Abstract
This document discloses a post-deploy reconciler that keeps a single, high-blast-radius production workload converged to an authorized image without reverting legitimate, healthy, out-of-band deployments. A short-interval reconciliation job reads a mutable, agent-writable in-cluster authority record — carrying an authorized image, a deploy-in-progress flag, a holder identity and a reason — and compares it against the live workload's running image and the readiness of its serving pod. The reconciler's corrective action is gated on a conjunction predicate: it reverts the workload to the authorized image only when the running image differs from the authorized image AND the serving pod is not ready. An image that drifts from the record but is healthy and serving traffic is tolerated — the reconciler reconciles the record to the reality (adopting the running image as newly authorized) instead of inducing an outage by reverting. A deploy-in-progress suspend handshake makes the reconciler stand down while an authorized rollout is mid-flight, and a forced deletion of Pending pods breaks the single-writer-volume attach deadlock that otherwise prevents recovery. The mechanism is disclosed here, dated 2026-07-03, together with clean-room reference code, to establish enabling public prior art.
Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.
Recommended Citation
Assuncao, gustavo matthew, "Health-Gated Deploy-Authority Reconciler", Technical Disclosure Commons, ()
https://www.tdcommons.org/dpubs_series/10940