TAO deployment branches and auto-update

From TAO 4.0.33+, enrolled agents can upgrade themselves when the Cloud Portal advertises a newer target version for the device’s deployment branch.

Configure this in Deployment → Deployment control (trustity.io/dashboard/deployment/control).

Branches

Only Managed devices (Vault Devices) appear in Deployment control. Removed devices are excluded automatically.

How auto-update works

1. Set the prod global version dropdown to Latest, Previous, or Hold.
2. Move one or more trusted machines to eval for soak testing.
3. On each heartbeat (org default 10 minutes; configurable under Security Policies → TAO Agent), the agent receives targetTaoVersion, installer/package URLs, and optional SHA-256.
4. If the target is newer than the running binary:
   • Windows - downloads Trustity-Agent-Setup.exe, verifies hash when available, runs Setup /quiet (enrollment under %ProgramData%\Trustity\TAO is preserved).
   • Linux - downloads the published tarball, verifies hash when available, replaces the binary and systemd unit, then restarts trustity-tao (state under /var/lib/trustity/tao is preserved).

To force an update attempt without waiting for the next heartbeat, use Update on Deployment → Deployment control (TAO 4.0.3518+). See How TAO agent sync and updates work.

Operator checklist

1. Confirm the new build is published (Deployment page shows Available).
2. Set eval on 2-3 pilot machines; wait for heartbeats and verify version in Managed devices.
3. When stable, set prod to Latest (or move eval machines back to prod).
4. Use Hold updates to pause prod auto-update during change freezes.
5. Read TAO Agent release notes before changing prod targets.

Version selection (no manual typing)

Operators choose from a dropdown - not free-text version numbers:

• Latest release - current published build on the portal (current.json).
• Previous release - the prior published tag (for rollback or staged lag).
• Hold updates - no auto-update target for prod stations.

Eval always tracks Latest.

Per-station vs global

• Global: prod dropdown applies to all stations on the prod branch.
• Per-station: move selected devices between prod and eval, or use row actions for a single host.

New enrollments join the default branch configured in Deployment control (prod by default).

Troubleshooting

• Station missing from Deployment control - ensure it exists under Managed devices and has sent at least one heartbeat.
• Status shows Manual bootstrap - the running agent is older than the heartbeat auto-update minimum (Linux 4.0.3300+, Windows 4.0.3200+). Install once manually, then portal targeting applies on heartbeat:
  • Linux: sudo tao-agent update (or install script from Deployment)
  • Windows: run Trustity-Agent-Setup.exe /quiet from Deployment
• Pending after bootstrap - confirm outbound HTTPS to GitHub Releases or your portal /exe/ mirror (on-prem); check agent logs / update_state.json (Windows: %ProgramData%\Trustity\TAO\update_state.json).
• Rollback - set prod to Previous and wait for the next heartbeat cycle.

Release notes

Version-to-version changes (features, fixes, model updates) are documented on the public Release notes page. Review before promoting a build from eval to prod.

Related guides

• Deployment Center
• Pilot to production rollout
• Managed devices and software inventory