24-Aug-2026 — stop wrong-image deploys with tag validation, build assertion and estate health monitoring #362

build 850 — commit eefbc82

What's new

Estate deploys now prove they shipped what was asked for. The deploy workflow refuses an image tag that is not latest or a recent successful Docker build number, the deploy itself checks each site is serving the requested build before reporting success, and a scheduled health check watches every environment round the clock. Follows the 23 Aug outage where a run number read from the wrong workflow deployed a February image to every site.

At a glance

• Deploy to Selected Environments validates image_tag before any environment deploys: latest or a run number from the last 100 successful Docker builds; anything else is refused with the correct lookup command in the error
• A deliberate rollback to an older image is still possible with the new allow_old_image input
• After each environment deploys, the job fails unless the app's /api/version reports the requested build number
• A new Estate Health Check workflow polls every environment's /api/version every 15 minutes and fails when any site is down, with one retry to ride out blips
• AGENTS.md: destructive operations need an explicit same-session instruction, and image tags must come from the Docker build workflow only