Manual deployment workflow cannot build a verification plan

[alexeygrigorev]

Problem

The reviewed workflow_dispatch deployment path emits the intentional full manual_dispatch selection with base: null, but ci.verification plan still unconditionally runs the canonical diff against the string null. Every manual promotion therefore fails in classification before quality, image publication, migration, or deployment.

Scope

• Preserve the classifier contract that manual dispatch does not guess a base.
• Make the verification planner accept the explicit no-base manual selection and produce a valid full plan from the selected commit.
• Add focused regression coverage and run the required CI verification.
• Do not change application runtime behavior, deployment mutation semantics, or database code.

Acceptance

A manual promotion of an exact main SHA reaches the existing quality, publish, migration, deploy, and live-smoke gates; the live site must report the selected source SHA/version/image digest. No manual path may silently downgrade from the full profile.

[alexeygrigorev]

PM grooming complete — ready for engineering

This is a release-infrastructure blocker discovered while completing #220. The required behavior is precise: keep ci.classifier manual dispatch selections at profile=full, reason=manual_dispatch, and base=null; teach the planner to handle that explicit no-base selection without invoking git diff null; emit a valid full plan rooted at the selected commit; and cover the path with focused tests. The existing push-based selective-CI behavior, deployment mutation logic, and application/runtime scope are out of scope. After independent verification, the accepted fix may be committed and merged so the exact #220 SHA can be redeployed.

[alexeygrigorev]

Product Acceptance

ACCEPT

The candidate satisfies #221: manual dispatch remains profile=full, reason=manual_dispatch, and base=null; the planner no longer passes null to Git and roots the valid full plan at the exact selected SHA. The regression test preserves that contract, and the change is limited to ci/verification.py and ci/tests/test_gate.py.

Independent verification reproduced the baseline failure and passed 602 make test-ci tests plus lint, format, typecheck, quality, and full Django checks. Playwright/container checks are not applicable to this CI-planner-only, non-render change. The candidate may be committed.

[alexeygrigorev]

Scope amendment — manual base extraction

The accepted two-file planner fix exposed one remaining shell-level failure in the same path: the workflow uses jq -er .base, which exits before the planner when the intentional manual selection contains JSON null. The candidate may therefore additionally update .github/workflows/ci.yml to normalize only this explicit null to the planner sentinel null, plus the workflow contract test that prevents regression. The manual classifier must continue to emit base: null; no runtime, deployment mutation, AWS, database, or image behavior is changing.

[alexeygrigorev]

Product Acceptance

ACCEPT

The #221 scope amendment is accepted. The follow-up is limited exactly to .github/workflows/ci.yml and ci/tests/test_workflows.py (2 insertions, 1 deletion): the workflow normalizes the intentional manual-dispatch JSON null to the planner sentinel null, and the workflow test locks that shell contract. Manual dispatch remains profile=full, reason=manual_dispatch, and base=null; the planner regression roots the valid full plan at the selected SHA without diffing against null.

Independent tester verification passed the exact jq/manual-planner regression, make test-ci (602 tests), lint, format, and typecheck. Playwright/container checks are not applicable to this shell/planner contract change because it has no product-page render, runtime, deployment-mutation, image, or database impact. The amended candidate may be committed.

[alexeygrigorev]

P0 release-lane audit — 2026-08-24

Issues #219, #220, #221, and #222 have their intended code merged and tester/PM technical gates recorded; no additional engineering is indicated. Their remaining gates are human/on-call deployment, populated-database migration, readiness, smoke, and exact live identity evidence.

The strongest current evidence is push run 32689634458 for origin/main ef24863: all CI verification gates passed, but auto-capture-prior stopped before mutation with service_pending_nonzero for web. Publish and deploy were skipped. The non-mutating OIDC/ECS probe 32690654995 passed, but it is not deployment evidence. Live still serves 20260821-062421-11b2bd1 and health/ready is 503 with database unavailable.

Next lifecycle action: resolve or explicitly authorize the bounded development recovery for the static DATABASE_URL/RDS readiness boundary tracked by #191, then rerun the normal exact-main release controller and collect the remaining human gates. Do not bypass capture or revive merged engineering candidates. No repository or AWS state was changed by this audit.