[scott-lowe-vapi]

Support partial GitOps promotions using traffic splitting

Part of DEPLOY-205. 2 of 5: promote into a rollout org pins, publishes at 0%, then takes step 1.

What changes

transitionRun (src/promote-cmd.ts), via src/rollout-promote.ts, for changed assistants that already exist in the destination:

1. Preflight, after if (!apply) return false and before the check: gate, so a refusal costs no simulation run and writes nothing. It refuses a split set outside gitops (a manual split wins) and a Vapi for CX lock, and skips assistants that 404 or have no version. If a gate ran, it runs again after the gate and before promotionPlanApply, because the gate can take 300 minutes while the ticker or an abort writes.
2. Pin every assistant to the version serving now, with compare-and-set. Any pin that a fresh read and one retry can't land undoes the others and stops before the apply child runs, so nothing is ever published unpinned.
3. Apply child, unchanged. A publish under an explicit allocation appends nothing, so the new version lands at 0%.
4. In a finally: step 1 where a new version was published, or undo the pin (writing back exactly the row it replaced) where nothing was. An abort that landed meanwhile is left alone. The applied paths are recorded before any rollout error is thrown, so committed state always has its files.

Also:

• Deletes are never pinned, and an assistant with no state UUID goes live on create.
• Unsplit changes (tools, squads, structured outputs) are listed.
• An assistant the apply published without a pin is reported.
• --no-rollout publishes at once and releases gitops holds on the assistants it published, which is the revert path.
• --rollout-override (single transition only) pins a manual split on its largest share, never the canary.
• Each write carries a gitops-rollout … marker (src/rollout-marker.ts), the ramp's only state.

Evidence

tests/promote-rollout.test.ts drives promotionCommandRun against an in-memory allocation API with the platform's publish semantics (tests/rollout-fake.ts). It covers:

• the write order (pin, then publish with no system follow-latest row, then step 1);
• an apply that fails after one publish;
• dedup undo with no targets;
• preflight refusals before the gate;
• override on the largest share;
• a pin failing on assistant 2 of 3;
• a race retry;
• abort during the apply;
• a split, and separately an abort, written during the gate;
• deletes, creates and 404s;
• the --no-rollout variants;
• the unpinned-publish report.

631 tests pass.

🤖 Generated with Claude Code

[scott-lowe-vapi]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• feat(rollout): report each tick's ramps and fail the run when one is overdue #90
• feat(rollout): gate each ramp step on the new version's calls and errors #89
• feat(rollout): add the rollout ticker, its workflow and promotion's rollout input #88
• feat(promote): pin assistants around the apply so a rollout org ramps instead of cutting over #87 👈 (View in Graphite)
• feat(promote): add rollout config, traffic-allocation client and splitting probe #86
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.