Release and Promotion Policy¶
Three-stage promotion. Every promotion requires the gate checklist below. No exceptions; emergency releases follow the incident process and post-mortem.
Stage 0 — Experimental¶
- Lives on a single laptop / single contributor's environment.
- Manual approvals on risky operations.
- No external consumers.
Gate to Stage 1:
- Repo contract validates (validate automation green).
- Baseline tests exist and pass on a clean checkout.
- README documents purpose, usage, and known limitations.
- Security baseline attestation (SPB-13) recorded.
Stage 1 — Stabilizing¶
- Lives in a real namespace repo.
- Reproducible scripts and pinned dependencies.
- One reviewer beyond the owner.
- Semantic versioning starts.
Gate to Stage 2:
- All Stage 0 gate items still pass.
- Cross-repo compatibility validated against current control-plane (compatibility-validation.md runbook).
- All linked credentials are agent-scoped, time-bounded, and rotation-tested (SPB-02, SPB-05, SPB-08).
- Audit logging conforms to audit-log-spec.md.
- Rollback procedure exists and was tested at least once.
Stage 2 — Production¶
- Namespace governance applies.
- Read-only orchestration agent has full namespace visibility.
- Releases are tagged, signed, and recorded.
Required checks at every Stage 2 release:
| # | Check | Owner |
|---|---|---|
| 1 | Contract validation passes | platform |
| 2 | All tests green on the release ref | repo owner |
| 3 | Security checklist (SPB-01..SPB-15) clean or with explicit accept-with-rationale | security |
| 4 | Audit logs reachable and not tampered | security |
| 5 | Rollback procedure dry-run on staging | platform + repo owner |
| 6 | Release notes match commit history | repo owner |
| 7 | Approver: platform_owner | platform |
| 8 | Approver: security_owner | security |
Rollback¶
- Rollback path documented per release.
- Rollback target is the prior production tag unless explicitly stated.
- Rollback is itself a release event and must pass checks 1, 2, 4, and 5.
Incident handling¶
- Stop-the-line authority: any owner may halt promotion if a gate fails or a control regresses.
- Post-mortem within 5 working days.
- Policy change resulting from incident must follow SPB-15 change-control.