Aegis Rollouts and Rollback

Overview

Axis exposes rollout control at `/api/rollouts/plan`, `/api/rollouts/apply`, and `/api/rollouts/rollback`.

The released v0.5.5 native catalog identifies executable options for each build. Verify the exact binary catalog and selected agents' runtime readiness before planning. A saved draft does not change active policy delivery.

Endpoint Assumptions

• Production auth and API host: https://axis.velikey.com (signin: https://axis.velikey.com/auth/signin).
• Non-production override: set AXIS_BASE_URL explicitly before running docs commands.
• Manual operator substitutions: provide tenant-scoped values for cookies, bearer tokens, agent IDs, and tenant slugs.

Actionable Steps

1. Save an exact versioned draft, select the environment and agent cohort, and preview its current revision.
2. Review the candidate, immutable previous version, membership, capabilities, fixed phases, health thresholds, and rollback baseline.
3. Explicitly apply the reviewed plan. Apply rechecks membership, draft revision, baseline, and fresh capability fingerprints in the same transaction.
4. Require every phase's acknowledgments and fresh version-attributed handshake observations. Zero traffic, stale reports, or missing acknowledgments do not establish success.
5. Retain operation IDs and audit records. Completion changes only the frozen cohort; later arrivals and other environments retain their existing baseline.

Use Axis's authenticated Crypto Policies workflow and current versioned request contracts. Legacy policy-ID-only examples and older SDK write methods do not express the catalog/draft contract.

Acknowledged recovery

Rollback restores the previous desired version and enters rolling_back. It reaches rolled_back only after every affected agent acknowledges restoration. Restoring an inactive baseline removes that policy through an acknowledged rollback delivery. Missing acknowledgments remain pending.

A newer deployment cannot be overwritten by an older rollback. Destination promotion requires a completed parent whose source cohort still runs that promoted version, plus a fresh review of the destination baseline.

Binary downgrade is separate: verify the signed binary/catalog pair against current and saved rollback policies. Restore a compatible baseline before returning to a catalog-unaware agent.

Validation Checks (Last Step)

# executable example
command -v curl
command -v jq
date -u +"%Y-%m-%dT%H:%M:%SZ"

Timestamp capture is useful when correlating rollout events to receipt timelines.

The authenticated, tenant-scoped Axis receipt API reports signatureValid for HMAC-SHA256 receipts. This uses Axis's shared-secret verifier, not a public-key signature for independent offline verification. A false or null result does not establish verified receipt integrity. Retain receipt IDs and API results alongside policy acknowledgments and observed TLS results.

Common Failure Modes

• Non-dry-run apply without `confirm=true` and `confirmation="APPLY"` is rejected.
• Rollback without `confirmation="ROLLBACK"` is blocked server-side.
• Operators capture plan/apply output but fail to persist receipt IDs for audit evidence.

Navigate Docs

Docs Index • Previous: Aegis Policies • Next: Axis Overview • Troubleshooting