Estate delivery: deploy with deploy-kit, pause and roll back, watch it from one dashboard #195

What this is

The estate gets a delivery path built on deploy-kit, so that a release becomes a deploy without any rendered YAML in a repository, and so that Projects can be paused and rolled back and watched from one admin dashboard. This epic carries the decisions of the 2026-10-01 design session and every ticket that implements them. Supersedes the outline in #148.

Design canvas (dashboard, desktop and mobile for every page): https://claude.ai/artifact/M5ZQjxFofUeEqaEdPLtn2R

Decisions

Delivery

• Composition runs in CI in a new private Estate repository: the Platform document, the composition lock, the ClusterState snapshot and one pin per Project. It never holds a rendered tree, and there is no backing repository. The render diff is posted on the application repository's PR.
• A fragment publishes when release-please tags a release, and carries that version. Application repositories publish through one reusable publish-fragment workflow and dispatch composition with a GitHub App token; a nightly composition is the safety net.
• The toolkit is pinned exactly from npm. Artifacts are signed keyless and verified by Flux, the one applier.
• A refused fragment is isolated: its Project stays at its last composed fragment, and every other Project still composes.

Controls

• Pause freezes a Project's pin, recorded as annotations on its pin file. Pause, resume and rollback are estate workflows.
• Rollback re-composes an earlier release, named by version, with the schema at its newest. It is offered only to releases proven against the current schema. It first takes a backup kept for 7 days, moves the pin only once that backup succeeds, and leaves the Project paused.

In-cluster services, Go, in a new delivery repository and project:

• A minimal Release Gate. It reads each Application's releaseGate from a rendered ConfigMap and fails closed.
• A read-only ClusterState Collector that commits the snapshot to the Estate repository through a GitHub App.
• A Vault policy job in apps-vso-secrets.
• All three generate their types from deploy-kit's published JSON Schemas.

Alerts

• Alertmanager is the hub for cluster-side alerts; their rules are Assets of the observability project.
• Composition-side alerts are commit statuses, one Estate-repository issue per Project condition, and Discord posts.

Dashboard

• estate-dashboard: Go + Vue, contract-first (OpenAPI, ogen, openapi-ts).
• Signed in as an OIDC client of auth, with its own session and its own admin-role check. It keeps its own database.
• Read-only, except for Alertmanager silences.

Standard

• go-commons, extracting a package only once three consumers share it.
• template-go and template-go-vue; the Go and Vue blueprints move out of grimoire into them.

Model

• A project's database is named <project>_db.
• Vault roles and policies are named <namespace>-<identity>.
• Backup pods get their own NetworkPolicy.
• The pending refusal codes become real refusals in slice 7, in both implementations.

Children

Decisions

• ADRs: publish on release tags, Pause and Rollback, and isolate a refused Project #196
• JorisJonkers-dev/workspace#107

deploy-kit

• Compose the estate: a compose use-case and CLI, pin annotations and fragment versions #197
• Publish versioned JSON Schemas for the Resolved Deployment, the composition lock and the pin annotations #198
• Render the delivery path's own facts: the releaseGate ConfigMap, backup-pod policies and namespaced Vault names #199
• Slice 3b: render auth, with its migration Jobs and identity #200
• The edge Project's own objects land in the estate artifact, and nothing applies its proxies #253
• The Release Gate's inputs carry the migration, and a changelog nothing gates is refused #261
• Slice 4: model and render the knowledge platform #201
• Slice 5: render the delivery machinery, Flagger declared as a foundation Application #202
• Slice 6: render the composed estate and the edge #203
• Slice 7: every refusal through check/, the pending codes included #204
• Describe the Release Gate in the delivery example as the Go service it is #234
• Declare the Collector in the model: a scheduled lifecycle, a cluster-wide read, and a namespace on snapshot facts #236

Estate repository and workflows

• Bootstrap the Estate repository and point Flux at it estate#1
• Composition workflow: compose, sign, pin, and report estate#2
• Pause, resume and rollback workflows estate#3
• Delivery and platform alert rules as observability Assets, routed to Discord estate#4
• Reusable publish-fragment workflow, and the render diff on the app PR github-workflows#135

delivery (Go)

• Scaffold the delivery repository and its project delivery#1
• Release Gate, minimal: may-start, checks and the may-promote barrier delivery#2
• Release Gate: migrations, the guarded Down, held reporting and alerts delivery#3
• ClusterState Collector: read-only snapshot, committed on change delivery#4
• Vault policy job: apply the rendered policies and roles delivery#5
• Repin the vendored deploy-kit schemas to a release tag delivery#9
• The platform's Liquibase runner image and CI helpers liquibase-runner#1

Dashboard

• Register the estate dashboard as an OIDC client auth-api#79
• Scaffold the dashboard: contract, project and database estate-dashboard#1
• Sign in through auth: OIDC client, own session, admin check estate-dashboard#2
• Read the estate: repository, Flux and Canary objects, Alertmanager estate-dashboard#3
• Build the dashboard screens to the design, desktop and phone estate-dashboard#4

Go standard

• Make template-go: a Go service or controller template template-go#1
• Make template-go-vue, and move the Go and Vue blueprints into it template-go-vue#1
• Point the Go and Vue blueprints at template-go-vue grimoire#73
• Start go-commons with what three consumers share go-commons#1

Adoption

• Move home-portal onto the estate path, the first Project home-portal#70
• Move grimoire onto the estate path grimoire#74
• Move tribelt onto the estate path tribelt#13