fix(operator): record the automatic pre-submission approval too

sean commented

2026-08-15 22:42:25 +00:00

Owner

The -git2 master roll died at verify-deploy-intent: it requires an approved gate=approval decision and automatic Environments never recorded one. syncDeploymentDecisions now records the submission act as an Environment-attributed automatic approval decision, uniform across adapters; a human denial still stays terminal. Red-green envtest.

sean added 1 commit

2026-08-15 22:42:25 +00:00

fix(operator): record the automatic pre-submission approval too

pipeline/ci CI green @ 3f8a365ed9b3

Details

3f8a365ed9

The -git2 master roll got past validate-request and died one step
later: verify-deploy-intent requires an approved decision on gate
'approval', and an automatic Environment never recorded one — its
approval act was the submission itself, invisible to the template and
to audit alike.

syncDeploymentDecisions now records that act: when the Environment
declares automatic and no approval-gate decision exists, it appends
an approved automatic decision attributed to the Environment (same
attribution shape as the canary decision). It never writes over an
existing approval-gate decision, so a human denial stays terminal
even in automatic mode. This is uniform across adapters — every
automatic Deployment now carries a recorded, attributed
pre-submission approval, which is what the audit trail should have
shown all along.

Red-green in envtest; the argocd/flux/noop specs now assert both
decisions.

pipeline-bot merged commit 3f8a365ed9 into trunk

2026-08-15 22:45:18 +00:00

Rows
Columns

fix(operator): record the automatic pre-submission approval too #2057