pre-ship-gate
pre-ship-gate
Overview
CI says the deploy job returned exit 0. The pipeline succeeded. But the rollback rate is 3× higher than the green pipeline would suggest — because "exit 0" only proves the deploy artifact was written, not that:
- migrations were actually applied (vs skipped silently)
- the new release is the one serving requests (vs the old version still in CDN / load balancer)
- feature flags flipped at the right time (not 30 minutes late due to stale KV)
- env vars survived the rollout (not silently defaulted to a fallback)
- canary is making progress (vs stuck at 0% due to a label selector mismatch)
- shadow traffic is being mirrored correctly (not silently dropped)
This skill combines pre-deploy read-only audit (catch silent misconfig before rollout) and post-deploy smoke verification (catch the same class of issues in the first 5 minutes after rollout). Source material draws on the antigravity pre-release-review + pre-ship-gate pair, merged into one workflow.
Distinction from verification-before-completion: verification-before-completion is the per-PR code-change gate (Iron Law). pre-ship-gate is the per-rollout runtime gate — it runs after the green CI, against the deployed artifact, against the live system state.