devops-safe-shiplisted

# Safe-Ship: Risky Rollout Playbook A repeatable procedure for shipping high-blast-radius changes (auth cutovers, key revokes, etc.) without breaking prod and without a human babysitting every step. **You prepare, verify, and present; the human pulls the trigger on anything irreversible.** Land one risky thing at a time, prove it with real signals, and keep a one-line rollback ready before you merge. ## When to use Invoke for: issuer/auth cutovers, signing-key revokes, hard-to-reverse changes, or any change where a mistake locks users out or can't be trivially undone. For ordinary additive features use `/new-feature` or `/plan`. ## Rollout under design: "$ARGUMENTS" ## The seven disciplines ### 1. Incremental delivery — one risky change per PR - **One PR = one purpose.** Split the rollout into the minimum ordered PRs the deploy-ordering forces (e.g. auth foundation → relocation → enablement → cutover → cleanup). Never bundle unrelated risk into one PR. - **Land + verify before the next step.** Each PR must be CI-green and its effect confirmed in prod (or proven no-op) before you build the one after it. - **Consolidate follow-ups, never risk.** Housekeeping and small fixes can share a cleanup PR; a lockout-capable flip gets its own PR. - Prefer **additive first**: introduce the new shape, run both in parallel, cut over, then retire the old shape in a later PR. ### 2. Fallback / rollback readiness — keep the old path inert-but-present - **Make rollback one line