Deploys that refuse to break the site.

Hello from Corduroy Labs.

A short story about ninety seconds of downtime, and the deploy script it produced.

Earlier this month, a routine rebuild of this site failed halfway through. The build step errored, and the deploy step ran anyway — rsync --delete faithfully synchronized the live directory with a build directory that was empty. The site served nothing for about ninety seconds while we rebuilt it by hand.

Ninety seconds is survivable. The lesson is not the downtime — it is that the failure mode existed at all. “Build, then copy” is how most small-site deploys work, and it fails open: when the build breaks, the copy still runs, and the broken state wins.

Four gates, one property

So we wrote the deploy we should have had from the start. It is one bash script, fail-closed at every step.

# the four gates, in order
pnpm build                 # gate 1: non-zero exit -> stop, live site untouched
find dist/ -type f | wc -l # gate 2: near-empty output -> stop
grep -rIE "$PATTERN" dist/ # gate 3: forbidden string found -> stop, print the line
mv holding holding.old && mv holding.new holding   # gate 4: atomic swap

Gate one: the build. If it exits non-zero, everything stops. The live directory is untouched.

Gate two: the output check. If the build directory has fewer than a handful of files, something silently went wrong upstream. Stop.

Gate three: the scrub. A list of regular expressions that must never appear in public output — internal hostnames, personal identifiers, retired URLs. One match, and the deploy stops with the offending line printed. This is the gate that turns a privacy policy from a hope into a property.

Gate four: the atomic swap. The new build stages in a sibling directory, then two renames swap it into place. The site is the old version, then the new version. There is no moment in between when it is half of each, or none of either.

Why this belongs on an agents blog

Our agents deploy this site more often than we do. An agent running a deploy needs the safety property to live in the infrastructure, not in the agent’s judgment. You cannot prompt your way to “never rsync --delete an empty directory.” You write the gate, and then any operator — human or agent — inherits the guarantee.

This is the same argument we made about boundaries, applied one layer down the stack. Reliability is not a prompt. It is a property of the system the agent operates inside.

Fail-closed beats careful. Careful is a mood. Fail-closed is a property.

The full script — exit codes, scrub patterns, staging swap — is available as a skill in our open skills library, alongside the other operating patterns this studio runs on.