Release

Release — Pre-Ship Gate

Final verification before shipping. Maps to Protocol P12 (Release Readiness) and P13 (Security Gate).

Pattern: This skill runs after all beads are closed. It verifies all work is done, security is clean, and the system is ready to ship.

When This Applies

Prerequisites

Before running /release:

1. All execution phases complete (or user explicitly skipping)
2. No beads in in_progress status
3. Agent Mail available (if multi-agent)

Tool Reference

Verification Commands

Agent Mail (MCP)

Message Subjects

Architecture

┌─────────────────────────────────────────────────────────────────┐
│                      RELEASE ORCHESTRATOR                        │
│  You are here. You:                                              │
│  - Verify all beads closed                                       │
│  - Run security scan                                             │
│  - Check for uncommitted work                                    │
│  - Validate against rigor tier                                   │
│  - Generate release report                                       │
└─────────────────────────────────────────────────────────────────┘
                              │
         ┌────────────────────┼────────────────────┐
         │                    │                    │
         ▼                    ▼                    ▼
┌─────────────────┐  ┌─────────────────┐  ┌─────────────────┐
│  Bead Status    │  │  Security Gate  │  │  Multi-Agent    │
│  bd list        │  │  ubs --staged   │  │  Cleanup        │
│  bv --robot-*   │  │  Language audits│  │  Agent Mail     │
└─────────────────┘  └─────────────────┘  └─────────────────┘
         │                    │                    │
         └────────────────────┼────────────────────┘
                              │
                              ▼
                    ┌─────────────────┐
                    │  Release Report │ → Present to operator
                    │  GO / NO-GO     │
                    └─────────────────┘

Execution Flow

Step 1: Setup

1. Identify rigor tier from North Star Card:
   - Read PLAN/00_north_star.md (or project config)
   - Determine Tier 1, 2, or 3

2. Initialize TodoWrite with release phases:
   - [ ] Verify beads complete
   - [ ] Run security scan
   - [ ] Check git state
   - [ ] Multi-agent cleanup
   - [ ] Generate report

Step 2: Verify Beads Complete

# Check for incomplete beads
bd list --json | jq '.[] | select(.status != "closed")'

# Get summary
bv --robot-summary

# Check for alerts
bv --robot-alerts

Blocking if:

• Any P0 beads not closed
• Any beads in in_progress status (orphaned work)

Step 3: Security Gate (MANDATORY)

# Run security scan
ubs --staged

# For Java code (72% OWASP failure rate)
# ADDITIONAL manual SQL injection review required

# For web code (JS/TS)
# ADDITIONAL manual XSS output encoding review required

Blocking if:

• Any high/critical findings
• Medium findings without documented justification

Step 4: Run Tests

# Run test suite (project-specific)
pytest                    # Python
npm test                  # Node.js
go test ./...             # Go
cargo test                # Rust

Blocking if:

• Any test failures

Step 5: Check Git State

# Uncommitted changes?
git status

# Recent commits look right?
git log --oneline -10

# On correct branch?
git branch --show-current

Blocking if:

• Uncommitted changes (unless intentional)
• On wrong branch

Step 6: Multi-Agent Cleanup

# Check for unresolved urgent messages
urgent = fetch_inbox(
    project_key=PROJECT_PATH,
    agent_name=AGENT_NAME,
    urgent_only=True
)

if urgent:
    # Handle or acknowledge before release
    for msg in urgent:
        acknowledge_message(project_key, AGENT_NAME, msg.id)

# Release any file reservations
release_file_reservations(
    project_key=PROJECT_PATH,
    agent_name=AGENT_NAME
)

# Announce release readiness
send_message(
    project_key=PROJECT_PATH,
    sender_name=AGENT_NAME,
    to=["Coordinator"],  # or all agents
    subject="[RELEASE READY] Project Name",
    body_md="""
Release verification complete.

**Status:** READY TO SHIP
**Beads:** X closed, Y blocked
**Security:** Clean
**Tests:** Passing
    """,
    importance="high"
)

Step 7: Generate Release Report

Present to operator:

## Release Readiness Report

**Project:** [name]
**Rigor Tier:** [1/2/3]
**Date:** [timestamp]
**Agent:** [agent_name]

### Verification Summary

| Check | Status | Details |
|-------|--------|---------|
| Beads Complete | ✓/✗ | X/Y closed |
| Security (ubs) | ✓/✗ | Clean / N findings |
| Tests | ✓/✗ | All passing / N failures |
| Git State | ✓/✗ | Clean / uncommitted |
| Agent Mail | ✓/✗ | No urgent / N unresolved |

### Blockers
[List any blocking issues, or "None"]

### Recommendation
**[READY TO SHIP]** or **[BLOCKED - see above]**

### Next Steps
- [ ] Operator sign-off
- [ ] Tag release: `git tag -a vX.Y.Z -m "Release X.Y.Z"`
- [ ] Deploy to [environment]
- [ ] Monitor logs/metrics

Release Checklist by Rigor Tier

Tier 1 (Personal/Hobby)

Tier 2 (Startup MVP / Business Tool)

Tier 3 (Enterprise)

Agent Mail Protocol

Error Handling

Beads Not Complete

1. List incomplete beads with bd list --json
2. Present to operator: complete or descope?
3. If descoping: document decision, update requirements
4. Re-run release check

Security Findings

1. List findings from ubs --staged
2. For high/critical: MUST fix before release
3. For medium: document justification or fix
4. Re-run after fixes

Test Failures

1. List failing tests
2. Fix failures or document known issues
3. Known issues require operator sign-off
4. Re-run after fixes

Orphaned File Reservations

1. Check for stale reservations
2. Force release if agents are inactive
3. Document in release notes

Post-Release

After shipping:

# Tag the release
git tag -a v1.0.0 -m "Release 1.0.0"
git push origin v1.0.0

# Update beads (if any tracking beads remain)
bd close <release-bead-id> --reason "Released v1.0.0"

# Notify team
send_message(
    project_key=PROJECT_PATH,
    sender_name=AGENT_NAME,
    to=["all"],
    subject="[RELEASED] v1.0.0",
    body_md="Release complete. Monitoring for issues.",
    importance="high"
)

Mandatory Rules (2025 Research)

Evidence Base

See Also

• /calibrate — Run if drift detected before release
• /prime — Worker startup (for re-verification)
• docs/workflow/PROTOCOLS.md — P12: Release Readiness, P13: Security Gate
• docs/workflow/IDEATION_TO_PRODUCTION.md — Stage 10
• advance/ — Bead lifecycle details