Id Rollback

Original name

Original description

The infra-delivery INCIDENT safe-revert PROCEDURE skill (the recurring/incident rollback step) — the PROCEDURE the generic agent runs when a delivered change did NOT land (a NOT-LANDED realization, an escaped defect, bad config) to restore the last-known-good IaC and prove reality matches it again. The shape is git revert -> reconcile -> verify-landed: revert the offending commit via the governed /foundry:revert (restoring the prior authorized IaC — the reused prior authorization, NOT a no-skip bypass; still subject to the merge floor), drive the GitOps controller''s idempotent reconcile toward the REVERTED IaC PINNED to the reverted commit''s candidate_sha (the merged-HEAD pin, never an arbitrary HEAD), then run the realization read and RECORD the realization observation via the DEDICATED post-deploy producer emit_realization_evidence(*, change_scope, candidate_sha, post_apply_plan_results, argocd_status, artifact) (scripts/foundry_realization.py, DC3 — a real, live producer) — recording {candidate_sha, post_apply_plan_empty, argocd:{applicable, sync_status, health_status}, artifact:{applicable, deployed_identity, merged_commit}} that derive_realization_verdict consumes — confirming LANDED iff post_apply_plan_empty AND (argocd NA OR Synced ∧ Healthy) AND (artifact NA OR identity-match) against the reverted IaC. The mutation is POSTURE-GATED (delegated to ctx-posture / id-apply EXECUTE | GENERATE_RUNBOOK | VERIFY_ONLY | REFUSE — never break-glass, never a mutating verb of its own; guarded prod GENERATES the revert runbook for the operator). ADVISORY observe-and-record (the realization read is NOT a merge-floor verdict the skill self-certifies; the merge floor — branch protection + CI checks, see docs/merge-floor.md — governs the revert''s reused authorization); NOT-LANDED is a tracked incident state surfaced, never force-reverted blindly / papered over.