U6 — the deploy workflow itself

deploy-scp.yaml: download, back up the production database before
touching anything, upload into a timestamped release, symlink the
persistent website in, switch current and restart, verify /health
with retries, prune old releases only once that check passes. No
sudo, no container actions, one shared interface U5 will call next.

aidlc-docs/features/gitea-deployment-workflow/audit.md

@@ -1027,3 +1027,80 @@ Nothing pushed. Next: Round 3 — U5 CI Workflow & Gates and U6 Deploy Workflow,
 by Infrastructure Design. U5 carries REF-U3-01's Umami origin gate plus FR-21 and FR-22.
 
 ---
+## Session Resume
+
+**Timestamp**: 2026-07-28T00:00:00Z
+
+**User Input**: "Ik was bezig met de gitea-deployment-workflow feature met aidlc. Die wil ik graag oppakken. Als het goed is waren net u3 en u4 afgerond"
+
+**AI Response**: "Confirmed Round 2 (U3 Security Headers & CSP, U4 Observability) is complete, committed, and verified (372 backend / 237 frontend tests passing). Nothing pushed. Proceeding to Round 3: U5 CI Workflow & Gates + U6 Deploy Workflow (Infrastructure Design first for U6)."
+
+**Context**: Session resumed; loaded aidlc-state.md, unit-of-work.md, and Round 2 verification record
+
+---
+## Infrastructure Design — U6 Deploy Workflow (Planning)
+
+**Timestamp**: 2026-07-28T00:05:00Z
+
+**User Input**: "(implicit — continuing Round 3 per prior approval)"
+
+**AI Response**: "Created infrastructure-design-plan question file with 12 questions across 6 categories (Deployment Environment, Compute, Storage, Networking, Monitoring, Shared Infrastructure), covering Pi topology, publish RID/self-contained mode, systemd restart mechanism and sudo, release/persistence directory layout, retention count, database backup automatability, health-check verification method, rollback-on-failure behaviour, and Gitea secret naming. Functional Design and NFR Design confirmed skipped for U6 per execution plan (Pipeline-type unit)."
+
+**Context**: CONSTRUCTION — Round 3 — U6 Infrastructure Design, Step 3-5 (question generation, awaiting user answers)
+
+---
+## Infrastructure Design — U6 Deploy Workflow (Complete)
+
+**Timestamp**: 2026-07-28T00:20:00Z
+
+**User Input**: "Ik heb de vragen ingevuld, ga verder"
+
+**AI Response**: "Read 12/12 answers from u6-deploy-workflow-infrastructure-design-plan.md. Resolved an apparent Q1/Q10 tension (same Pi, directory-only split, yet an existing nginx reverse proxy routes environments) by concluding port assignment is a pre-existing host/nginx fact the workflow never manages. Generated infrastructure-design.md and deployment-architecture.md covering host topology, systemd --user process management (identifying a new finding, INFRA-U6-01: loginctl enable-linger is required or the service dies when the deploy SSH session closes), release/shared/current directory layout with 2-release retention, the full deployment sequence including production-only DB backup via a host-side script (no DB credentials touch the workflow), health verification via public URL through nginx with no automatic rollback on failure, the reusable workflow_call interface shared with U5, and Gitea variable/secret naming (PI_MAIN_ADDRESS renamed per user's answer)."
+
+**Context**: CONSTRUCTION — Round 3 — U6 Infrastructure Design, Steps 6-8 complete; awaiting approval to proceed to Code Generation
+
+---
+## Infrastructure Design — U6 Deploy Workflow (Approved)
+
+**Timestamp**: 2026-07-28T00:25:00Z
+
+**User Input**: "Continue to Next Stage"
+
+**AI Response**: "Infrastructure Design for U6 approved. Proceeding to Code Generation, starting with U6 (deploy-scp.yaml, implementing the just-approved interface) then U5 (continuous_integration.yaml, which calls it), since U5 depends on U6's concrete interface."
+
+**Context**: CONSTRUCTION — Round 3 — Infrastructure Design U6 marked complete; entering Code Generation for U6
+
+---
+## Code Generation Plan — U6 Deploy Workflow (Planning)
+
+**Timestamp**: 2026-07-28T00:30:00Z
+
+**User Input**: "(implicit — continuing after Infrastructure Design approval)"
+
+**AI Response**: "Created code generation plan for U6 (3 steps: generate deploy-scp.yaml, validate YAML, generate documentation), presenting for approval before generation starts."
+
+**Context**: CONSTRUCTION — Round 3 — U6 Code Generation Part 1 (Planning), awaiting plan approval
+
+---
+## Code Generation Plan — U6 Deploy Workflow (Approved)
+
+**Timestamp**: 2026-07-28T00:32:00Z
+
+**User Input**: "Approve Plan"
+
+**AI Response**: "Plan approved. Proceeding to Code Generation Part 2 for U6."
+
+**Context**: CONSTRUCTION — Round 3 — U6 Code Generation Part 1 complete, entering Part 2 (Generation)
+
+---
+## Code Generation — U6 Deploy Workflow (Complete)
+
+**Timestamp**: 2026-07-28T00:40:00Z
+
+**User Input**: "(implicit — plan approved, generation executed)"
+
+**AI Response**: "Generated .gitea/workflows/deploy-scp.yaml (7 workflow_call inputs, 1 job, 8 steps) implementing the approved Infrastructure Design. Validated YAML syntax with PyYAML (confirmed the 'on:' key resolves to boolean True under YAML 1.1 rules, matching the reference project's own working deploy.yaml — a parser quirk, not a defect). Documented in construction/u6-deploy-workflow/code/generation-summary.md. No C# test project applies to this Pipeline-type unit."
+
+**Context**: CONSTRUCTION — Round 3 — U6 Code Generation Part 2 complete, presenting completion message
+
+---