/common-devops-operations

name: common-devops-operations
description: 'Execute provider-neutral DevOps operations across AWS, GCP, Cloudflare, and Vercel. Standardizes MCP preflight, identity and authorization, effect-based release gating, and outward verification for setup, deploy, verify, monitor, diagnose, and recover. Use when managing cloud infrastructure, deploying releases, or diagnosing operational issues. (triggers: devops operations, cloud deployment, hosting verification, deployment diagnosis, cloud monitoring, deployment recovery)'
metadata:
  triggers:
    files: []
    keywords:
      - devops operations
      - cloud deployment
      - hosting verification
      - deployment diagnosis
      - cloud monitoring
      - deployment recovery

Provider-Neutral DevOps Operations

**Priority: P1 (HIGH)**

Single operations entrypoint for cloud infrastructure and services. MCP tools and discovered capabilities govern execution; organizational policy and host controls govern authorization.

Operational Lifecycle

Every operation follows seven mandatory stages:

1. **Discover MCP**: Verify required provider MCP is installed, connected, and advertising necessary tools. No silent CLI fallback. 2. **Verify Identity & Scope**: Confirm authenticated principal, organization/account, project/resource, region, and environment. 3. **Identify Policy & Capabilities**: Match discovered tool capabilities against target organizational security policy. 4. **Propose & Authorize**: Present concrete action set, target, artifact identity, risk, and expiry to authorized human. 5. **Execute Bounded Operation**: Perform authorized mutations with bounded deadlines and idempotency tokens. 6. **Independently Verify**: Inspect outward system behavior from target origin, separate from mutation operator. 7. **Reconcile & Report**: Emit standardized operations report; reconcile actual state; preserve feature lifecycle.

Core Operations

Default `operation=deploy` when omitted. Reject unknown, typo, or conflicting modes.

| Operation | Scope | Verification Requirement | | --- | --- | --- | | `setup` | Hosting, DNS, TLS configuration | Valid DNS records, TLS handshake, origin routing | | `deploy` | Release promotion, artifact rollout | Outward origin check, mobile C6, rollback readiness | | `verify` | Health check, routing, headers | Root response, valid TLS, 404 on unknown path | | `monitor` | Metrics, alerts, quota inspection | Measured signals; missing telemetry is not health | | `diagnose` | Bounded hypothesis investigation | Evidence collection; no writes disguised as diagnosis | | `recover` | Incident mitigation from prior state | Restored healthy state; unverified build forbidden |

Effect-Based Eligibility

Classify operations by real-world effect, never by mode label alone:

• **Deploy-Bearing Actions**: Any traffic switch or configuration introducing a new release enters full deploy readiness gates, even under `setup` or `recover`.
• **Read-Only Mode Lock**: `verify`, `monitor`, and `diagnose` cannot execute writes. Mutation requests block and require renewed authorization.
• **Recovery Boundary**: `recover` applies fixed runbook mitigations against an identified prior artifact or state. Fresh builds require release workflows. Active harm retains `incident-hotfix` policy; containment retains `cyber-triage`.

Positive & Negative Invariants

• **Positive Invariants**:
• Authorized, scoped operations proceed with least-privilege discovered tools.
• Irrelevant or unconfigured providers do not block independent analysis of configured targets.
• Offline review proceeds with explicit evidence limit when MCP is absent.
• **Negative Invariants**:
• No implicit credentials, ambient CLI fallbacks, or automatic tool installations.
• No agent self-approval, role expansion, or making resources public to bypass errors.
• No secret values, credentials, or tokens in reports, receipts, or logs.
• No timeout-as-failure retry; reconcile actual resource state before re-attempting.

Detailed References

• [Authorization & Host Enforcement](references/authorization.md) — Scope binding, approval invalidation, enforcement evidence checklist.
• [MCP Preflight & Capabilities](references/mcp-preflight.md) — Connection schema, tool discovery, structured missing-MCP outcomes.
• [Operations & Effect Classification](references/operations.md) — Six operations, diagnostic side effects, uncertain-write reconciliation.
• [Orchestration & Verification](references/orchestration.md) — Single context, specialist briefs, caller-return semantics, monitoring contract.
• [Evidence & Reporting Matrix](references/evidence.md) — Operations report shape, lifecycle preservation, consumer gap handling.
• **Provider References** — Read the matching file before any provider operation: [AWS](references/providers/aws.md), [GCP](references/providers/gcp.md), [Cloudflare](references/providers/cloudflare.md), [Vercel](references/providers/vercel.md).
• **Provider Extension Contract** — Read before onboarding a new provider: [Extension Contract](references/providers/extension-contract.md).