# Deploy and apply

`apply` is the universal mutation boundary: begin or resume authorized
reconciliation of one exact reviewed plan.

## Plans are immutable

Planning is read-only. A plan identifies exact semantics, requirements,
providers, topology, artifacts, permissions, observations, costs, actions, and
approval obligations.

If a material input changes, One produces a new plan. Apply never edits the
old plan to make it fit.

## Apply does not replan

Before mutation, apply verifies:

- the exact plan and selection lock;
- required approvals and grants;
- artifact digests, provenance, and signatures;
- permitted refreshed observations;
- action identities, fencing, and journal state.

It does not reselect a provider, rebuild an artifact, widen authority, or
blindly repeat an unknown-outcome effect.

## Reconciliation is durable

REC-IR journals deterministic actions and observed outcomes. Resume uses the
same durable journal and action identities. Unknown external outcomes are
reconciled before a repetition that could be unsafe.

Desired state, observed state, plan, approval, grant, action, receipt, history,
and evidence remain distinct records.

## Choose the control plane

The same contracts can be realized through:

- embedded apply with a durable journal;
- Kubernetes reconciliation;
- an exact GitOps projection for Argo CD or Flux;
- a persistent One controller;
- another conforming domain-specific control plane.

Exporting YAML, committing Git, submitting a resource, applying it, and proving
convergence are separate receipted events.

## Rollback is forward reconciliation

Rollback produces a new reviewed plan. Reversible actions can be reversed
within their contracts; compensatable effects use new forward effects;
irreversible consequences remain visible.

Canonical owner:
[Deployment](https://github.com/muijf/one/blob/main/systems/deployment/AGENTS.md).