Skip to content

Phase 5: Deploy

Pre-deployment verification using the deployment-orchestrator. Produces a Go/No-Go decision.

Command: /5-deploy [--env production] [--migration]

When to use

After the code review in Phase 4 passes. This is the final gate before code goes to production.

What happens

  1. Test gate verification -- Reads .test-gate.md and verifies:
    • File exists (if missing, deployment is blocked)
    • status: PASS (if FAIL, deployment is blocked)
    • branch matches the current branch (stale gates are rejected)

See Testing Procedures for the gate file format and how to generate it.

  1. Documentation build (when docs/user-manual/ exists) -- Runs mkdocs build --strict to verify the docs site builds without broken links or missing pages. Build failures block deployment.
  2. Repo governance audit -- If .repo-manifest.yaml exists, runs /repo-audit --ci-mode to verify zero context bleed and LFS compliance. Fails on any context artifacts in deployable paths.
  3. Dependency security audit -- Runs npm audit or bundle audit to find known vulnerabilities in dependencies.
  4. Final security scan -- Last-pass review for anything missed in Phase 4.
  5. Migration safety -- If database migrations are pending, checks for zero-downtime compatibility, rollback capability, and data loss risks.
  6. Compliance verification -- GDPR data handling, SOC2 logging, PII protection, and audit trail completeness.
  7. Constitution compliance (when SpecKit active) -- Verifies all constitution principles are respected and reports spec coverage percentage.

Output

  • Deployment report with check results for each category
  • Go/No-Go decision with rationale
  • Rollback plan (previous version, rollback command, monitoring targets)
  • Post-deployment monitoring checklist

Next step

  • If GO: Deploy via your CI/CD pipeline, then Phase 6: Operate
  • If NO-GO: Fix blocking issues, then run /5-deploy again.