v0.18.2

Upgrading to 0.18.2 — the deploy now reads production back, and refuses on a mismatch

Wave 1 of the quality retrospective: the mechanisms that make the rules from 0.18.1 actually run.
Most of this release is build-time machinery with no runtime surface. One item is not, and it is
the reason this note exists.

If you deploy from GitHub Actions, do this first

The workflow now takes the target instance from a repository variable named INSTANCE_ID
(Settings → Secrets and variables → Actions → Variables, not Secrets). Without it the deploy
step refuses by name in a few seconds rather than failing later against AWS. A variable rather than
a secret is deliberate: a masked value would make a typo look correct in the log.

The deploy verifies itself

After applying configuration, the deploy now reads the running box back and fails on a
mismatch. Five checks: memory ceilings, environment keys, application identity, Grafana health and
configuration-drift freshness. There is a --verify-only mode that re-reads without deploying, a
metric per check, and an alert that reads them per check rather than as a roll-up.
Details.

Third-party output from the box is no longer republished into the public Actions log. Only lines
the deploy script wrote itself are shown; everything else is counted and named, with the command to
read it privately.

Everything else is the build

Rules that refuse a test which cannot fail, an enumeration harness so a guard covers every door of
its kind rather than the one that was reported, the documented gotchas turned into executable
architecture rules, a contract requiring every timer and alert to name what observes it, a lint
rule set for the interface, and a guard that refuses a suite which quietly ran less of itself than
the repository contains.

For self-hosters building from source: the build is stricter than before and will refuse things it
used to accept. None of it affects a running instance.

---

Full Changelog: v0.18.1...v0.18.2