Updates

Self-host updates are operator-run. An AI agent can prepare values and explain the process, but ordinary admin MCP does not get deploy or restore tools.

Release Contract

A release publishes:

• API image digest, for example ghcr.io/premierstudio/agentful-api@sha256:....
• Web image digest, for example ghcr.io/premierstudio/agentful-web@sha256:....
• Release manifest JSON containing those exact digests.
• Optional manifest SHA-256 for pinning the manifest bytes.

The updater rejects mutable image tags such as latest. Image references must use image@sha256:<64 hex chars>.

Run An Update

Prepare the host env once:

cp deploy/update.env.example .env.production
$EDITOR .env.production

Run a local manifest:

vp run release:update -- \
  --manifest deploy/update-manifest.example.json \
  --env-file .env.production

Run a published manifest:

vp run release:update -- \
  --manifest https://github.com/PremierStudio/Agentful/releases/download/v0.1.0/update-manifest.json \
  --expected-manifest-sha256 <64-hex-checksum> \
  --env-file .env.production

What The Updater Does

1. Validates the manifest.
2. Writes a generated env under .shop/release/.
3. Starts Postgres if needed.
4. Creates a pg_dump -Fc backup under .shop/backups/.
5. Pulls pinned API and web images.
6. Runs tracked SQL migrations from the pinned API image.
7. Starts API and web containers.
8. Health-checks both services.
9. Promotes .shop/release/current.env.

Agent Boundary

The update command is an operator tool. Do not add it to the normal admin MCP server. If an operations plugin later exposes updates, make it local-only, separately scoped, and confirmation-heavy.