---
id: w2/m10/t005
title: Acceptance — bad-image deploy → rollback → previous digest live; mid-build cancel
worker: worker2
status: todo
estimate: 25m
depends_on: [w2/m10/t004]
---

## Objective

Prove both verbs against a real cluster: deploy a known-good image → deploy a bad one (or a slow build) → **cancel** it mid-build and assert the service never blipped; then let a bad deploy land → **rollback** via MCP → poll the returned deploy to `live` and assert the served content is the known-good version again.

## Steps

1. Good deploy (whoami) → verify URL content.
2. Trigger a build-from-git deploy and cancel during `build_in_progress`: Job deleted, record `canceled`, URL still serving good content.
3. Deploy a bad image → rollback → poll new deploy to `live` → URL serves good content; `list_deploys` shows the full story (good → bad → rollback-of-bad).

## Files

- `scripts/` (extend the m5 deploys verify script if one exists, else inline kubectl/curl checks recorded in the task log)

## Acceptance criteria

- [ ] Scripted/recorded pass of both flows on a live cluster; deploy history reads truthfully afterwards.

## Out of scope

- Load/perf; concurrent cancel+rollback races beyond t008's unit coverage.
