Instant rollback with health checks

A rollback needs a known-good target

Keep the previous production deployment addressable until the new version has passed the release window. Apex retains deployment metadata so an operator can change the active version without rebuilding.

Define health checks

health:
  path: /health/ready
  interval: 15s
  timeout: 2s
  failures: 3

Make readiness reflect the dependencies required to serve real traffic. A process that is alive but cannot reach its database should not advertise itself as ready.

Gate the promotion

• Require a successful build and smoke test.
• Require health checks to remain green during the canary window.
• Block promotion when error rate or latency crosses the release threshold.

Rollback without panic

When the gate trips, return traffic to the last known-good deployment and preserve the failed deployment for diagnosis. Do not delete evidence during the incident.