apply is the universal mutation boundary: begin or resume authorized
reconciliation of one exact reviewed plan.
Plans are immutable
Planning is read-only. A plan identifies exact semantics, requirements, providers, topology, artifacts, permissions, observations, costs, actions, and approval obligations.
If a material input changes, One produces a new plan. Apply never edits the old plan to make it fit.
Apply does not replan
Before mutation, apply verifies:
- the exact plan and selection lock;
- required approvals and grants;
- artifact digests, provenance, and signatures;
- permitted refreshed observations;
- action identities, fencing, and journal state.
It does not reselect a provider, rebuild an artifact, widen authority, or blindly repeat an unknown-outcome effect.
Reconciliation is durable
REC-IR journals deterministic actions and observed outcomes. Resume uses the same durable journal and action identities. Unknown external outcomes are reconciled before a repetition that could be unsafe.
Desired state, observed state, plan, approval, grant, action, receipt, history, and evidence remain distinct records.
Choose the control plane
The same contracts can be realized through:
- embedded apply with a durable journal;
- Kubernetes reconciliation;
- an exact GitOps projection for Argo CD or Flux;
- a persistent One controller;
- another conforming domain-specific control plane.
Exporting YAML, committing Git, submitting a resource, applying it, and proving convergence are separate receipted events.
Rollback is forward reconciliation
Rollback produces a new reviewed plan. Reversible actions can be reversed within their contracts; compensatable effects use new forward effects; irreversible consequences remain visible.
Canonical owner: Deployment.