feat(code-editing): Step 5 — rollback + multi-file deploy + revocation flagging

[WayforthOfficial]

The cheap step on the Step 1–4 foundation — and it completes the code-editing backend. Flag-gated + inert (AGENT_VERSIONED_DISPATCH_ENABLED off). No merge — for review.

Rollback (mostly "repoint active_version_id", as designed)

core.agent_versions.rollback_to — instant + safe: the target version's image is already built, so rollback is a pure pointer repoint, no rebuild. Deliberately not forward-only (rollback goes backward by design); rejects rolling back to a failed/building version (nothing usable to serve).

• POST /cloud/agents/{id}/rollback {version_id | version_no}

Multi-file deploy (the orchestrator already takes a files map)

• POST /cloud/agents/{id}/deploy {files: {path: content}, requirements} → the Step-4 redeploy orchestrator unchanged.
• GET /cloud/agents/{id}/versions → history + active pointer (what rollback targets).
• Flag-gated; size-capped; RedeployError → HTTP via the shared _redeploy_http mapper.

Package-revocation flagging

Migration 071: revoked_packages table + agent_versions.dep_flagged.

• revoke_package(name, version?, reason?) records the revocation and flags every version whose baked requirements include it (so affected agents can be rebuilt).
• is_revoked / revoked_pins block NEW builds from using a revoked package (wired into the redeploy orchestrator — a package can be allowlisted yet later revoked).
• Admin POST /admin/packages/revoke + GET /admin/packages/flagged.

Proven against real Postgres — scripts/agent_redeploy_proof.py now 15/15

D. rollback to a prior version (no rebuild)
  PASS  rollback repointed active to v1
  PASS  rolled-back version is now active
  PASS  rollback to a 'failed' version rejected
E. package revocation flags affected versions
  PASS  revoke flagged exactly the version using badpkg
  PASS  unrelated version (httpx) NOT flagged
  PASS  is_revoked(badpkg==1.0) true
  PASS  flagged_versions surfaces the affected version

(A–C from Step 4 still pass.) Migration 071 ephemeral-pg proof: additive, idempotent, reversible. 7 new unit tests. Full suite 623 passed.

Where this leaves the backend

Steps 1–5 complete. Remaining before users touch it:

• Step 4b: stand up the minimal real mirror + prove the real egress-locked build E2E, then flip AGENT_VERSIONED_DISPATCH_ENABLED.
• Frontend (6–7, Lovable).
• (Separately, the egress-lock flag AGENT_GATEWAY_EGRESS_ENABLED is still gated on the E2B Firecracker-token reply.)

🤖 Generated with Claude Code