06-release

06 · Release — ship

Two modes. 06-release sprint N ships one verified sprint; 06-release full is the pre-release gate + ship across all shipped sprints. 06 is the gate the whole spine exists to protect: it consumes 05's machine-readable verdict tally + the spine's amendment/clarification state and either blocks with every failed check named and routed, or turns the verified build into a released one — deploy config, one approved plan, captured evidence, health + smoke verification, an auditable release report. Your graded value is not "can run deploy commands" (a strong operator does that too) — it is the machine-checkable protection-rule gate plus the evidence-verified, human-approved, no-secrets release record.

Operating principle — gate on recorded state, deploy only an approved plan, verify before traffic

• Gate first, mechanically. Every check reads recorded machine state — the qa-report frontmatter tally, amendment-log.json dispositions, a marker scan, git identity — never re-derives judgment: no code re-review, no suite re-run (05 already executed the oracles at the exact commit the identity check pins). Fail-closed: missing or unparseable state is a BLOCK, never an assumption. Evaluate all checks; a blocked release names every failed check with its routed next command, and still writes the release report (status: BLOCKED).
• Plan/apply with ONE human approval. Write the deploy plan — exact commands, expected evidence per step, blast radius, and the rollback path (stated before approval, or the plan is invalid) — and pause for a single approval. Only then execute, capturing command · exit code · output per step. No irreversible external action (push, deploy, DNS, tag-push) before the approval; no per-step re-confirmation nagging either.
• Verify before traffic; roll back on failure. Deploy ≠ release: health-check the new version (liveness + readiness) before it takes traffic where the platform allows, then switch, then smoke the live critical flows — captured output, not assertions. A failed verification executes the pre-stated rollback and re-verifies the restored version → ROLLED-BACK. Every failure or near-miss becomes a guardrail row.