Field note /
Rocket Tooling Designer deploys could still reach the portfolio service despite a shared lock
A shared lock made the portfolio and RTS deployments take turns, but the RTS deploy could still replace the portfolio web service.
How the finding changed
Belief
Making the two deployment pipelines take turns was enough to keep them from interfering with each other.
Evidence
The deployment lock prevented concurrent changes to the stack.
Contradiction
The RTS publish command still targeted a broad Docker Compose service set that could replace the portfolio web image after a successful portfolio deploy.
Correction
Move the RTS static assets into an RTS-owned site container and have each pipeline target only the services it owns. The portfolio web service now proxies /rts/ to that container.
Current claim boundary
The corrected path was verified at runtime in the observed Jenkins deployment. That shows each pipeline touches only its own services on that path. It is not a guarantee about all shared infrastructure.