Document stable image channel rollout

Author: AnastaZIuk

DEVSH.md

@@ -20,28 +20,29 @@ The `DevSH FOSS image` workflow builds a fully self-hosted FOSS Rocket.Chat imag
 5. Build the Meteor production bundle.
 6. Keep a DevSH FOSS compatibility license package for shared Community code paths that import `@rocket.chat/license`.
 7. Build the Docker image.
-8. Publish immutable semver-compatible tags to `ghcr.io/devsh-graphics-programming/rocketchat-foss`.
+8. Publish immutable semver-compatible tags and the stable `devsh` channel tag to `ghcr.io/devsh-graphics-programming/rocketchat-foss`.
 
 Runtime validation happens after deployment through the TerraInfra Rocket.Chat E2E checks. The image workflow stays focused on producing and publishing the DevSH FOSS container.
 
 ## Image Tags
 
 Pushes to `devsh` publish:
 
-- `<rocket-version>-devsh.YYYYMMDDHHMMSS.<sha>` as the immutable rollout tag.
-- `devsh` as a moving convenience tag.
+- `<rocket-version>-devsh.YYYYMMDDHHMMSS.<sha>` as the immutable audit and rollback tag.
+- `devsh` as the stable production channel tag.
 
-Terraform/Flux uses only immutable semver-compatible DevSH tags for production rollouts because the upstream Helm chart runs semver checks against `.Values.image.tag`.
+TerraInfra points the Rocket.Chat HelmRelease at the stable `devsh` tag with `imagePullPolicy=Always`. Immutable tags remain available for audit, debugging, and explicit rollback.
 
 ## TerraInfra Integration
 
-TerraInfra watches the GHCR package with Flux image automation:
+TerraInfra uses the standard DevSH image rollout model:
 
 - `ImageRepository`: `ghcr.io/devsh-graphics-programming/rocketchat-foss`
-- `ImagePolicy`: newest immutable semver-compatible DevSH tag
-- `ImageUpdateAutomation`: commits the selected tag to `env/prod`
+- GitHub package webhook to the Rocket cluster Flux Receiver
+- Digest rollout hook for immediate deployment restarts when the `devsh` digest changes
+- Digest rollout CronJob as fallback
 
-After Flux commits the tag update, the Rocket.Chat HelmRelease rolls the deployment on `prod-rocket-01`.
+Do not add TerraInfra tag bump workflows to this fork. Publishing a new `devsh` package is enough; the cluster observes the digest change and rolls itself forward.
 
 ## Operational Rule
 

README.md

@@ -1,5 +1,5 @@
 > [!IMPORTANT]
-> This is the DevSH operational fork of Rocket.Chat. The `devsh` branch is used to build a FOSS-only image for the isolated DevSH production workspace. The image workflow runs `yarn fossify`, publishes immutable semver-compatible `<rocket-version>-devsh.YYYYMMDDHHMMSS.<sha>` tags to `ghcr.io/devsh-graphics-programming/rocketchat-foss`, and TerraInfra/Flux consumes those tags for production rollout on `prod-rocket-01`.
+> This is the DevSH operational fork of Rocket.Chat. The `devsh` branch is used to build a FOSS-only image for the isolated DevSH production workspace. The image workflow runs `yarn fossify`, publishes immutable semver-compatible `<rocket-version>-devsh.YYYYMMDDHHMMSS.<sha>` tags plus the stable `devsh` channel tag to `ghcr.io/devsh-graphics-programming/rocketchat-foss`, and TerraInfra rolls `prod-rocket-01` from the stable channel digest.
 >
 > Keep runtime infrastructure changes in TerraInfra. Keep this fork close to upstream Rocket.Chat and use `DEVSH.md` for the DevSH branch/build model.