This recipe carries one checked application root through planning, Build, release, interruption, reconciliation, and deliberate inspection.
Command outputs are illustrative end-product examples. Exact identifiers are owner-qualified references, shortened here only for readability.
1. Check the locked project
$ one check --root OrdersApi
checked parcelhub#OrdersApi@1
source parcelhub.one rev:8a31…
lock one.lock rev:41f2…
closure 7 semantic, 3 implementation, 5 provider requirements
report check:sha256:7c0d…Checking resolves the lock and validates semantic and implementation claims. It does not select a deployment provider, execute Build, or grant authority.
2. Test and invoke the exact operation
$ one test --root OrdersApi
12 passed; report test:sha256:31b9…
$ one invoke parcelhub.orders#Orders.Get@1 request.json
result ready
operation parcelhub.orders#Orders.Get@1
impl parcelhub.orders_impl#GetRust@1
receipt invoke:sha256:91ab…3. Explain and accept a physical plan
$ one plan --root OrdersApi --target local-release
candidate plan:sha256:ad14…
selected process host one.process#Supervised@1
selected state one.data.local#Transactional@1
selected transport one.http#Loopback@1
authority none
estimated monthly cost EUR 0.00$ one inspect plan:sha256:ad14… --subject state
requirement parcelhub.order_state#Orders@1
accepted one.data.local#Transactional@1
evidence conformance:sha256:11c2…
rejected one.data.memory#Ephemeral@1: durability unsatisfiedThe plan commits exact normalized configuration and evidence. It remains authority-free and cannot mutate the machine.
4. Build without reselecting
$ one build plan:sha256:ad14…
artifact artifact:sha256:2e77…
report build:sha256:cc80…
reproducible true
provenance provenance:sha256:0721…
sbom sbom:sha256:44a0…Build executes the locked action graph and produces owned artifact records. Artifact bytes alone are not Build evidence.
5. Create and apply a release plan
$ one observe local-release
observation observation:sha256:08dd…
$ one release local-release build:sha256:cc80…
release plan:revision:sha256:18f4…
build build:sha256:cc80…
provider_config provider-config:sha256:d891…
authority epoch:local-23
$ one approve plan:revision:sha256:18f4…
approval approval:sha256:991e…
$ one apply plan:revision:sha256:18f4…
operation deployment:operation:sha256:731c…
state awaiting_observationIf the apply response is lost, resume the same operation instead of issuing a new apply:
$ one reconcile deployment:operation:sha256:731c…
state reconciled
release release:sha256:f421…Deployment journals intent before dispatch, validates fresh matching authority, retains the fence, and reconciles provider observation.
6. Inspect from product to evidence
$ one inspect release:sha256:f421…
status healthy
plan plan:revision:sha256:18f4…
artifact artifact:sha256:2e77…
journal deployment:journal:sha256:c201…
postconditions satisfied
history history:fact-set:sha256:a883…$ one inspect why release:sha256:f421… --subject state
OrdersApi requires durable transactional Orders state
the release plan selected one.data.local#Transactional@1
the active binding matches provider configuration d891…
the latest independent observation is currentInspection does not create authority or invent absent evidence. A stale observation, revoked claim, unresolved reference, or missing receipt remains explicit.
Executable evidence
Developer Interface's owning ParcelHub lifecycle test executes native One invocation, exact Planning and Build evidence, local filesystem release, History facts, inspection, and idempotent resume through the public CLI:
cargo test -p one-cli --test parcelhub_lifecycle \
parcelhub_native_one_workflow_retains_interpreter_receipt \
-- --exact --nocaptureThe support-triage lifecycle independently proves the same generic release path for a native Rust application and selected agent/session providers:
cargo test -p one-cli --test custom_agent_lifecycle \
custom_agent_reaches_build_apply_inspect_and_history \
-- --exact --nocapture