1.5.0 — Fleet code deploy

2026-08-07

A webhook on the deploy branch rolls the fleet: one canary node first, the rest released only once it proves the release, migrations behind a Postgres advisory lock. Adds EDGE_CONVERGE_ENABLED so the edge app can be installed for the deploy plane alone.

Added

• Fleet code deploy. A webhook on the deploy branch starts a rollout from a start-of-run fleet snapshot.
  • A canary node (lowest live runner) updates first; the rest of the fleet is released only after it reports success against the expected commit.
  • Migrations run behind a Postgres advisory lock, so nodes starting together cannot race through the same migration.
  • Every node pins the same release; the orchestrator updates itself last.
  • Management commands: deploy_status, migrate_locked, sanity_check.
  • Two endpoints for triggering and observing a deploy.
• EDGE_CONVERGE_ENABLED (default True, so existing deployments are unchanged) — install mojo.apps.edge for the deploy plane without the vhost convergence sweep broadcasting every ten minutes to runners that do not consume it.
• Assistant WebSocket turn correlation.

Changed

• publish.py is agent-driven: it verifies, builds, pushes, publishes and tags, refuses a dirty tree, and never writes to the working tree.
• Documentation is no longer published through GitHub Actions.
• The real-nginx test skips cleanly when nginx is absent rather than failing.

Upgrade notes

If you write your own update script, report failure before rolling back. A rollback may reinstall a version that predates the reporting tool, so the report has to happen while that tool still exists. The documented skeleton contract was corrected to this order.

This feature is inert without the corresponding skeleton changes — see the deploy documentation for what a node needs.