dyn DeploymentProvider,
+        context: AuthorizedDeploymentContext,
+    ) -> Result<Deployment, String> {
+        let deployment = self.deployment(id).ok_or("deployment not found")?;
+        self.provider_operation(&context, &deployment.plan, "restart", || {
+            provider.restart(&context, &deployment.plan)
+        })?;
+        self.reconcile_authorized(id, provider, context)
+    }
+    pub fn scale(
+        &self,
+        id: &str,
+        policy: ScalingPolicy,
+        provider: &dyn DeploymentProvider,
+    ) -> Result<Deployment, String> {
+        if policy.min_instances > policy.max_instances {
+            return Err("minimum instances cannot exceed maximum instances".into());
+        }
+        let deployment = self.deployment(id).ok_or("deployment not found")?;
+        let context = AuthorizedDeploymentContext::system(&deployment.plan, id);
+        self.scale_authorized(id, policy, provider, context)
+    }
+    pub fn scale_authorized(
+        &self,
+        id: &str,
+        policy: ScalingPolicy,
+        provider: &dyn DeploymentProvider,
+        context: AuthorizedDeploymentContext,
+    ) -> Result<Deployment, String> {
+        if policy.min_instances > policy.max_instances {
+            return Err("minimum instances cannot exceed maximum instances".into());
+        }
+        let mut deployment = self.deployment(id).ok_or("deployment not found")?;
+        self.provider_operation(&context, &deployment.plan, "scale", || {
+            provider.scale(&context, &deployment.plan, &policy)
+        })?;
+        deployment.plan.scaling_policy = policy;
+        deployment.updated_at = now();
+        self.save_deployment(deployment.clone())?;
+        Ok(deployment)
+    }
+    pub fn destroy(
+        &self,
+        id: &str,
+        provider: &dyn DeploymentProvider,
+    ) -> Result<Deployment, String> {
+        let deployment = self.deployment(id).ok_or("deployment not found")?;
+        let context = AuthorizedDeploymentContext::system(&deployment.plan, id);
+        self.destroy_authorized(id, provider, context)
+    }
+    pub fn destroy_authorized(
+        &self,
+        id: &str,
+        provider: &dyn DeploymentProvider,
+        context: AuthorizedDeploymentContext,
+    ) -> Result<Deployment, String> {
+        let mut deployment = self.deployment(id).ok_or("deployment not found")?;
+        self.transition(id, DeploymentState::Destroying)?;
+        self.provider_operation(&context, &deployment.plan, "destroy", || {
+            provider.destroy(&context, &deployment.plan)
+        })?;
+        deployment.desired_state = DesiredDeploymentState::Destroyed;
+        deployment.state = DeploymentState::Destroyed;
+        deployment.updated_at = now();
+        self.save_deployment(deployment.clone())?;
+        Ok(deployment)
+    }
+    pub fn stop(&self, id: &str, provider: &dyn DeploymentProvider) -> Result<Deployment, String> {
+        let deployment = self.deployment(id).ok_or("deployment not found")?;
+        let context = AuthorizedDeploymentContext::system(&deployment.plan, id);
+        self.stop_authorized(id, provider, context)
+    }
+    pub fn stop_authorized(
+        &self,
+        id: &str,
+        provider: &dyn DeploymentProvider,
+        context: AuthorizedDeploymentContext,
+    ) -> Result<Deployment, String> {
+        let mut r = self
+            .records
+            .write()
+            .map_err(|_| "release store lock poisoned")?;
+        let d = r.deployments.get_mut(id).ok_or("deployment not found")?;
+        d.state = DeploymentState::Stopping;
+        let plan = d.plan.clone();
+        let _ = d;
+        self.persist(&r)?;
+        drop(r);
+        self.provider_operation(&context, &plan, "stop", || provider.stop(&context, &plan))?;
+        let mut r = self
+            .records
+            .write()
+            .map_err(|_| "release store lock poisoned")?;
+        let d = r.deployments.get_mut(id).ok_or("deployment not found")?;
+        d.desired_state = DesiredDeploymentState::Stopped;
+        d.state = DeploymentState::Stopped;
+        d.updated_at = now();
+        let out = d.clone();
+        self.persist(&r)?;
+        Ok(out)
+    }
+    pub fn rollback(
+        &self,
+        id: &str,
+        provider: &dyn DeploymentProvider,
+    ) -> Result<Deployment, String> {
+        let deployment = self.deployment(id).ok_or("deployment not found")?;
+        let context = AuthorizedDeploymentContext::system(&deployment.plan, id);
+        self.rollback_authorized(id, provider, context)
+    }
+    pub fn rollback_authorized(
+        &self,
+        id: &str,
+        provider: &dyn DeploymentProvider,
+        mut context: AuthorizedDeploymentContext,
+    ) -> Result<Deployment, String> {
+        let mut r = self
+            .records
+            .write()
+            .map_err(|_| "release store lock poisoned")?;
+        let target = {
+            let d = r.deployments.get(id).ok_or("deployment not found")?;
+            d.plan
+                .rollback_target
+                .clone()
+                .ok_or("deployment has no rollback target")?
+        };
+        let plan = {
+            let d = r.deployments.get(id).ok_or("deployment not found")?;
+            d.plan.clone()
+        };
+        let release = r
+            .releases
+            .get(&target)
+            .ok_or("rollback release not found")?
+            .clone();
+        let d = r.deployments.get_mut(id).ok_or("deployment not found")?;
+        d.state = DeploymentState::RollingBack;
+        let _ = d;
+        self.persist(&r)?;
+        drop(r);
+        context.release_id = plan.release_id.clone();
+        context.revision_id = plan.revision_id.clone();
+        self.provider_operation(&context, &plan, "rollback", || {
+            provider.rollback(&context, &plan, &release.manifest)
+        })?;
+        let health = self.provider_operation(&context, &plan, "rollback_health", || {
+            provider.health(&context, &plan)
+        })?;
+        if !health.healthy() {
+            return Err("rollback health contract failed".into());
+        }
+        let observed = self.provider_operation(&context, &plan, "rollback_status", || {
+            provider.status(&context, &plan)
+        })?;
+        let mut r = self
+            .records
+            .write()
+            .map_err(|_| "release store lock poisoned")?;
+        let d = r.deployments.get_mut(id).ok_or("deployment not found")?;
+        d.state = DeploymentState::Active;
+        d.health = health;
+        d.observed = observed;
+        d.previous_known_good_release = Some(d.plan.release_id.clone());
+        d.plan.release_id = target.clone();
+        d.plan.revision_id = release.manifest.revision_id;
+        d.updated_at = now();
+        let out = d.clone();
+        let active_key = format!(
+            "{}\0{}",
+            out.plan.application_id,
+            out.plan.environment.as_str()
+        );
+        r.active.insert(active_key, target);
+        self.persist(&r)?;
+        Ok(out)
+    }
+}
+#[cfg(test)]
+mod tests {
+    use super::*;
+    fn manifest() -> ReleaseManifest {
+        let mut checks = BTreeMap::new();
+        checks.insert("server".into(), "sha256:abc".into());
+        ReleaseManifest {
+            release_id: String::new(),
+            version: "1.0.0".into(),
+            application_id: "app".into(),
+            revision_id: "rev".into(),
+            bundle_id: "bundle".into(),
+            source_commit: "commit".into(),
+            artifacts: vec![ReleaseArtifact {
+                name: "server".into(),
+                artifact_type: "container".into(),
+                digest: "sha256:abc".into(),
+                size: 1,
+            }],
+            packages: vec![],
+            runtime: BTreeMap::new(),
+            environment: BTreeMap::new(),
+            parent_release: None,
+            ci_attestation: CiAttestation {
+                provider: "local".into(),
+                run_id: "1".into(),
+                commit: "commit".into(),
+                status: "success".into(),
+                checks: BTreeMap::new(),
+                artifacts: checks,
+                generated_at: 1,
+            },
+            release_attestation: None,
+            digest: String::new(),
+            created_at: 1,
+        }
+    }
+    #[test]
+    fn verify_promote_deploy_and_stop() {
+        let p = std::env::temp_dir().join(format!("release-{}", now()));
+        let s = ReleaseStore::load(&p).unwrap();
+        let r = s.create(manifest(), "owner").unwrap();
+        let r = s.verify(&r.manifest.release_id).unwrap();
+        assert_eq!(r.status, ReleaseStatus::Verified);
+        let r = s.publish(&r.manifest.release_id).unwrap();
+        assert_eq!(r.status, ReleaseStatus::Published);
+        let r = s.promote(&r.manifest.release_id, "app", "staging").unwrap();
+        assert_eq!(r.status, ReleaseStatus::Promoted);
+        let mut plan = s.plan(&r.manifest.release_id, "staging", None).unwrap();
+        plan.configuration
+            .insert("local.command".into(), "sleep".into());
+        plan.configuration.insert("local.args".into(), "30".into());
+        plan.configuration
+            .insert("health.command".into(), "true".into());
+        let d = s.deploy(plan, &LocalDeploymentProvider).unwrap();
+        assert_eq!(d.state, DeploymentState::Active);
+        assert_eq!(
+            s.stop(&d.deployment_id, &LocalDeploymentProvider)
+                .unwrap()
+                .state,
+            DeploymentState::Stopped
+        );
+        let _ = fs::remove_file(p);
+    }
+    #[test]
+    fn profiles_are_provider_neutral_and_vercel_is_studio_only() {
+        let p = std::env::temp_dir().join(format!("release-profiles-{}", now()));
+        let s = ReleaseStore::load(&p).unwrap();
+        let release = s.create(manifest(), "owner").unwrap();
+        let release = s.verify(&release.manifest.release_id).unwrap();
+        let release = s.publish(&release.manifest.release_id).unwrap();
+        let mut docker = s
+            .plan_for(
+                &release.manifest.release_id,
+                "production",
+                DeploymentProviderKind::Docker,
+                DeploymentProfile::Split,
+                None,
+            )
+            .unwrap();
+        docker
+            .configuration
+            .insert("image".into(), "feltdb:test".into());
+        docker
+            .configuration
+            .insert("health.url".into(), "https://example.test/ready".into());
+        assert!(s.certify_deployment(&docker).valid);
+        let mut plaintext_shape = docker.clone();
+        plaintext_shape.required_secrets.push("DATABASE_URL".into());
+        assert!(!s.certify_deployment(&plaintext_shape).valid);
+        let mut fly = s
+            .plan_for(
+                &release.manifest.release_id,
+                "production",
+                DeploymentProviderKind::Fly,
+                DeploymentProfile::Split,
+                None,
+            )
+            .unwrap();
+        fly.configuration
+            .insert("image".into(), "feltdb:test".into());
+        fly.configuration
+            .insert("fly.app".into(), "feltdb-test".into());
+        fly.configuration
+            .insert("health.url".into(), "https://example.test/ready".into());
+        assert_eq!(docker.services, fly.services);
+        assert_eq!(docker.profile, fly.profile);
+        let vercel = s
+            .plan_for(
+                &release.manifest.release_id,
+                "production",
+                DeploymentProviderKind::Vercel,
+                DeploymentProfile::AllInOne,
+                None,
+            )
+            .unwrap();
+        assert!(provider_for(DeploymentProviderKind::Vercel)
+            .validate(&vercel)
+            .is_err());
+        let worker = s
+            .plan_for(
+                &release.manifest.release_id,
+                "production",
+                DeploymentProviderKind::Vercel,
+                DeploymentProfile::WorkerExpansion,
+                None,
+            )
+            .unwrap();
+        let error = provider_for(DeploymentProviderKind::Vercel)
+            .validate(&worker)
+            .unwrap_err();
+        assert!(error.contains("Studio service only"));
+        let mut studio = s
+            .plan_for(
+                &release.manifest.release_id,
+                "production",
+                DeploymentProviderKind::Vercel,
+                DeploymentProfile::StudioOnly,
+                None,
+            )
+            .unwrap();
+        studio
+            .configuration
+            .insert("vercel.project".into(), "test".into());
+        studio.configuration.insert(
+            "control_plane.url".into(),
+            "https://api.example.test".into(),
+        );
+        studio
+            .configuration
+            .insert("health.url".into(), "https://example.test/ready".into());
+        assert!(provider_for(DeploymentProviderKind::Vercel)
+            .validate(&studio)
+            .is_ok());
+        let _ = fs::remove_file(p);
+    }
+    #[test]
+    fn deployment_state_survives_restart_and_reconciles() {
+        let p = std::env::temp_dir().join(format!("release-restart-{}", now()));
+        let s = ReleaseStore::load(&p).unwrap();
+        let release = s.create(manifest(), "owner").unwrap();
+        let release = s.verify(&release.manifest.release_id).unwrap();
+        let release = s.publish(&release.manifest.release_id).unwrap();
+        let mut plan = s
+            .plan(&release.manifest.release_id, "staging", None)
+            .unwrap();
+        plan.configuration
+            .insert("local.command".into(), "sleep".into());
+        plan.configuration.insert("local.args".into(), "30".into());
+        plan.configuration
+            .insert("health.command".into(), "true".into());
+        let deployment = s.deploy(plan, &LocalDeploymentProvider).unwrap();
+        drop(s);
+        let reloaded = ReleaseStore::load(&p).unwrap();
+        assert_eq!(
+            reloaded
+                .deployment(&deployment.deployment_id)
+                .unwrap()
+                .state,
+            DeploymentState::Active
+        );
+        assert_eq!(
+            reloaded
+                .reconcile(&deployment.deployment_id, &LocalDeploymentProvider)
+                .unwrap()
+                .state,
+            DeploymentState::Active
+        );
+        let context =
+            AuthorizedDeploymentContext::system(&deployment.plan, &deployment.deployment_id);
+        let pid = fs::read_to_string(state_file(&context, "pid")).unwrap();
+        let _ = Command::new("kill").arg(pid.trim()).status();
+        let _ = fs::remove_file(state_file(&context, "pid"));
+        thread::sleep(Duration::from_millis(50));
+        assert_eq!(
+            reloaded
+                .reconcile(&deployment.deployment_id, &LocalDeploymentProvider)
+                .unwrap()
+                .state,
+            DeploymentState::Active
+        );
+        assert!(reloaded
+            .operation_audit(&deployment.deployment_id)
+            .iter()
+            .any(|event| event.operation == "recreate"));
+        reloaded
+            .stop(&deployment.deployment_id, &LocalDeploymentProvider)
+            .unwrap();
+        let _ = fs::remove_file(p);
+    }
+    #[test]
+    fn rollback_verifies_previous_release_and_destroy_is_terminal() {
+        let p = std::env::temp_dir().join(format!("release-rollback-{}", now()));
+        let store = ReleaseStore::load(&p).unwrap();
+        let first = store.create(manifest(), "owner").unwrap();
+        let first = store.verify(&first.manifest.release_id).unwrap();
+        let first = store.publish(&first.manifest.release_id).unwrap();
+        let mut next_manifest = manifest();
+        next_manifest.version = "1.1.0".into();
+        next_manifest.revision_id = "rev-2".into();
+        next_manifest.source_commit = "commit-2".into();
+        let second = store.create(next_manifest, "owner").unwrap();
+        let second = store.verify(&second.manifest.release_id).unwrap();
+        let second = store.publish(&second.manifest.release_id).unwrap();
+        let mut plan = store
+            .plan(
+                &second.manifest.release_id,
+                "production",
+                Some(first.manifest.release_id.clone()),
+            )
+            .unwrap();
+        plan.configuration
+            .insert("local.command".into(), "sleep".into());
+        plan.configuration.insert("local.args".into(), "30".into());
+        plan.configuration
+            .insert("health.command".into(), "true".into());
+        let deployment = store.deploy(plan, &LocalDeploymentProvider).unwrap();
+        let rolled_back = store
+            .rollback(&deployment.deployment_id, &LocalDeploymentProvider)
+            .unwrap();
+        assert_eq!(rolled_back.state, DeploymentState::Active);
+        assert_eq!(rolled_back.plan.release_id, first.manifest.release_id);
+        assert!(store
+            .operation_audit(&deployment.deployment_id)
+            .iter()
+            .any(|event| event.operation == "rollback_health"));
+        let destroyed = store
+            .destroy(&deployment.deployment_id, &LocalDeploymentProvider)
+            .unwrap();
+        assert_eq!(destroyed.state, DeploymentState::Destroyed);
+        let _ = fs::remove_file(p);
+    }
+    #[test]
+    fn live_docker_provider_certification() {
+        let Ok(image) = std::env::var("FELTDB_LIVE_DOCKER_IMAGE") else {
+            return;
+        };
+        let port = std::env::var("FELTDB_LIVE_DOCKER_PORT").unwrap_or_else(|_| "18080".into());
+        let p = std::env::temp_dir().join(format!("release-docker-{}", now()));
+        let store = ReleaseStore::load(&p).unwrap();
+        let release = store.create(manifest(), "ci").unwrap();
+        let release = store.verify(&release.manifest.release_id).unwrap();
+        let release = store.publish(&release.manifest.release_id).unwrap();
+        let mut plan = store
+            .plan_for(
+                &release.manifest.release_id,
+                "staging",
+                DeploymentProviderKind::Docker,
+                DeploymentProfile::AllInOne,
+                None,
+            )
+            .unwrap();
+        plan.configuration.insert("image".into(), image);
+        plan.configuration.insert(
+            "docker.name".into(),
+            format!("feltdb-provider-cert-{}", std::process::id()),
+        );
+        plan.configuration
+            .insert("docker.ports".into(), format!("{port}:8080"));
+        plan.configuration.insert(
+            "health.url".into(),
+            format!("http://127.0.0.1:{port}/ready"),
+        );
+        plan.configuration
+            .insert("health.retries".into(), "30".into());
+        let data_dir =
+            std::env::temp_dir().join(format!("feltdb-provider-cert-data-{}", std::process::id()));
+        fs::create_dir_all(&data_dir).unwrap();
+        plan.configuration.insert(
+            "docker.volumes".into(),
+            format!("{}:/data", data_dir.display()),
+        );
+        for name in [
+            "FELTDB_MASTER_KEY",
+            "FELTDB_SESSION_SECRET",
+            "FELTDB_GRANT_SIGNING_KEY",
+        ] {
+            plan.required_secrets.push(name.into());
+            plan.secret_references.push(SecretReference {
+                name: name.into(),
+                provider_reference: format!("ci/{name}"),
+            });
+        }
+        let deployment_id = format!("deployment-docker-cert-{}", std::process::id());
+        let context = AuthorizedDeploymentContext::new(
+            "ci".into(),
+            &plan,
+            deployment_id,
+            "system".into(),
+            BTreeMap::from([
+                (
+                    "FELTDB_MASTER_KEY".into(),
+                    "docker-certification-master-key-material".into(),
+                ),
+                (
+                    "FELTDB_SESSION_SECRET".into(),
+                    "docker-certification-session-secret-material".into(),
+                ),
+                (
+                    "FELTDB_GRANT_SIGNING_KEY".into(),
+                    "docker-certification-grant-signing-material".into(),
+                ),
+            ]),
+            BTreeMap::from([
+                ("FELTDB_MASTER_KEY".into(), 1),
+                ("FELTDB_SESSION_SECRET".into(), 1),
+                ("FELTDB_GRANT_SIGNING_KEY".into(), 1),
+            ]),
+        );
+        let deployment = store
+            .deploy_authorized(plan, &DockerDeploymentProvider, context)
+            .unwrap();
+        assert_eq!(deployment.state, DeploymentState::Active);
+        let restarted = store
+            .restart(&deployment.deployment_id, &DockerDeploymentProvider)
+            .unwrap();
+        assert_eq!(restarted.state, DeploymentState::Active);
+        let destroyed = store
+            .destroy(&deployment.deployment_id, &DockerDeploymentProvider)
+            .unwrap();
+        assert_eq!(destroyed.state, DeploymentState::Destroyed);
+        let _ = fs::remove_file(p);
+        let _ = fs::remove_dir_all(data_dir);
+    }
+    #[test]
+    fn provider_credentials_are_ephemeral_and_audit_records_versions_only() {
+        let p = std::env::temp_dir().join(format!("release-credentials-{}", now()));
+        let store = ReleaseStore::load(&p).unwrap();
+        let release = store.create(manifest(), "owner").unwrap();
+        let release = store.verify(&release.manifest.release_id).unwrap();
+        let release = store.publish(&release.manifest.release_id).unwrap();
+        let mut plan = store
+            .plan(&release.manifest.release_id, "staging", None)
+            .unwrap();
+        plan.configuration
+            .insert("local.command".into(), "sleep".into());
+        plan.configuration.insert("local.args".into(), "30".into());
+        plan.configuration
+            .insert("health.command".into(), "true".into());
+        plan.required_secrets.push("PROVIDER_TOKEN".into());
+        plan.secret_references.push(SecretReference {
+            name: "PROVIDER_TOKEN".into(),
+            provider_reference: "secret-provider-token".into(),
+        });
+        let deployment_id = format!("deployment-credentials-{}", unique_timestamp());
+        let mut credentials = BTreeMap::new();
+        credentials.insert("PROVIDER_TOKEN".into(), "never-persist-this-value".into());
+        let mut versions = BTreeMap::new();
+        versions.insert("PROVIDER_TOKEN".into(), 7);
+        let context = AuthorizedDeploymentContext::new(
+            "tenant".into(),
+            &plan,
+            deployment_id,
+            "system".into(),
+            credentials,
+            versions,
+        );
+        let deployment = store
+            .deploy_authorized(plan, &LocalDeploymentProvider, context.clone())
+            .unwrap();
+        let persisted = fs::read_to_string(&p).unwrap();
+        assert!(!persisted.contains("never-persist-this-value"));
+        let audit = store.operation_audit(&deployment.deployment_id);
+        assert!(audit
+            .iter()
+            .any(|event| event.credential_versions.get("PROVIDER_TOKEN") == Some(&7)));
+        store
+            .stop_authorized(&deployment.deployment_id, &LocalDeploymentProvider, context)
+            .unwrap();
+        let _ = fs::remove_file(p);
+    }
+}