Preview releases

A release contains an immutable image digest, validated backify.lock.json, migration checksums and optional frontend files. CI uploads it once. Preview and production deployments reference the same unchanged release.

The pipeline validates, plans, provisions, runs migrations, stages roles and checks health. The web role uses revisions: traffic moves only after the staged revision is healthy. A failed stage must not replace the active release.

Use backify ship for preview. Plain deployment requests are preview-only. Production requires an explicit user request to deploy to production and uses backify ship --production-deploy, subject to testing and approval policy. Approval to merge, push or retry does not authorize production.

Promotion refuses a changed image, lockfile or migration history (release_changed), or changed production plan (production_plan_changed). Production migrations take a backup first. Release health monitoring can return traffic to the previous healthy revision; schema rollback and destructive migration safety still need application-specific planning.

The portal Backend and Jobs pages describe the active release, including OpenAPI, schedules, subscriptions and run history. This version has one preview environment per app; per-PR environments are a follow-up.

Report verified URLs only; label existing production separately when changes are preview-only. Never fabricate deployment health or bypass approval. See build contract and runtime contract.