fix(devops-engineer): operationalize production-deploy approval gate in core workflow

The constraints said never to deploy to production without explicit
approval, but the workflow's deploy step proceeded straight to rollout.
The workflow now determines the target environment and, for production
or customer-facing targets, requires presenting the deployment summary
and rollback plan and receiving explicit approval first. Mirrors the
terraform-engineer gate added in #213. Closes #196, closes #212.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E6LA4sndtVGyvoXqwYeHoB

CHANGELOG.md

@@ -24,6 +24,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `site/package-lock.json`: follow-up fresh `npm audit fix` clearing post-July advisories (9 findings down to 5). The remaining 5 require a semver-major Astro 7 upgrade (cascading @astrojs/starlight and @astrojs/mdx majors) and are dev-server/SSR-context advisories with low exposure for a statically built site; tracked as separate upgrade work
 - `rag-architect/SKILL.md`: reranking example instantiated the Cohere client with a hard-coded `"YOUR_API_KEY"` placeholder; now reads `COHERE_API_KEY` from the environment with a note on secrets handling, closing #210 (#216)
 - `terraform-engineer/SKILL.md`: core workflow allowed proceeding from `terraform plan` straight to `terraform apply`; now requires presenting a plan summary (highlighting destructive actions) and receiving explicit user approval before apply, refusing when approval is withheld, closing #211 (#213)
+- `devops-engineer/SKILL.md`: the "never deploy to production without explicit approval" constraint was not operationalized in the core workflow; the deploy step now determines the target environment and, for production or customer-facing targets, presents the deployment summary and rollback plan and requires explicit user approval before running deployment commands, closing #196 and #212
 
 ### Contributors
 - @vasugarg09 — Fixed broken relative reference paths in `vue-expert-js` and `react-expert` (#225)
@@ -32,7 +33,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - @awais786 — New `django-storages-s3` skill: production S3 file storage for Django (#218)
 - @snvtac — Replaced hard-coded Cohere API key placeholder in `rag-architect` with environment lookup (#216)
 - @SergiuLupaiescu — Added user-approval gate between `terraform plan` and `apply` in `terraform-engineer` (#213)
-- @specterslient95-lgtm — Reported the missing plan/apply approval gate (#211)
+- @specterslient95-lgtm — Reported the missing plan/apply approval gate (#211) and the non-operationalized production-deploy constraint (#196, #212)
 
 ## [0.4.15] - 2026-05-20
 

skills/devops-engineer/SKILL.md

@@ -42,8 +42,9 @@ You are a senior DevOps engineer with 10+ years of experience. You operate with
 2. **Design** - Pipeline structure, deployment strategy
 3. **Implement** - IaC, Dockerfiles, CI/CD configs
 4. **Validate** - Run `terraform plan`, lint configs, execute unit/integration tests; confirm no destructive changes before proceeding
-5. **Deploy** - Roll out with verification; run smoke tests post-deployment
-6. **Monitor** - Set up observability, alerts; confirm rollback procedure is ready before going live
+5. **Plan rollout** - Determine the target environment; prepare the deployment summary, rollback command, and validation plan
+6. **Approve and deploy** - If the target is production or customer-facing, present the deployment summary and rollback plan and ask for explicit user approval; only run deployment commands after confirmation, and stop with a blocked verdict if approval is withheld. Roll out with verification; run smoke tests post-deployment
+7. **Monitor** - Set up observability, alerts; confirm rollback procedure is ready before going live
 
 ## Reference Guide