checkId: check.release.environment.matches-approved plugin: stellaops.doctor.release severity: warn tags: [release, estate, drift, deviation, deployment]

Environment Matches Approved Releases

This Doctor check verifies that the container digests reported by environment agents still match the approved deployed-estate digests. It also reports release-estate deviations raised when new findings make an already-deployed release regress its gate verdict.

What It Checks

The check reads /api/v1/release-orchestrator/estate/status and evaluates:

Digest drift: an agent reports a running digest different from the approved release digest.
Estate deviations: a deployed release has regressed against current finding data.
Observation coverage: a deployed estate with no agent reporting running digests is skip/unobserved, never a false pass.
Authentication: HTTP 401 or 403 is skip because the estate could not be verified.

No deployed components is a valid pass. Any drift or outstanding deviation is a fail. A non-empty estate passes only when at least one agent is observing it, all observed digests are in sync, and no deviation is outstanding.

Evidence collected: deployed_components, observing_agents, drift_count, in_sync_count, unobserved_agents, and estate_deviations.

The check requires ReleaseOrchestrator:Url or Release:Orchestrator:Url to be configured.

Why It Matters

Approval proves what Stella Ops intended to deploy. Agent observation proves what is actually running. A mismatch can mean an out-of-band redeploy, mutable-tag drift, or a compromised runtime. A later estate-finding deviation means the running digest has become unacceptable under current security evidence even though its original release decision passed.

Common Causes

An operator redeployed a different image outside Stella Ops.
A mutable tag resolved to a new digest.
An environment agent has stopped sending digest observations.
New vulnerability or reachability evidence regressed a deployed release verdict.
Doctor cannot authenticate to the Release Orchestrator read endpoint.

How to Fix

# Inspect drift rows and their approved/observed digests.
curl -s "$RELEASE_ORCHESTRATOR_URL/api/v1/release-orchestrator/estate/drift"

# Review active and failed deployments before deciding whether to redeploy.
stella deployment list --status running,failed

# Re-run the check after restoring the approved digest or resolving the deviation.
stella doctor run --check check.release.environment.matches-approved

If the result is unobserved, restore the environment-agent heartbeat and digest-reporting path before treating the estate as in sync. If drift is real, redeploy the digest pinned by the approved release; do not repair by retagging an unapproved image.