0053. A release pins its image and its whole config
Status: accepted, 2026-10-30. Applies the vision's immutable releases (principle 4) to configuration; env becomes a
producer of watches (0021).
Context
The vision says a release never changes and rolling back is moving a pointer. apps' releases kept an image tag and the
names of their variables: every container a node made later — after a restart, a reboot, a move — read env's values
as they were at that moment and pulled whatever the tag pointed at then. A rollback during an incident caused by a bad
variable or a moved tag brought back the same variable or image. Nothing told a person that a running app used values
env had changed since, and nothing could redeploy the apps a changed secret affects.
Decision
- A release holds what it runs with: the image by the digest its node pulled; its settings (command, port,
resources, health policy, release command); and a snapshot of every variable and file — env's values as resolved at
the deploy, with the version of every set read, the app's own variables and secrets, the platform's — sealed in apps
and bound to the release. Every container made for a release, at any time, gets exactly that; building a desired
state never reads env.
- Rollback brings back code and config by default, code alone on request. Volumes, ports, names and a database's
password belong to the app, not to a release, and stay as they are.
- Drift is shown: env offers watches on its sets (through
kit/watch, ADR 0021's machinery in kit); apps shows
which variables changed since a live release, who changed them and when, and which of the app's own settings wait
for a release.
- Redeploy on change where asked: an app redeploys after env changes when set to — the default outside protected
environments — debounced and one at a time per node; elsewhere a person redeploys.
- Snapshots are kept for an app's 20 newest releases and every release live in the last 30 days; older releases
roll back code only.
Consequences
- apps holds sealed copies of the values its kept releases ran with: a second place secrets live, bounded by
retention. A rollback can bring back a value rotated since, and its confirmation names every one.
- env is read once per deploy instead of for every desired state: fewer secret reads in env's audit, and an env
outage no longer stops a rollback or a container's re-creation.
- env gains watches, deliveries and a list of consumers; apps becomes a watch consumer.
- A digest a registry deleted makes a rollback fail cleanly, leaving the app as it was.
- Design:
superpowers/specs/2026-10-30-apps-operations-design.md in this repository.