safe-deploy

name	safe-deploy
description	Guided deployment with pre-flight, explain, confirm, execute, verify. Triggers: "deploy", "push changes", "update the agent", "update workspace files". NEVER skip phases. NEVER auto-execute.

Safe Deploy

MANDATORY: Follow all 5 phases in order. No deployment command runs without Trent's explicit confirmation.

Phase 1: Pre-Flight

Before anything else:

1. Ask Trent: "Which agent are you deploying?" (Jeeves, Orchestrator, Research, Ads, Analytics, Storefront, Grid Scorer, or Execution Auditor)
2. Read the local repo state: run git status in /Users/javeriaabdulsami/Projects/Content/ai60/kurk-org/ to check for uncommitted changes
3. Dispatch the safety-checker agent for a full pre-flight report
4. Dispatch the secret-auditor agent to scan files being deployed for leaked secrets
5. Present the pre-flight report to Trent in plain English

If safety-checker returns NO-GO, STOP. Explain why and what needs to be fixed first.

Phase 2: Backup

1. SSH into VPS: ssh -i ~/.ssh/id_ed25519_github root@72.62.213.231
2. Create a backup of the current workspace state:

   ssh -i ~/.ssh/id_ed25519_github root@72.62.213.231 \
     "tar -czf ~/.openclaw/backups/pre-deploy-$(date +%Y%m%d-%H%M%S).tar.gz \
      ~/.openclaw/workspace/ ~/.openclaw/openclaw.json"
   

3. Confirm the backup was created: show Trent the file name and size
4. Tell Trent: "Backup created. If anything goes wrong, we can restore from this."

Phase 3: Explain

Show Trent exactly what will happen:

1. List the files that will be deployed (read from the deploy script or compare local vs remote)
2. Explain each change in plain English:
   • "This updates the agent's operating instructions (AGENTS.md)"
   • "This installs 3 new skills into the agent's skill directory"
   • "This changes the agent's personality/behavior rules (SOUL.md)"
3. Show the deploy command that will run
4. State the risk level (almost always YELLOW for workspace deploys)
5. State expected downtime: "The gateway will restart. The agent will be unavailable for about 15-30 seconds."

Ask: "Ready to deploy? (yes/no)"

Phase 4: Execute

Only after explicit "yes" from Trent:

1. Run the deploy script from the local machine:

   cd /Users/javeriaabdulsami/Projects/Content/ai60/kurk-org && \
     bash agents/kurk/<agent>/deploy-hostinger.sh
   

   Add --setup flag if Trent is doing a fresh deployment or installing new skills.
2. Stream output to Trent with brief commentary on what each step means
3. If any step fails, STOP and explain what happened. Do not retry automatically.

Phase 5: Verify

After deployment completes:

1. Wait 15 seconds for the gateway to stabilize
2. Dispatch the deploy-verifier agent for a full verification
3. Present results to Trent in plain English
4. If verification fails, offer to restore from the Phase 2 backup
5. If verification passes: "Deployment complete. Everything looks healthy."

Rules

• NEVER deploy without a backup (Phase 2).
• NEVER skip the explanation (Phase 3).
• NEVER auto-execute the deploy command. Even if Trent says "just deploy," show the explanation first.
• If Trent is deploying config changes (openclaw.json.template), remind him that config is locked (chmod 444) and the deploy script handles unlocking/relocking.
• After deploying one agent, wait 15 seconds before deploying another (gateway needs time to stabilize).