/deployment

Record, inspect and compare the deployments you operate — what exists, what each one runs, where it is hosted. Read-only reconnaissance; for CHANGING a deployment follow /deployment-activity instead. Every change to an instance goes through memex, never by hand-editing the config repo or patching the cluster.

• Instructions: # /deployment Record, inspect and compare the deployments you operate. Use this when someone asks what deployments exist, what one of them runs, where something is hosted, or asks you to record a new one. For *changing* a deployment, follow [`/deployment-activity`](deployment-activity.md) instead. ## 🚨 ADMINISTER AN INSTANCE THROUGH MEMEX — NEVER DIRECTLY > **Every change to an instance goes through memex — the MCP or the GUI. Never by hand-editing the > config repository on GitHub, and never by patching the cluster with `kubectl` / `az aks command > invoke`.** The mesh is the control plane: it holds the records, and it is what writes the repo and the cluster. **How it writes: memex opens a PULL REQUEST on a FEATURE BRANCH of the config repository** — never a direct commit to its default branch, and never a live `kubectl apply`. So an instance change is reviewable before it exists, the repo stays the 1:1 description of what is deployed, and the roll is the merge rather than a side effect somebody performed by hand. A direct edit bypasses the thing that knows what "correct" is, and it fails in two ways that both look fine at the time: - **A cluster patch is DRIFT.** `values.<env>.public.yaml` in the config repo is *captured from the live release* (`helm get values`) and compared against the cluster by a chart-drift gate. A hand-patched cluster is a gate failure someone else has to reconcile, without knowing what you intended. - **A repo edit skips the checks the record can make.** The deployment record knows the vault, the secret prefix and the config path; it can answer "will the pod actually see everything it needs?" BEFORE a roll. An edit made straight on GitHub answers that question after the pod fails to start. The one exception is **break glass** — the control plane itself cannot act (its operator is not live, or the control instance is what's down) and the change cannot wait. Then the direct path is allowed and creates a debt the same session…
• Auto mount: yes
• Launches sub thread: no