| name | ops-ship |
| description | The pre-deploy gate. Triggers on "deploy", "ship it", "release", "cut a release", "push to prod", "roll it out", or editing a CI or deploy config. Produces a deploy brief with five required slots and a tagged release — or it refuses to call the deploy ready. |
| allowed-tools | Read, Grep, Glob, Bash, Write, Edit |
The deploy gate — a brief with five filled slots, or it doesn't ship
A deploy is a change to a running system other people depend on. The gate is not "be careful" — it's a
deploy brief whose five slots are structurally required. An empty slot means the brief is
INCOMPLETE and the deploy is not ready. Not "proceed with caution" — not ready.
First, confirm where this is going: read .skull/env (run ops-env-map if it's stale). If the target is
production, you assemble the brief for a human to execute — you do not run the deploy yourself.
The five required slots
| # | Slot | What fills it — and what an empty slot means |
|---|
| 1 | Verify evidence | The command you ran and its actual output: tests, build, typecheck, lint green. No output = unverified = not ready. |
| 2 | Migration dry-run result | The migration run against a copy, with its output — or the literal words "no schema change". Never blank. |
| 3 | Rollback plan | The exact revert commands and the direction you tested. "We'd figure it out" is not a plan (see ops-rollback). |
| 4 | Blast radius | Who and what breaks if this is wrong — which users, which services, which data. Name them. |
| 5 | Flag / canary strategy | Behind a flag, or canaried to N% with a rollback trigger — or one sentence on why neither fits. |
Write the brief to .skull/deploy-<date>.md. A reviewer should green-light it without re-deriving any slot.
Tag the release — every time
git tag -a v1.4.2 -m "release notes" && git push origin v1.4.2
The tag is what ops-rollback redeploys and what ops-incident points at. An untagged deploy is one you
can't cleanly name later — which means one you can't cleanly revert.
Size the gate to the change
- Schema migration, auth, payments, data backfill → all five slots argued in full; a canary is not optional.
- Copy tweak, config value, static asset → the slots still get answered, but "no schema change" and a
one-line rollback are complete answers. The gate is proportionate, never skipped.
Red flags — stop, the brief is lying
A slot filled with "should be fine" / "N/A" where a real answer belongs · "we'll test in prod" · a rollback
plan nobody has ever run · a migration that only goes forward · deploying Friday afternoon with no one
watching the graphs. Each is an incomplete brief wearing a checkmark.
Pairs with ops-env-map (prove the target first) and ops-rollback (the plan slot 3 demands). Credits:
change-management and canary / progressive-delivery discipline from standard SRE practice.
