What problem does it solve? Deploying one project to multiple targets (home lab, cloud, staging VPS) usually leaks target-specific values like FQDNs, IPs, and TLS paths into shared config, and one target's bootstrap can destroy another target's state on a shared host. This Skill enforces a strict SST → generated contract → per-target adapter pattern that keeps target knowledge isolated and every operation idempotent. ## Core Features & Use Cases - Contract-Driven Adapters: Generates a target-agnostic deploy/contract.yaml from the SST and requires each target to supply its own params.yaml, bootstrap, apply, rollback, verify, and teardown scripts. - Operator Privacy via Locality Modes: Separates in-tree generic adapters from out-of-tree operator-private adapters resolved through DEPLOY_TARGETS_ROOT, with a strict no-silent-fallback CLI rule and a public-repo safety checklist. - Build-Once Deploy-Many: Pins deployments to immutable image digests with cosign signatures, SBOM and SLSA attestations, per-environment config bundles, and an assurance-gated preflight that refuses prototype-tier builds. - Use Case: When adding a home-lab target to a public repo, scaffold deploy/_example/ in-tree, keep the real host adapter in a private repo, and run deploy home-lab bootstrap twice to prove idempotency without touching peer adapters. ## Quick Start Ask the AI to scaffold a new deployment target adapter for your project following the contract and params layout, then verify bootstrap idempotency by running it twice.
