EVULGARE

IMPLEMENTATION RECORD · SYNTHETIC TECHNOLOGY DEMONSTRATION

Complete-Root cPanel Deployment Cutover

Implementation record for archive verification, safe staging, complete-root replacement, runtime-integrity checks, liveness/readiness endpoints, rollback preservation, and bounded production-host evidence.

Open the deployment cutover centerOpen the deployment cutover APIResearch-to-software traceability →

Complete-Root cPanel Deployment Cutover — Evulgare 2.0.0-rc.9-WIP

Purpose

RC9 adds a deterministic, non-destructive cutover contract for replacing a stale or mixed cPanel application root with one complete Evulgare release. The contract is designed around the historical failure in which cPanel’s generated passenger_wsgi.py loaded itself recursively. The distributable archive therefore continues to exclude passenger_wsgi.py; cPanel owns that wrapper, while cpanel_app.py is the configured startup module and application is the entry point.

The cutover system does not deploy the release automatically. It does not alter MySQL, change cPanel settings, restart Passenger, or promote a release. It verifies and stages evidence so an authorized operator can perform those actions deliberately.

Immutable package identity

The repository-controlled build record identifies:

  • release 2.0.0-rc.9-WIP;
  • Python 3.13.14;
  • application root evulgare.com;
  • empty application URL path;
  • startup module cpanel_app.py;
  • entry point application;
  • public URL root /;
  • synthetic terminal SYNTHETIC_NULL_SINK.

A stale environment APP_VERSION can no longer make a newer package identify itself as an older release. A mismatch is exposed as deployment drift.

Runtime-integrity manifest

app/content/release/runtime-integrity.json records byte counts and SHA-256 digests for the bounded files that define the WSGI, Flask, release-identity, simulation-catalog, workbench, JavaScript, CSS, and cPanel startup path. The manifest does not replace the full release manifest; it provides a fast, bounded readiness check.

The runtime verifier also checks the cPanel-owned Passenger wrapper when one exists:

  • a missing wrapper is correct inside the distributable ZIP;
  • a wrapper pointing to cpanel_app.py is accepted on the host;
  • a wrapper that loads passenger_wsgi.py recursively is rejected;
  • an unrecognized wrapper remains a readiness failure.

Liveness and readiness

RC9 separates three public contracts:

  • /livez — the process can load immutable package identity and the bounded integrity verifier;
  • /readyz — critical bytes match, configured version does not conflict, MySQL is reachable, and the ten-record simulation catalog is ready;
  • /healthz — a combined human- and machine-readable summary containing both liveness and readiness state.

A live process may still be unready. The endpoints are Cache-Control: no-store.

Cutover sequence

  1. Back up .env, MySQL, and the current application root.
  2. Verify the ZIP without extracting it into the active root.
  3. Extract to a separate empty staging directory.
  4. Verify the staged build identity, critical hashes, root layout, and forbidden-file rules.
  5. Stop Passenger and replace the active root with the complete staged tree.
  6. Restore the private .env without adding it to the archive.
  7. Install production and development requirements in the Python 3.13.14 virtual environment.
  8. Run Alembic upgrade and idempotent seeding.
  9. Run full-stack diagnostics, runtime integrity, deterministic proofs, .uai validation, preflight, and pytest.
  10. Restart Passenger.
  11. Probe live candidate routes, headers, release identity, database reachability, and Simulation Explorer readiness.
  12. Preserve a bounded production-host evidence candidate for explicit review.

Safe tools

python scripts/cpanel_release_cutover.py plan prints the contract without changing state.

python scripts/cpanel_release_cutover.py verify-archive RELEASE.zip verifies the archive.

python scripts/cpanel_release_cutover.py stage RELEASE.zip STAGE_DIRECTORY extracts only to a separate empty directory and verifies it. It does not activate the stage.

python scripts/probe_candidate_deployment.py --expected-version 2.0.0-rc.9-WIP performs a read-only outside-in probe and retains only bounded statuses, selected non-secret headers, byte counts, and body fingerprints.

Rollback boundary

Rollback is not automatic. The pre-cutover root, private environment, and database backup remain preserved until live acceptance completes. A rollback restores technical state; it does not erase evidence of the failed cutover or establish that downstream effects were remedied.

Public-safety boundary

The cutover tools do not control vehicles, select targets, issue payload or weapon commands, create force authorization, contact operational systems, or persist public simulation inputs. The public simulation platform remains synthetic, normalized, educational, assurance-oriented, and bounded by SYNTHETIC_NULL_SINK.