Workflows · Converge

upgrade.yaml

product workflow · the engine holds no product knowledge

apiVersion: cf/v1
kind: Workflow
metadata: { name: upgrade }

inputs:
  target_release: { type: string }
  canary:         { type: bool, default: auto }

tasks:
  preflight:
    operator: core.preflight
    params: { requires: "${spec.requires}" }

  compat_gate:
    operator: release.compat
    needs: [preflight]
    params: { release: "${inputs.target_release}" }   # signature + matrix

  backup_databases:
    operator: backup.databases
    needs: [compat_gate]
    params: { databases: "${release.databases}" }

  snapshot:
    operator: state.snapshot
    needs: [backup_databases]

  approve_ponr:                       # point of no return
    operator: core.checkpoint
    needs: [snapshot]
    params: { message: "Migrations are forward-only beyond this point" }

  migrations:
    operator: db.migrate
    needs: [approve_ponr]
    params: { strategy: expand-first }

  canary_rollout:
    operator: release.canary
    when: env.clusters > 1 && inputs.canary
    needs: [migrations]

  helm_rollout:
    operator: helm.release
    needs: [migrations, canary_rollout]
    params: { values_overlay: "${spec.overlays}", atomic: true }
    retry: { max_attempts: 3 }

  verify:
    operator: core.verify
    needs: [helm_rollout]

  smoke_tests:
    operator: product.hooks.postUpgrade  # product manifest, not engine
    needs: [verify]

  finalize:
    operator: release.finalize
    needs: [smoke_tests]

Inspector — dry run for meridian-health/prod

when:-pruned branches highlighted

canary_rollout skipped env.clusters > 1 → false for this environment.

Operator registry

named · versioned · JSON-schema'd params

helm.releaserolling Helm upgrade with atomic rollback · params: chart, values_overlay, timeout, atomicv3

terraform.applyplan-gated infrastructure convergence · params: dir, var_filesv2

db.migrateexpand-first schema migrations with rollback-safety flagsv2

core.checkpointresumable approval gate — BLOCKED is a state, not a failurev1

backup.databasesmanifest-declared DB dumps + tfstate + state + secret inventoryv2

…36 more. Every operator: Check → Run → Verify → Recover, journaled, resumable, formally verified step semantics.

Authoring — humans, CI, or an AI agent

authoring agent ──emits──▶ workflow.yaml ──▶ cf workflow lint ──▶ cf run
 (any model, net OK)        (reviewable,       (schema + expr
                             diffable)          + DAG + policy)

An AI-authored workflow passes the identical gates as a human-authored one: schema validation, when: type-check, cycle detection, and policy. There is no drag-and-drop editor — YAML is the only authoring surface.