Specification: Rollout and Release (Phase 4)

Operator-driven phase: deploy the merged Phases 1–3 across partitions, verify end-to-end, and close the project. Verification traceability is inline (this phase’s “tests” are operator gates); requirement source is the project-level completion checklist plus Design §11 — Operations Impact.

Entry gate: Phases 1–3 merged; 13.2.0 published; operations image with the system sender built by CI.

Order (constraint 5 of the design): dev → {stage ∥ demo} → prod. Do not skip a partition’s verification cycle.

Per-Partition Procedure

Repeat per partition, in order. AWS profile per the partition’s account (Alpha002-Admin for dev/stage, Admin-Alpha1 for demo/prod); op biometric in the same shell invocation as the deploy.

Step R.1 — Provision

Run the partition deploy via amm.sh (never npx cdk deploy directly). The partition mail step now ensures the SystemEmailServer, custodies its token, and upserts the SM secret.

Verify (BV-1-07 on dev):

Postmark console/API: server SystemEmailServer-{fqn} exists on the correct account (NonProd for dev/stage, Prod for demo/prod).
1Password: Arda-{Env}OAM/SystemEmailServer/credential populated.
aws secretsmanager describe-secret --secret-id {fqn}-I-EmailSystemServerToken --profile <profile> succeeds.
Immediate re-run of the same deploy is a converging no-op.

Step R.2 — Deploy operations

Roll the operations component (standard component deploy path for the partition) so the new chart projects the token and the pod boots with the email {} block.

Verify:

Pod boots clean; configuration endpoint shows the email block with the token sanitized.
ESO: kubectl get externalsecret -n <ns> shows the app secret synced with the new key.

Step R.3 — End-to-end send (dev only)

Execute the dev smoke (BV-4-06): one real message through the dev SystemEmailServer to a controlled recipient; assert Sent(messageId); spot the message in the Postmark activity view.

Step R.4 — Drift

Trigger runtime-platform-drift manually; the new server/secret assertions must pass for every partition provisioned so far.

Diagnosis Table

Symptom	Likely cause	Action
Pre-Deploy fails: item exists but server missing	Server deleted out-of-band	Per Design §9.7: delete stale vault item, re-run (fresh server + token)
Pre-Deploy fails on 1P access	Biometric not in same shell / wrong vault perms	Re-run with `op` auth in the same invocation; check vault access
CFN deploy fails on the Email stack	Parameter/secret issues	CFN rolls back automatically; read stack events; re-run `amm.sh` (idempotent)
Pod boot failure: `GeneralValidation` on email block	ESO not synced / blank token line	Check ExternalSecret status + SM secret value shape (`{"token": …}` needs `property: token`); re-sync, restart
Smoke send → `Rejected` 401	SM/vault/Postmark token disagreement	Re-run partition deploy (`--force` propagates), restart pods; compare vault item modified-time vs deploy time
Drift red on server/secret	Out-of-band deletion	Re-run partition deploy; investigate deletion

Rollback

Provisioning: the stack additions are inert without consumers — no rollback needed for the secret/export. To fully back out: remove the CDK additions (secret is RETAIN — physical secret survives; delete manually only with explicit intent), delete the Postmark server (destructive, operator-deliberate), delete the vault item.
Operations: standard component rollback (previous Helm release). The absent/previous chart simply stops projecting the key; the email {} block’s absence turns the capability off (design kill switch).

Release and Documentation Closure

All four partitions through R.1–R.4 (R.3 dev only; optional controlled send on prod at the user’s discretion).
Current-system documentation updated: System — Messaging capability page, runtime/OAM email pages, secret-delivery inventory (list the new secret), operator runbook location.
Project docs set status: completed; byproducts recorded per phase.
Final documentation PR (PR-body changelog); ## Closes carries the Linear ticket so it resolves on merge.
Worktrees and local branches removed after all merges.

Open Questions and Decisions

#	Question	Options	Recommendation	Decision
1	Controlled prod send at rollout (beyond dev smoke)	(a) yes, one message to an internal recipient (b) no — trust dev + drift	(a) — one-time cheap confidence on the PostmarkProd path before the accounts follow-up depends on it	Open — operator’s call at prod gate