Release a verified build

Outcome

One clean commit produces reproducible artifacts, passes every activated release gate, and retains a known-good rollback until live verification succeeds.

Prerequisites

All owning slices are complete with saved evidence. Public release additionally requires full-history secret scanning, license/SBOM and provenance review, trademark-risk record, public-content review, community policies, and a public clean clone.

Steps

1. Run the deterministic known-name/path gate before commit and push.
2. Build and test from a clean clone using locked dependencies.
3. Publish immutable preview artifacts from the same commit.
4. Verify staging normal, failure, restart, recovery, browser, security, and performance paths.
5. Promote backend roles, then static web and docs in dependency order.
6. Change DNS one hostname class at a time and verify TLS plus deep links.
7. Keep the old image, static artifact, project, and DNS snapshot until rollback is exercised.

Missing runtime API keys defer only the corresponding live-provider smoke; adapters, fakes, failure tests, unconfigured UI, docs, and deployment wiring still must be complete.

Verify

Record remote CI, deployment commit/digest, live health, every docs route/search/canonical URL, web apex/www deep link, API CORS/auth/SSE/runtime ticket behavior, worker reconciliation, and rollback.

Recover

Restore the last known-good artifacts and only the DNS records changed by the rollout. Keep schema and workflow compatibility rules appropriate to the current durability epoch; never erase newer evidence.

Next task

Review contribution boundaries.