Coming soon — stub
This page is a placeholder. The pull-agent hasn't shipped yet — see the
parent CI/CD for internal apps
for the model, or .claude/features/deploy-pipeline/research.md
§ D3 for the decision rationale (custom pull-agent vs. Ansible vs.
Komodo vs. k3s+ArgoCD).
What this page will cover
- What the agent runs on each tick —
git pullagainst the deploy key, rsync-with-checksum + atomic mv into~/.config/containers/systemd/,systemctl --user daemon-reload, restart of units whose source changed. - The timer cadence (
OnUnitActiveSec=2minproposed) and how to tune it. - Reconciliation atomicity: how the agent stages changes so a mid-tick crash doesn't leave the host half-applied.
- Auth: deploy-key provisioning, podman secret storage.
- Debugging a stuck reconcile —
journalctl --user -u shyft-pull-agent -epaths and the common failure modes. - Interaction with
podman-auto-update.timer: which lane handles config vs. image, why both can coexist safely. - Lock semantics: what happens if the agent fires while a previous run is still in flight.
Until then
The shape is sketched at
§ Config flow on the parent
page. The implementation lives in
.claude/features/deploy-pipeline/plan.md § P3.