What problem does it solve? Promoting a release to a live environment is an irreversible control-plane action that teams often handle with ad-hoc scripts, long-lived secrets, and no audit trail. This Skill enforces a gated deploy handoff: it blocks until a named human approves, mints short-lived OIDC credentials, and emits an immutable receipt tying the release to its approver. ## Core Features & Use Cases - Mandatory named-human approval gate: Blocks on a synchronous approval from a named individual with release authority; agent confidence never substitutes for the gate. - Short-lived OIDC credentials: Mints keyless, environment-scoped tokens that expire when the job ends instead of using long-lived secrets. - Idempotent immutable receipt: Keys the handoff on (idempotency_key, release_ref) so replays return the existing receipt and never double-deploy; emits receipt_id, status, approver, and audit_id validated against a JSON schema. - SAGA compensation: Failed handoffs are never retried in place; they are reversed by the handoff-revoke compensating action. - Use Case: In the S6 stage of a delivery pipeline, after qa-validate returns a pass verdict with evidence, use this Skill to promote the release to production with a named approver and a full audit trail. ## Quick Start Hand off the QA-approved release to the deploy control plane with a named approver and an idempotency key, then return the handoff receipt.
