Pipeline: Safe Deploy

You are orchestrating a safe deployment pipeline. Every deploy is preceded by security checks, baseline capture, and followed by canary monitoring and performance benchmarking.

Input Parameters

Collect before starting:

• target: railway | vercel (required)
• production-url: The live production URL to monitor (required for baseline/canary/benchmark)
• environment: production | staging (default: production)

Pipeline State

Create a tracker at .gstack/pipeline-deploy-{date}.md.

## Pipeline: Safe Deploy
Started: {timestamp}
Target: {target}
URL: {production-url}
Environment: {environment}

| # | Stage | Status | Gate | Notes |
|---|-------|--------|------|-------|
| 1 | PRE-DEPLOY | pending | — | — |
| 2 | BASELINE | pending | — | — |
| 3 | DEPLOY | pending | — | — |
| 4 | VERIFY | pending | — | — |
| 5 | REPORT | pending | — | — |

---

Stage 1: PRE-DEPLOY CHECKS (parallel)

Run security and operations critiques as parallel subagents:

1a: Security check

Dispatch a subagent to invoke /security-critique on the current branch diff:

• Focus on: secrets exposure, auth changes, new API endpoints, dependency vulnerabilities
• Scope: only changed files (git diff main...HEAD --name-only)

1b: Operations check

Dispatch a subagent to invoke /operations-critique:

• Focus on: Dockerfile changes, CI/CD pipeline changes, infra config changes, env var changes
• Scope: only changed infra files

Gate: No Critical findings from either critique. High findings are warnings (noted but not blocking).

If Critical findings exist:

1. Report them to the user
2. Ask: "Critical issues found. Deploy anyway? (yes/no)"
3. If no → STOP pipeline, update tracker → BLOCKED
4. If yes → note the override in tracker, proceed

On pass: Update tracker → PASS.

---

Stage 2: BASELINE CAPTURE (parallel)

Capture the current production state before deploying:

2a: Canary baseline

Invoke /canary --baseline {production-url} to capture:

• Console error count per page
• Page load times
• Screenshots of key pages

2b: Performance baseline

Invoke /benchmark --baseline {production-url} to capture:

• Core Web Vitals (LCP, FID, CLS)
• Resource sizes and counts
• Load time per page

Both run as parallel subagents. Their outputs are saved to .gstack/canary-reports/baselines/ and .gstack/benchmark-reports/baselines/.

Gate: Baselines captured successfully. If production URL is unreachable, warn user and ask whether to skip baselines.

---

Stage 3: DEPLOY

Based on the target:

Railway

Invoke /railway-deploy:

• Links project if not linked
• Sets environment variables from .env or .env.example
• Runs --dry-run before applying
• Triggers build
• Waits for deployment to complete
• Runs HTTP health check on the production URL

Vercel

Invoke /vercel-deploy:

• Links project if not linked
• Configures environment variables
• Deploys (preview or production based on environment parameter)
• Waits for deployment to complete

Gate: Deployment successful. Health check passes (HTTP 200 on production URL).

If deployment fails:

1. Report the error and deployment logs
2. Update tracker → BLOCKED
3. Do NOT proceed to verification — the old version is still live

On pass: Wait 30 seconds for the deployment to stabilize, then proceed.

---

Stage 4: VERIFY (parallel)

Run post-deploy verification as parallel subagents:

4a: Canary monitoring

Invoke /canary {production-url} --duration 5m:

• Monitors for new console errors
• Checks page load times against baseline
• Takes periodic screenshots
• Reports: HEALTHY / DEGRADED / BROKEN

4b: Performance benchmark

Invoke /benchmark {production-url} --diff:

• Compares current metrics against Stage 2 baseline
• Reports: regressions, improvements, unchanged

Gate:

• Canary verdict must be HEALTHY. DEGRADED triggers a warning. BROKEN triggers rollback discussion.
• Benchmark must show no REGRESSION (>50% slower or >500ms absolute increase).

If BROKEN or REGRESSION:

1. Report the specific failures with evidence
2. Ask: "Rollback to previous version? (yes/no/monitor-longer)"
3. If rollback → provide the rollback command but do NOT execute without user confirmation
4. If monitor-longer → re-run canary with --duration 10m

---

Stage 5: REPORT

Produce the deploy report:

## Deploy Report
Target: {target}
URL: {production-url}
Environment: {environment}
Date: {timestamp}

### Pre-Deploy
- Security: {grade} — {critical/high/medium/low counts}
- Operations: {grade} — {critical/high/medium/low counts}
- Overrides: {any critical findings overridden}

### Deployment
- Status: {SUCCESS/FAILED}
- Build time: {duration}
- Health check: {HTTP status}

### Post-Deploy Verification
- Canary: {HEALTHY/DEGRADED/BROKEN}
  - Console errors: {baseline} → {current}
  - Load time: {baseline} → {current}
- Benchmark: {PASS/WARNING/REGRESSION}
  - LCP: {baseline} → {current}
  - CLS: {baseline} → {current}

### Before/After Screenshots
{links to canary screenshots}

Persist

• Save report to .gstack/deploy-reports/deploy-{target}-{date}.md

---

Final Pipeline Report

## Pipeline Report: Safe Deploy
Target: {target} | URL: {production-url}
Run: {timestamp}
Duration: {total elapsed}

| # | Stage | Skill(s) | Result | Gate | Duration |
|---|-------|----------|--------|------|----------|
| 1 | PRE-DEPLOY | security-critique, operations-critique | {result} | {gate} | {time} |
| 2 | BASELINE | canary, benchmark | {result} | Captured | {time} |
| 3 | DEPLOY | {deploy skill} | {result} | HTTP {status} | {time} |
| 4 | VERIFY | canary, benchmark | {result} | {verdict} | {time} |
| 5 | REPORT | — | PASS | Saved | {time} |

Overall: {PASS / PASS_WITH_WARNINGS / BLOCKED / ROLLBACK_RECOMMENDED}