deployment-checklist-author

name	deployment-checklist-author
description	Author a production deployment checklist (deployment-checklist@1) from an approved release plan + impl-plan + test-strategy verdict. Use when user asks to "draft a deploy checklist", "create the production deploy plan", or "outline the rollout for the AUTH slice". Captures prereqs, migration order, smoke tests per service, rollback steps, observability dashboards, on-call coverage, security review, change-window booking. Covers SDP §4(c) Release engineering. Chains naturally into deployment-checklist-audit. Do NOT use for "audit an existing deploy checklist" (use deployment-checklist-audit instead).
license	Apache-2.0
metadata	{"version":"1.0.0","module":"skill","stage":"i","cyberos-template":"deployment-checklist@1","cyberos-rubric-target":"deploy_checklist_rubric@1.0"}
allowed_memory_scopes	{"read":["project:*","module:*","company:locked-decisions","memories:decisions","memories:projects","memories:refinements"],"write":["project:*","memories:projects"]}
allowed_mcp_tools	["kb.read","kb.search","memory.search","memory.write_memory","audit.append","chat.notify"]
escalation	{"to_persona_on_legal":"cuo-clo","to_persona_on_security":"cuo-cseco","to_persona_on_compliance":"cuo-clo","to_human_on_irreversible":true}
invocation_modes	["standalone","chained"]
expects	{"schema_ref":"./envelopes/input.json","required_fields":["source_files","output_dir"],"optional_fields":["manifest_path","batch_size","caller_persona","trace_id","chain_to"],"standalone_interview_ref":"./STANDALONE_INTERVIEW.md"}
produces	{"schema_ref":"./envelopes/output.json","output_kind":"artefact","human_summary_ref":"./HUMAN_SUMMARY.md"}
depends_on_contracts	[{"id":"deploy-checklist","version":"v1","purpose":"generation_skeleton","pin_path":"cyberos/skill/contracts/deployment-checklist/"},{"id":"nats-subjects","version":"v1","purpose":"wire_protocol_emission","pin_path":"cyberos/skill/contracts/nats-subjects/"}]
exposable_as	{"internal":true,"agent_plugin":true,"mcp_tool":true,"partner_connector":false}
audit	{"emit_to":"genie.action_log","row_kind":"artefact_write","payload_hash_field":"artefact_hash","explanation_pane":"required"}
confidence_band	{"default":0.7,"defer_below":0.5,"cite_sources":"required"}
untrusted_inputs	{"wrap_in_marker":"untrusted_content","injection_scan":"required","on_marker_hit":"surface_to_human"}
self_audit	{"invariants_ref":"./INVARIANTS.md","check_at":["on_node_boundary",{"on_audit_row_count":25},"on_completion"],"anomaly_signals":{"confidence_low_streak":{"threshold":3,"window":10},"user_correction_streak":{"threshold":2,"window":5},"denylist_near_miss_streak":{"threshold":2,"window":20},"scope_rejection_streak":{"threshold":1,"window":1},"citation_missing_streak":{"threshold":2,"window":10}},"on_breach":{"emit":"refinement_proposal","pause_pipeline":true,"resume_token_field":"refinement_run_id"}}
human_fine_tune	{"fine_tuner_role":"cpo","review_required":{"on_minor_bump":false,"on_major_bump":true,"on_safety_change":true},"signals_to_initiate":[{"acceptance_rate_below":0.6},{"hitl_pause_rate_above":0.4},{"drift_signal_count_above":3},"user_complaint_received","regulator_inquiry_received",{"self_audit_refinement_proposal_count_above":2}],"procedure_ref":null,"required_artifacts":["changelog_entry","acceptance_test_added","memory_refinement_entry"],"blackout_windows":[]}
determinism	{"reproducible":false,"fixity_notes":"Authoring is judgement; manifest state IS reproducible. Re-running on settled state is a no-op except for last_audit_at refresh."}
emitted_source_freshness_tier	30
gated_until_phase	null
untrusted_content_wrapping	required

deployment-checklist-author — DEPLOY-CHECKLIST generator

Standalone trigger that turns one or more documents into a versioned, audited deployment-checklist@1 markdown. Halts at PLAN approval and HITL gates; resumable from manifest.json state. Chains naturally into deployment-checklist-audit by default.

prompt_revision: deploy-checklist_author@1.0.0

When to invoke this skill

CUO routes a request here when the user wants to:

• "Turn this into a DEPLOY-CHECKLIST."
• "Generate v2 of the DEPLOY-CHECKLIST from the updated source."
• "Draft a DEPLOY-CHECKLIST for ."

If the user asks to audit an existing DEPLOY-CHECKLIST, route to deployment-checklist-audit instead. If both, the supervisor chains the two.

Self-test preamble — emit BEFORE any file action

Begin every invocation with a single fenced CONTRACT_ECHO block. Do NOT proceed past this block until it has been emitted.

CONTRACT_ECHO
skill_id:                        deployment-checklist-author
skill_version:                   1.0.0
prompt_revision:                 deploy-checklist_author@1.0.0
template_version:                deployment-checklist@1   (loaded from cyberos/skill/contracts/deployment-checklist/template.md)
output_dir:                      <from caller>
manifest_path:                   <from caller; default: <output_dir>/manifest.json>
naming_pattern:                  DEPLOY-CHECKLIST-{NNN}-{slug}.md
batch_size:                      <from caller; default 3, soft-cap 5, hard-cap 10>
hitl_categories:                 [<list per skill — e.g. customer_quotes, success_metric_targets, scope_decomposition>]
hitl_policy:                     HALT_BATCH_ON_PAUSE
amendment_policy:                ACCUMULATE_THEN_BATCH
max_iterations_per_artefact:     10
re_entrancy:                     idempotent_on_manifest_state
untrusted_content_handling:      spotlight_xml_tagged
file_scope:                      MUST NOT write outside output_dir
inputs:
  source_files:                  [<list of paths/URLs with media_type>]
  source_hash:                   <sha256 of normalized concat, see references/MANIFEST_SCHEMA.md §3.1>
phase:                           <PLAN | WORKER | RESUME>   (computed per §3 below)

§1 Pipeline interface (envelopes)

Input envelope (envelopes/input.json):

{
  "source_files"