Release Gate

Use this before staging or production release.

Workflow

Confirm the reviewed commit or artifact being released.
Confirm environment and deployment mechanism.
If the release introduces or changes a required config/secret name, reconcile required config/secret names against the target environment and block on any gap (reconcile_config) — see configuration preflight.
If a secret-delivery path is new or changed, run a non-secret canary through that path and block until the canary confirms delivery works (run_canary) — see configuration preflight.
Run the smallest deployment validation available.
Smoke-test the critical route or workflow.
Record rollback path.
Create a HITL issue if deployment needs missing human-held access. This is for access that does not exist yet and only a human can create or grant it (e.g., nobody has been given the third-party account/credential itself) — distinct from step 3's reconciliation, which is for config/secret names already obtainable through an existing provisioning process that simply haven't been set in the target environment yet.