Expand description
Boot-time resolution of the services root from configured bundle sources.
The happy path is fetch, verify, compose, swap, record. Every other path
is a named fallback carrying the error that caused it: an instance serving
last-good content reports ServicesProvenance::LastGood with the failure
text, so “we are running yesterday’s bundle” is visible rather than
inferred from a log line that scrolled past. fail_closed refuses to boot
instead.
Copyright (c) systemprompt.io — Business Source License 1.1. See https://systemprompt.io for licensing details.