fix: harden cross-org promotion safety

[dhruva-vapi]

Linear ticket

https://linear.app/vapi/issue/PRISM-1335/gitops-harden-cross-org-promotion-and-rollback-safety

Fixes PRISM-1335

Value

Vapi employees can now promote GitOps resources between orgs without truncating assistant state, leaking source-org references, or applying destructive flags that were not in the reviewed plan.

We found these failures during an NHS EU migration and confirmed the fixes against the real promotion and rollback flow.

Evidence of value

• A live EU-to-target promotion updated exactly the three reviewed resources, then returned an idempotent plan.
• Bootstrap loaded all 123 assistants and excluded the ignored resource.
• A 45-assistant targeted pull completed with bounded concurrency.
• Nested handoffs had zero unknown references and zero source-org UUID leaks.
• The corrected rollback restored all three target assistants exactly.

API Changes (including webhooks + events)

• Is this changing the public API?

  • Yes
  • No

• If yes, is it backward‐compatible?

  • Yes
  • No

Non backward-compatible changes might break customers' agents. Please proceed with care and notify the team.

Testing plan

Run the focused promotion, pull, resolver, scoped-apply, and snapshot tests plus the TypeScript build. Monitor future promotion runs for incomplete inventories, unexpected destructive flags, unresolved target references, retry storms, or rollback failures.

[dhruva-vapi]

• fix: harden cross-org promotion safety #48 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.