ADR-0001: Two-CRD model — mutable Application, immutable Release

Status

Accepted

Context

Pagifier needs rollback today and canary/blue-green/preview deployments later, without redesigning the API machinery.

Decision

Two CRDs. Application is the long-lived identity of a project in an environment and carries only a pointer, spec.activeRelease. Release is created once per upload and never mutated: it snapshots the artifact reference and the fully resolved configuration.

Consequences

• Rollback is a pointer swap; no rebuild, no config re-resolution.
• Deployment strategies become "how many Releases receive traffic and in what proportion" — a routing concern layered on later without changing either CRD.
• History has a natural unit (the Release), mirrored to PostgreSQL because in-cluster Releases are eventually garbage-collected.
• Cost: two reconcilers instead of one, and a phase contract between them (Application deploys only Built/Deployed Releases).