---
key: release.promotion-floating-prod
title: '2026-07-13 — Release promotion: floating `:prod`, exact-image scan before manual deploy (#335)'
status: active
since: '2026-07-13'
supersedes: none
superseded-by: none
rule: Prod tracks the floating `:prod` image reference; a tag build's immutable `:<version>` image is scanned first, then promotion happens via a separate manual `DeployStack`, with daily auto-update only as a fallback — tag with enough runway before 03:00 to avoid an unscanned promotion.
signals: 'floating prod tag, exact-image scan, manual promotion · paths: Komodo `DeployStack` · issues: #335, server-management#585, server-management#589'
mechanics: '`docs/ci-cd.md` → Versioning & releases'
---

Prod keeps the floating `:prod` image reference; PR #191's workflow-driven immutable pin bump is
closed as superseded. server-management#585 proved that automatic and manual promotions share
`DeployStack` and made a changed `:prod` digest trigger the fail-closed backup; #589 added the
prod-copy migration smoke before live recreation. Tagging and promotion remain separate: scan the
tag build's immutable `:<version>` image, then deploy manually. Daily auto-update is only a fallback,
so cut tags with enough runway before 03:00 to prevent an unscanned promotion. Refs #335 and
server-management#585/#589.
