arsdlc-release

Shipping is a reversible decision or it is a gamble. This skill makes it reversible and makes the on-call person's night boring.

Lane check first

npx arsdlc next <slug> --json → read lane. Lanes spike and quick skip G5/G6: spike finishes after G3, quick after G4. If a quick-lane change turns out to need a flag, a migration contract step, or a runbook entry, the lane was wrong: npx arsdlc lane <slug> standard and continue here. Regulated lane: two approvers on G5 and a rollback rehearsal recorded as evidence (--label rollback-drill) before approval is requested.

G5: Release approval

Write docs/features/<slug>/rollout.md:

# Rollout: <title>

## Strategy
<flag name> · canary <n>% → <n>% → 100% · bake time per step · success signal per step

## Preconditions
- G4 green (acceptance signed)
- Migration applied in expand mode / backward compatible

## Rollback
1. Flip <flag> off.
2. Revert tag <tag>.
3. Run smoke: <command>.
Owner: <role>. Max time to rollback: <minutes>.

## Comms
Changelog entry · status page · stakeholder note

Approved-by: ______  Date: ______

G5 requires concrete ## Rollback steps and a human approval bound to the current spec, acceptance and rollout: npx arsdlc approve G5 <slug> --by "<release owner>" (never the author, never you).

G6: Runtime guardrails

Write guardrails.yaml:

budgets:
  latency_p95_ms: 800
  error_rate_pct: 1.0
  monthly_cost: 5000        # in the team's currency
kill_switch: <FLAG_NAME>
alerts:
  - on: error_rate_pct > budget for 5m
    do: page owner, flip kill_switch
review_after_days: 14

And runbook.md:

# Runbook: <title>

## Symptoms → Actions
| Symptom | First action | Escalate to |
|---|---|---|

## Dashboards / logs
- ...

## Known failure modes
- ...

## Contacts
On-call rotation: ...

G6 requires budgets, kill_switch and a runbook with a Symptoms section. For ML features, add evals.md with golden and adversarial cases plus thresholds; evals are tests.

Ponytail applies here too

The smallest rollout that is still reversible wins: one flag, one canary step, one smoke command. Do not invent a five-stage canary for a copy change. Do not skip the flag for a schema change.

Final security verification before deployment

Review security-review.md against the actual production configuration/build: public bundles/maps, secrets/logs, cookies, auth/permissions, RLS, rate limits, webhook signatures and egress/SSRF controls where applicable. If absent or stale, use arsdlc-verify's Final security verification protocol. FAILED or applicable NOT_VERIFIED blocks a security-ready release claim; record required human risk decisions without relabeling outcomes. G5/G6 do not automatically evaluate this report. Include security results and residual risks in the final handoff.

After release

• Record the deploy as evidence: npx arsdlc evidence <slug> --label deploy -- <deploy or smoke command>.
• Schedule the guardrails review (review_after_days). Budget breaches are new deltas, not silent tuning.
• Run npx arsdlc next <slug>; when it says DONE, load arsdlc-retro.

Smells to refuse

• A rollback section that has not been rehearsed. Steps that have never been executed are a wish list. Regulated lane records the drill as evidence (--label rollback-drill); every other lane should still walk the steps once and say what it found.
• A five-stage canary for a copy change, or no flag for a schema change. Both are the same mistake: the rollout does not match the blast radius.
• Guardrail numbers invented to satisfy the gate. error_rate_pct: 1.0 is worthless if the service normally sits at 0.9 or at 3. Derive every budget from a baseline measurement or a stated SLO, and say which.
• A kill switch nobody can reach. Name the flag, say who can flip it, and confirm it exists in the deployed config — a kill_switch: key pointing at a flag that was never created is a false sense of safety.
• A runbook written from memory. Symptoms come from the alerts and the failure modes you actually observed; "contact the team" is not an escalation path without a name or rotation.
• Deploying without recording it. The deploy command run through arsdlc evidence is the last piece of proof the whole feature has; skip it and the chain breaks at the finish line.
• Calling the feature DONE before arsdlc next says so. G4 green is not shipped.