rollback-safety-plannerlisted

## What It Does Reads the story plan and selects every story tagged `reversibility: hard` or `blast-radius: wide`. For each, drafts a concrete rollback procedure: trigger condition, time-to-rollback target, step list executable by the on-call without consulting the original implementer, forward-only recovery notes when applicable, and a drill plan. The point is to prevent surprised rollback failures during incidents — an explicit procedure is required before any high-cost story can be marked ready. ## Use This When Use this immediately after the story-designer emits its plan in the graduated and full lanes. Skip stories where reversibility is `easy` and blast-radius is `isolated`. Always run for migration workflows. ## Inputs - Read the story plan at `story_plan_path` first; identify each story's risk annotation. - Read the spec at `spec_path` when available so the rollback's scope can be validated against documented behavior. - Read canonical module docs in `module_doc_paths` for feature flag names, deployment conventions, and existing rollback patterns. - Read `references/rollback-procedure-template.md` before drafting any procedure so every required field is populated. ## Procedure 1. Run `scripts/select-stories.sh <story_plan_path> [workflow]` to get story ids needing a plan (filters on `reversibility: hard`, `blast-radius: wide`, or workflow=`migration`). 2. For each selected story, draft a procedure with every field in `assets/required-fields.txt` (Trigger, Time