Controlled Deployment

The engineer edits one module and checks it as a candidate. t.code.check runs the same compiler and verifier the host will run, so a candidate that fails here never becomes a generation.

chest candidate() {
    chest row = {
        text moduleId = "a.approval",
        text source = "bool needsSecondApproval(u32 openDays) {\n    return openDays > 30\n}\n"
    }
    chest[] modules = [row]
    chest map = { u16 schemaVersion = 1, text entryModule = "a.approval" }
    map.modules = modules
    return map
}

text main(text[] argv) {
    chest verdict = t.code.check(candidate())
    chest[] faults = verdict.faults
    if (faults.count() > 0) {
        return "refused: " + text(faults.count()) + " faults"
    }
    return "ready to publish"
}

The application asks its host for the replacement as a row in its result, never as a call. merge keeps every module the edit does not name, and adopt keeps live peer connections. The host compiles the whole program, installs it between calls, and keeps generation 184 as the rollback point.

chest replaceRequest(u64 generation, chest moduleMap) {
    chest program = { text origin = "authored", u64 sequence = 0 }
    chest? source = moduleMap
    guid? connection = null
    program.source = source
    program.connection = connection
    chest payload = { text compose = "merge", text connections = "adopt" }
    payload.program = program
    chest request = { text kind = "programReplace" }
    request.generation = generation
    request.payload = payload
    return request
}

The driver fix is a new runtime, so it takes the node path. Each node runs the release its tri.draft pins, and a runner of another version refuses at the argument stage. The runner also checks its own image bytes against the pinned digests. Five bench stations get the new pin first.

# The runtime release this node runs, and the runner images it accepts.
text release = "1.0.2"
sha256 releaseDigest = "a41c97e2b0d35f8861c4e2f09b7d3a6e5f1c8b2d4e6a7f9031c5b8d2e4f6a7b9"
sha256[] releaseRunners = ["0c9e4d1b7a3f5e2c8d6b4a1f9e7c5b3d2a4f6e8c1b3d5f7a9e2c4b6d8f1a3c5e"]

A node installs a runtime as one complete generation and moves one pointer. The old generation stays on disk, so rollback moves the pointer back, and a running process keeps the generation it started with.

~/.mertek-trident-cache/
  <sha256>                 # one blessed object: tricli, tri, or the launcher
  releases/<sha256>/       # one release: its public manifest and its artifact set
  generations/<sha256>     # immutable descriptor: tricli, tri, launcher, release
  pins/active              # one atomic reference to a complete descriptor
  trust/                   # durable highest accepted signed-index generation

Blue and green serve together. Pilot nodes on 1.0.2 and the other 135 on 1.0.1 share one wire. The handshake refuses only a different protocol identity, and each side reads any other difference as a fact. The application plan stays pinned by digest the whole time.

# The application plan this node runs, pinned by its digest.
# A substituted plan file refuses before any provider opens.
text plan = "/srv/depot/readiness/plan.chest"
sha256 planDigest = "5d1f0c3a9e8b7d6c5b4a3928170f6e5d4c3b2a19087f6e5d4c3b2a1908f7e6d5"