[witbrock]

Merge decision: ready — authorised DGX deployments can select a complete worker/backend release for the next invocation, preserving the loaded release and a recoverable predecessor. Live activation remains pending operator bootstrap.

User outcome

New worker scripts previously imported an older backend and silently lost task-specific reasoning settings. PR #641 repaired task creation and detects that mismatch; this continuation supplies the durable installation path for JVNAUTOSCI-2750.

Material changes

• Prepare independent, versioned checkouts containing backend, worker, inbox, prompts and deployment helpers. Atomically replace the current symlink after local/public web health checks, retaining the previous release in the deployment receipt.
• Pass the controller's existing worker lock into deployment. Reconcile interrupted activation and attempt both worker and web recovery, even if one recovery fails.
• Add a read-only installed-adapter task check and a scheduled-startup provenance receipt. Preserve task-specific model/reasoning settings and distinguish selection, startup, eligibility and pickup.
• Document the one-time operator bootstrap, descriptor forwarding, existing schedule preservation and rollback.

No new model routing, task workflow, scheduler, database migration or credential handling is introduced.

Evidence

pdm run pytest -q tests/test_codex_von_release.py tests/test_codex_von_deploy.py tests/backend/test_codex_von_worker.py tests/backend/test_codex_von_inbox.py tests/test_deploy_local_main.py: 78 passed.

Fixtures exercise real Git release preparation, the installer CLI, a fresh process importing the selected worker and backend, inherited cross-process locking, unchanged loaded files, rollback, interrupted deployment, revoked authority, task point/list parity and exact Astra/high resolution through the adapter. They launch no models or production work. Black (Python 3.10 target) and git diff --check pass.

Ship boundary

Minimum merge evidence is coherent source selection, lock preservation, recoverable failure and truthful preference/provenance read-back. Wrong checkout selection, clobbered active files, lost task settings or false activation claims block shipment.

Live release acceptance remains outstanding: the coding sandbox cannot change operator-owned wrappers/configuration or activate services. Read-only host checks found /home/mjw/Von-runtime-main at 847aeee348b00ce81aa55fac1f82d0a547f309c5, the old source clone at ab7394ae7c6caa168bf643e616f5772b784feea6, and no releases/current pointer or worker runtime receipt. Those checkout observations do not prove the served revision. The operator must bootstrap the documented route, verify actual scheduled adapter settings and next-run module paths, and have the controller deploy and verify the merged revision. Keep JVNAUTOSCI-2750 open until those receipts exist. Jira access currently requires connector reauthentication.