Operator Stream — Task Plan (post-implementation)

Compares the planned tasks (see ../task-plan.md) against what shipped in documentation PR #75.

Delta from plan

The plan called for the Account Holder–facing runbook. The shipped scope was extended during review and during the rollout to include several documentation surfaces that surfaced as preconditions:

Area	Plan	Reality
Account Holder runbook	Author `process/sre/runbooks/amazon-creators-api-onboarding.md`	Shipped as planned.
devOps section	Per-partition vault provisioning + deploy trigger	Shipped, expanded with a per-vault verification command, `OP_SERVICE_ACCOUNT_TOKEN` documentation, and a matching pre-deploy gate.
Ongoing-operations section	Not initially specified	Added: eligibility-loss monitoring, credential rotation, quota awareness.
Secrets-vault reference	Implicit	Standalone reference page authored; partition-vault convention vs. system-vault distinction made explicit.
BFF API reference	Not in operator scope	Authored in this PR (request/response, error matrix, HTTP-status semantics) — the operator runbook references it, so it lives in the same doc PR.
`Alpha001/prod` region annotation	Not in original plan	Added in operator runbook § 9; later subsumed by PDEV-452 making `amm.sh` region-aware end-to-end.

Project-level deliverables added in this PR

All Phase-1 planning artefacts (goal.md, context-exploration.md, phases.md) authored on the same branch.
Four per-stream 2-implementation/<stream>/task-plan.md files.
3-deployment/deployment-plan.md covering merge order, per-partition rollout choreography, smoke-test procedure, rollback.
Project moved to roadmap/completed/; project-level completion-report.md and per-stream byproducts/ added at completion.

Verification

make pr-checks (lint + preview build + link check + smoke tests) green locally before each push.
All inbound runbook → planning-doc links validated by the link-check stage of pr-checks after the in-progress → completed move.
End-to-end operator flow exercised by the v1 rollout: Account Holder registered the application, handed credentials to devOps, devOps populated all four partition vaults and ran amm.yml per partition (with the PDEV-452 manual workaround for prod, since closed).