01 — UI Operator Deploy Pack

Classification: READY (executable the moment operator GitHub creds are available). Sole blocker: UI_DEPLOY_BLOCKED_BY_GIT — no agent git credentials + divergent local git. This is an OPERATOR blocker, not an engineering blocker. DB-side readiness is already PASS.

Target artifact

• Branch: feat/rp-current-supervision
• Commit: d04d8e5624f92d26b868c93adc50fca5e2f07b7f (short d04d8e5)
• Worktree: /opt/incomex/docker/nuxt-repo/web-rp-current (tracked tree clean; only gitignored lint configs are untracked — not committed-tree drift)
• Main UI repo: /opt/incomex/docker/nuxt-repo/web
• Feature diff vs parent: 20 files, +1261 lines, additive (0 deletions, 0 conflicts vs origin/main)
• Container to rebuild/restart: incomex-nuxt (image family nuxt-ssr-local:sNNN)
• Remote: https://github.com/Huyen1974/web-test.git (https, no token helper installed)
• Git divergence: local main 17 ahead / 13 behind origin/main (noise; patch is additive and applies clean)
• Patch artifact: /opt/incomex/docs/mcp-writes/rp-ui-current-2026-06-05/rp-current-supervision.patch

Exact deploy sequence (two operator paths)

Path A — push branch + PR (needs operator GitHub creds)

1. Operator supplies creds (Secret Manager / gh auth login).
2. Rebase feature onto origin/main to shed the 17/13 divergence noise, OR cherry-pick d04d8e5.
3. git push origin feat/rp-current-supervision → open PR → CI (eslint/prettier/nuxt build/typecheck) → merge.

Path B — apply patch onto a clean origin/main checkout (preferred; sheds divergence)

1. git checkout -b rp-current origin/main
2. git am /opt/incomex/docs/mcp-writes/rp-ui-current-2026-06-05/rp-current-supervision.patch (additive, applies clean — 0 target paths exist in origin/main)
3. push → PR → CI → merge.

Rebuild + restart (both paths, after merge/checkout)

• docker compose -f docker-compose.local.yml build incomex-nuxt
• docker compose -f docker-compose.local.yml up -d incomex-nuxt

Container health

• docker ps / list containers → confirm incomex-nuxt is Up and healthy.
• Note executor /health returns 404 on the wrong path — 404 ≠ down (historical gotcha).

11-route post-deploy HTTP smoke (run after deploy; expect 200 + JSON)

All bind _current views only (never the generated view). Curl through the live host:

1. /api/registries-pivot/deploy-guard (must be PASS / db_side_ready)
2. /api/registries-pivot/acceptance-current
3. /api/registries-pivot/axes
4. /api/registries-pivot/contract-current
5. /api/registries-pivot/invariant-current (invariant_status must carry; UI fail-closes on real-fail)
6. /api/registries-pivot/proof-current
7. /api/registries-pivot/count-reliability-current
8. /api/registries-pivot/static-literal-current
9. /api/registries-pivot/node/<axisCode>/<nodeCode>
10. /api/registries-pivot/node/<axisCode>/<nodeCode>/children
11. /api/registries-pivot/node/<axisCode>/<nodeCode>/substrate

• Page: /knowledge/registries-pivot/current (withholds body unless deploy-guard PASS).
• Acceptance assertion: a known real-fail node must render CRITICAL, not green (no false-green).

Deploy guard (DB-side; already PASS — run BEFORE and AFTER deploy)

• Function-backed, crash-safe: fn_rp_ui_deploy_final_readiness_guard() — verdict carries UI_DEPLOY_BLOCKED_BY_GIT + db_side_ready=true (the git-block is the only open item).
• DB-side smoke (no deploy needed): fn_rp_ui_current_production_acceptance() → 15/15, PASS, 6/6 anti-false-green.
• Secondary guard view: v_rp_contract_current_guard → PASS, 87==87 live-derived, alias 7/7 valid, stale-v1 0.
• IMPORTANT (OOM): run these via ssh psql with statement_timeout=0. Under the MCP query_pg 5s wrapper the guard function's smoke-probe gate will hit a statement-timeout (observed 06:23 UTC) — that is a timeout, NOT a crash, but it blocks getting the verdict. See doc 03.

Rollback

• DB OOM/landmine objects: /opt/incomex/docs/mcp-writes/rp-ui-operator-deploy-decorated-generator-2026-06-05/99_rollback.sql (WARNING: that rollback restores the landmine acceptance dashboard — do NOT query it after rollback).
• UI rollback: redeploy the prior incomex-nuxt image, or git revert the merge / un-merge the PR.

NO-GO conditions

• Deploy guard != PASS, OR invariant real-fail > 0, OR static stale > 0, OR smoke != 15/15, OR anti-false-green != 6/6.
• Any CRASH_LANDMINE present in v_rp_oom_landmine_detector.
• Push/deploy over divergent git without an operator rebase decision.

Gaps / ambiguities (minor)

• AMBIGUOUS: exact docker compose file/flags and the live base-URL/host for the 11 curl routes are not pinned in the runbook (compose file docker-compose.local.yml is named; the curl host should be confirmed by the operator against the running nginx/host mapping).
• MISSING_COMMAND: no scripted one-shot smoke harness — the 11 routes are run manually. A curl loop could be added but is not required for execution.
• These do not block execution; they are the only items T1 may want to tighten post-deploy.