deploy

# Deploy No gate skipped, no failure ignored. If any gate fails, halt and report. Never `--no-verify`. Never bypass. **Failure recovery (rule 14).** Worker errors and Quality Gate failures follow the canonical policy in [`skills/hyperflow/failure-recovery.md`](../hyperflow/failure-recovery.md). Gate failures are user-surfaced, never auto-fixed — print the failing command + full stderr and halt the push. Never `--no-verify`, never force-push to main. ## Per-Step Agent Map | Step | Sub-phase | Worker tier | Thinking tier | Notes | |---|---|---|---|---| | 1a | Repo-state scan | Worker A (git status), Worker B (git log) | Sonnet | — | | 1b | Tool detection | Worker A (profile.md + lockfiles), Worker B (testing.md + devDeps) | Sonnet | — | | 2a | Lint + typecheck (parallel) | Worker A (linter), Worker B (formatter), Worker C (tsc) | Sonnet | Step 3 (Security Sweep) runs in parallel with Step 2 at orchestrator level; 2a halts chain on any failure before 2b | | 2b | Build gate | Worker A (prod build), Worker B (dev build) | Sonnet | Depends on 2a PASS | | 2c | Test gate | Worker A (unit), Worker B (integration/E2E) | Sonnet | Parallel (P1); depends on 2b PASS | | 3a | Secrets scan | Worker A (diff pattern), Worker B (file pattern) | **Opus** | Runs in parallel with Step 2 (pre-build; read-only) | | 3b | Dependency audit | Worker A (CVE audit), Worker B (license check) | Sonnet | — | | 4 | Commit | single Worker | Sonnet | atomic-exempt (DOCTRINE 12.2) | | 5a | Release execution ...