feat(deploy): close candidate release set topology

2026-08-31 16:35:08 +03:00
parent e21eae7a99
commit 42285a55be
7 changed files with 234 additions and 28 deletions
@@ -0,0 +1,17 @@
+# GEN2-DEPLOY-004 candidate shadow secret capability gap
+
+Date: 2026-08-31
+
+The candidate Compose slot requires two distinct external, read-only Docker
+volumes: `assistant_candidate_notification_shadow_writer_secret` and
+`assistant_candidate_notification_shadow_reader_secret`. They are deliberately
+not aliases for the production notification writer or reader volumes.
+
+A read-only Docker volume inspection on `docker.cin.su` confirmed that both
+candidate-only volumes are absent. No secret values were read or emitted.
+
+The candidate ReleaseSet must not be started until the existing production
+secret control plane provisions both bounded artifacts with distinct values.
+This preserves the fail-closed, zero-external-delivery property of the shadow
+notification path. Stable containers and production notification artifacts
+were not modified.