feat: gate upgrades with compatibility matrix

2026-07-18 00:17:45 +07:00
parent d129ba60ef
commit 407d373b4e
6 changed files with 107 additions and 0 deletions
@@ -0,0 +1,18 @@
+# Upgrade and Rollback Runbook
+
+The compatibility gate is mandatory before every deployment or rollback:
+
+```bash
+bash packages/casan-harness/scripts/bash/upgrade-compatibility.sh check \
+  --from 1.0.0 --to 1.0.1
+```
+
+Only an explicit rule in `compatibility-matrix.json` can permit a version pair.
+Before rollout, verify provenance, create and verify a state backup, smoke the
+extracted artifact, deploy immutable image digests, and verify an Evidence Pack
+after deployment. A rollback requires the same gate with `--rollback`, plus an
+approved change record and a verified backup.
+
+Do not infer compatibility from matching image tags, passing unit tests, or
+successful container startup. Add and review a new matrix entry before any
+cross-minor or cross-major migration.