Agent contract

ck-deploy

Provider-neutral agent that manages deploy surfaces (vercel today; tauri and npm declared for future) with evidence-based approval gates on promote and rollback.

Role: deterministic-hybrid-deploy-policy
Fibonacci level: L5
Module version: v0.1.0
Author: chiralkit
Created: 2026-08-22
Dependencies: None declared

Input

Required fields

requested_action
target
repository
source_ref
environment
declared_scope
expected_target_state_before
expected_new_artifact_identity
approval
lifecycle
build
artifact
target_state
gitnexus
sentrux
verification

targets: vercel
tauri
npm
approval: authorized_action
reason_codes
target
repository
source_ref
environment
declared_scope
expected_target_state_before
expected_new_artifact_identity
lifecycle: phase
lifecycle_phases: pre_promote
post_promote
post_publish
aborted
build: exit_status
artifact_hash
artifact_bytes
expected_files_present
unexpected_files_present
artifact: identity
signature_verified
provenance_source_ref
target_state: fresh_fetched
current_artifact_identity
current_environment
reachable
gitnexus: risk
index_current
sentrux: status
verification: passed
post_promote_passed
smoke_probe_passed

Output states and sections

terminal_states: ready
approval_required
blocked
promoted
published
rolled_back
no_change
aborted
policy_decision_fields: status
risk
reasons
permitted_actions
approval_action
approval_requirement
required_fields: repository
target
source_ref
environment
build
artifact
target_state
gitnexus
sentrux
verification
risk
lifecycle
approval
performed_actions
pending_action

Behavior and invariants

actions: assess
prepare
promote
rollback
abort
targets_supported: vercel
targets_declared: vercel
tauri
npm
policy_responsibility: deterministic_authorization_only
agent_responsibility: collect_normalized_evidence_and_render_full_result
provider_dependencies: false
command_execution: false

Capabilities

Required capabilities

filesystem.read: Inspect repository instructions, build outputs, and artifact metadata.
shell.execute: Run bounded, non-interactive build and publish commands.
git.inspect: Resolve the source ref that produced the artifact for provenance.
verification.repository: Discover and run scope-appropriate checks before promote.
quality.sentrux: Run quality analysis and parse its result.
code-intelligence.gitnexus: Query impact and changed execution flows on the source ref.
approval.request: Stop and obtain explicit human authorization for promote and rollback.
vercel.deploy.assess: Dry-run a Vercel deployment for the given source ref and environment.
vercel.deploy.publish: Publish a prepared Vercel deployment to the target environment after approval.
vercel.deploy.rollback: Alias a previous Vercel deployment as the target environment's live artifact after approval.

Optional capabilities

None declared

Runtime entries

Canonical entry

agent.md

Adapters

claude-code: adapters/claude-code.md
codex: adapters/codex.toml

Complete validated contract JSON

{
  "role": "deterministic-hybrid-deploy-policy",
  "input": {
    "required": [
      "requested_action",
      "target",
      "repository",
      "source_ref",
      "environment",
      "declared_scope",
      "expected_target_state_before",
      "expected_new_artifact_identity",
      "approval",
      "lifecycle",
      "build",
      "artifact",
      "target_state",
      "gitnexus",
      "sentrux",
      "verification"
    ],
    "targets": [
      "vercel",
      "tauri",
      "npm"
    ],
    "approval": [
      "authorized_action",
      "reason_codes",
      "target",
      "repository",
      "source_ref",
      "environment",
      "declared_scope",
      "expected_target_state_before",
      "expected_new_artifact_identity"
    ],
    "lifecycle": [
      "phase"
    ],
    "lifecycle_phases": [
      "pre_promote",
      "post_promote",
      "post_publish",
      "aborted"
    ],
    "build": [
      "exit_status",
      "artifact_hash",
      "artifact_bytes",
      "expected_files_present",
      "unexpected_files_present"
    ],
    "artifact": [
      "identity",
      "signature_verified",
      "provenance_source_ref"
    ],
    "target_state": [
      "fresh_fetched",
      "current_artifact_identity",
      "current_environment",
      "reachable"
    ],
    "gitnexus": [
      "risk",
      "index_current"
    ],
    "sentrux": [
      "status"
    ],
    "verification": [
      "passed",
      "post_promote_passed",
      "smoke_probe_passed"
    ]
  },
  "output": {
    "terminal_states": [
      "ready",
      "approval_required",
      "blocked",
      "promoted",
      "published",
      "rolled_back",
      "no_change",
      "aborted"
    ],
    "policy_decision_fields": [
      "status",
      "risk",
      "reasons",
      "permitted_actions",
      "approval_action",
      "approval_requirement"
    ],
    "required_fields": [
      "repository",
      "target",
      "source_ref",
      "environment",
      "build",
      "artifact",
      "target_state",
      "gitnexus",
      "sentrux",
      "verification",
      "risk",
      "lifecycle",
      "approval",
      "performed_actions",
      "pending_action"
    ]
  },
  "behavior": {
    "actions": [
      "assess",
      "prepare",
      "promote",
      "rollback",
      "abort"
    ],
    "targets_supported": [
      "vercel"
    ],
    "targets_declared": [
      "vercel",
      "tauri",
      "npm"
    ],
    "policy_responsibility": "deterministic_authorization_only",
    "agent_responsibility": "collect_normalized_evidence_and_render_full_result",
    "provider_dependencies": false,
    "command_execution": false
  }
}