--- a/hg-web/BUILD	Sun Aug 02 14:42:01 2026 -0700
+++ b/hg-web/BUILD	Sun Aug 02 16:31:44 2026 -0700
@@ -87,3 +87,12 @@
   name = "hg_web_server_bundle",
   binary = ":hg_web_server",
 )
+
+sh_binary(
+  name = "deploy",
+  srcs = ["deploy.sh"],
+  data = [
+    ":hg_web_server_bundle",
+    "@bazel_tools//tools/bash/runfiles",
+  ],
+)

--- a/hg-web/README.md	Sun Aug 02 14:42:01 2026 -0700
+++ b/hg-web/README.md	Sun Aug 02 16:31:44 2026 -0700
@@ -217,6 +217,25 @@
 release root, active path, health URL, user, and group can be overridden with
 environment variables.
 
+## Publishing
+
+Push committed Mercurial changes to the configured server:
+
+```bash
+hg push
+```
+
+Then update and deploy on the server:
+
+```bash
+ssh -t [email protected] \
+  'cd ~/zenbu && hg update default && bazel run //hg-web:deploy'
+```
+
+The SSH key may prompt for its passphrase. `//hg-web:deploy` builds the release
+bundle through Bazel before running the atomic promotion, health check, and
+rollback workflow.
+
 ## Forge capability tree
 
 ```text

--- a/hg-web/deploy.sh	Sun Aug 02 14:42:01 2026 -0700
+++ b/hg-web/deploy.sh	Sun Aug 02 16:31:44 2026 -0700
@@ -8,15 +8,45 @@
 SERVICE_USER="${SERVICE_USER:-hg_web_server}"
 SERVICE_GROUP="${SERVICE_GROUP:-zenbu_team}"
 
-workspace="$(hg root)"
+workspace="${BUILD_WORKSPACE_DIRECTORY:-$(hg root)}"
 cd "$workspace"
 
+if [[ -n "${BUILD_WORKSPACE_DIRECTORY:-}" ]]; then
+  if [[ -n "${RUNFILES_DIR:-}" ]]; then
+    source "$RUNFILES_DIR/bazel_tools/tools/bash/runfiles/runfiles.bash"
+  elif [[ -n "${RUNFILES_MANIFEST_FILE:-}" ]]; then
+    runfiles_library="$(
+      grep -sm1 '^bazel_tools/tools/bash/runfiles/runfiles.bash ' \
+        "$RUNFILES_MANIFEST_FILE" | cut -d' ' -f2-
+    )"
+    source "$runfiles_library"
+  elif [[ -d "$0.runfiles" ]]; then
+    RUNFILES_DIR="$0.runfiles"
+    export RUNFILES_DIR
+    source "$RUNFILES_DIR/bazel_tools/tools/bash/runfiles/runfiles.bash"
+  elif [[ -f "$0.runfiles_manifest" ]]; then
+    RUNFILES_MANIFEST_FILE="$0.runfiles_manifest"
+    export RUNFILES_MANIFEST_FILE
+    runfiles_library="$(
+      grep -sm1 '^bazel_tools/tools/bash/runfiles/runfiles.bash ' \
+        "$RUNFILES_MANIFEST_FILE" | cut -d' ' -f2-
+    )"
+    source "$runfiles_library"
+  else
+    echo "Bazel runfiles are unavailable." >&2
+    exit 1
+  fi
+  bundle_dir="$(rlocation _main/hg-web/hg_web_server_bundle)"
+else
+  bazel build -c opt //hg-web:hg_web_server_bundle
+  bundle_dir="bazel-bin/hg-web/hg_web_server_bundle"
+fi
+
 revision="$(hg log -r . -T '{node|short}')"
 release_name="${revision}-$(date -u +%Y%m%dT%H%M%SZ)"
 release_dir="${RELEASE_ROOT}/${release_name}"
 staging_dir="${RELEASE_ROOT}/.${release_name}.tmp"
 next_link="${ACTIVE_PATH}.next"
-bundle_dir="bazel-bin/hg-web/hg_web_server_bundle"
 previous_release=""
 promoted=0
 
@@ -53,8 +83,6 @@
 }
 trap rollback ERR
 
-bazel build -c opt //hg-web:hg_web_server_bundle
-
 sudo install -d -o root -g "$SERVICE_GROUP" -m 0755 "$RELEASE_ROOT"
 sudo rm -rf "$staging_dir"
 sudo install -d -o "$SERVICE_USER" -g "$SERVICE_GROUP" -m 0755 "$staging_dir"