---
name: numa-local-flux-deploy
metadata:
  version: "1.1.0"
description: Build and deploy an existing Numa application locally through its image registry and Flux Git repository when the governed Jenkins/Numa pipeline is unavailable and the user explicitly authorizes the fallback. Use for local production image builds, direct Flux image-tag releases, rollout recovery, or an accompanying Numa CLI npm release; do not use as the default path while the normal pipeline is usable.
---

# Numa Local Flux Deploy

## 加载基础 Skill（必读）

本 Skill 依赖同来源的 `numa-cli@1.4.1`。业务操作前先加载基础 Skill；缺失时按 [依赖恢复指引](references/cli-bootstrap.md) 询问用户是否立即安装，不静默安装。命令示例使用 npx，无需全局安装；执行时将示例中的 `latest` 换为基础 Skill 已确认的具体版本，同一任务沿用同一入口。

Use this as a controlled fallback, not as a silent replacement for the governed pipeline. The user must explicitly authorize the resolved application and environment and state that the pipeline is unavailable or that local deployment is required.

Read [local-flux-release.md](references/local-flux-release.md) completely before inspecting credentials, building an image, changing Flux, reconciling a cluster, or publishing npm packages.

## Preserve the deployment boundary

- Resolve the exact source repository, remote commit, application, environment, namespace, workload, image repository, Flux values file, cluster context, and health endpoint from version-controlled or live read-only evidence. Do not guess any of them.
- Use an isolated clean Git worktree for both source and Flux changes. The preferred Flux repository is `~/mci/mci-flux`; never overwrite, stash, clean, or build from unrelated changes in its primary worktree.
- Never read registry auth files, kubeconfig contents, application secrets, token caches, or `secrets/**`. Check only whether the required authenticated tools can operate.
- Do not modify Keycloak, database data, unrelated Flux resources, or a live Deployment unless the user separately placed that target in scope.
- A local interruption or registry/network error creates an unknown result. Inspect the existing image tag, Git ref, Flux revision, and workload before any retry. Reuse the exact operation identity; never create a second release to escape uncertainty.
- A retired signed-snapshot build whose writer result is `UNKNOWN` is not evidence that the Flux write failed. Before selecting this fallback, inspect the original request plus the remote target HEAD/request marker and exact image field. If the intended CAS already landed, do not write Flux again; observe the existing revision and leave ledger reconciliation to the supported server-side recovery path.

## Finish with evidence

Do not call the release successful until GitOps has applied the exact Flux commit, the controller and workload are healthy on the exact image tag, the application readiness check passes, and any optional npm release has passed candidate smoke testing before promotion to `latest`. When this fallback only verifies a revision already written by a v2 platform request, report `runtime deployed / platform ledger unresolved` until the control plane reconciles the original request.

Report the source commit, image tag and digest, Flux commit/revision, cluster context, controller/workload status, health results, npm version/tags when applicable, and whether Jenkins or Keycloak were touched.