gaelic-ghost · gaelic-ghost · Jul 29, 2026 · Jul 29, 2026 · Jul 29, 2026 · Jul 29, 2026
diff --git a/README.md b/README.md
@@ -150,7 +150,7 @@ Current Socket catalog shape:
 - `apple-creator-studio-skills`: source-preserving Final Cut Pro editing, Motion template, Compressor delivery, Logic Pro production, MainStage concert, and GarageBand project workflows with local Help Viewer discovery, explicit Computer Use safeguards, and artifact or rehearsal verification
 - `apple-dev-skills`: Apple, Swift, SwiftPM, macOS-hosted boundary selection, custom Virtualization framework hosts, persistent Linux development guests, clean macOS development guests, imaging, Vision/Core ML, camera, spatial sensing, media/audio, SwiftUI, AppKit, Xcode, Safari, OpenAPI, and DocC workflows, plus the source-bundled `swift-steward` custom-agent definition with its own roadmap
 - `cardhop-app`: mixed skill plus bundled MCP server for Cardhop.app contact workflows
-- `cloud-deployment-skills`: cloud provider deployment routing, official provider plugin selection, credential and mutation boundary checks, AWS handoff to the official AWS Agent Toolkit, and Azure handoff to Microsoft's Azure Skills plugin rather than duplicated provider MCP or CLI setup
+- `cloud-deployment-skills`: cloud provider deployment routing, official provider plugin selection, credential and mutation boundary checks, a reusable Dockerized-service release/deployment contract, AWS handoff to the official AWS Agent Toolkit, and Azure handoff to Microsoft's Azure Skills plugin rather than duplicated provider MCP or CLI setup
 - `cloud-inference-skills`: cloud AI inference, training, model conversion, and GPU infrastructure routing for Runpod, Hugging Face, AWS, Vast.ai, CoreWeave, and similar providers, with bundled Runpod MCP server configuration, upstream Runpod skill mirrors, and first-party Hugging Face/AWS handoffs
 - `cybersecurity-skills`: suspicious-content triage, evidence preservation, isolation selection, disposable Linux and macOS analysis-lab preparation, malware analysis, agentic security-tool controls, macOS investigation and defense, vulnerability validation, authorized testing, incident response, threat hunting, detection content, and clear non-specialist advice
 - `messaging-collaboration-skills`: chat-app, bot, business-messaging, meeting-collaboration, iMessage collaboration, Communication Notifications, Push to Talk, VoIP/SIP, documented iOS/iPadOS default communication roles, and app-owned macOS client workflows for Discord, Telegram, Slack, Teams, WhatsApp Business, SMS/MMS/RCS, Google Meet, and Apple communication surfaces, with explicit Signal and Mac operator-automation boundaries

diff --git a/ROADMAP.md b/ROADMAP.md
@@ -713,7 +713,7 @@ Completed
 - [x] The plugin boundary is clear enough for future provider slices without absorbing framework-specific deployment workflows.
 - [x] Root Socket docs, marketplace wiring, and validation agree on the exported cloud-deployment skill surface.
 
-Completed Milestone 21 by adding the `cloud-deployment-skills` child plugin, shipping the provider-routing workflow, wiring the Socket marketplace entry, documenting the AWS Agent Toolkit delegation, and keeping future provider expansion scoped to small official-tool routing slices.
+Completed Milestone 21 by adding the `cloud-deployment-skills` child plugin, shipping the provider-routing workflow, wiring the Socket marketplace entry, documenting the AWS Agent Toolkit delegation, and keeping future provider expansion scoped to small official-tool routing slices. The plugin now also ships a provider-neutral Dockerized-service release/deployment contract and templates: clean GitHub Actions artifact builds, main-anchored tags, immutable digest manifests, release-published production deployment triggers, environment approval, exact-digest health checks, and rollback handoffs without host-side rebuilds.
 
 ## Milestone 22: Network Protocol Skills plugin
 

diff --git a/docs/maintainers/hermes-compatibility.md b/docs/maintainers/hermes-compatibility.md
@@ -112,9 +112,11 @@ plugin runtime, MCP server, or native Hermes extension.
 The exported F# web-framework workflows are portable instruction contracts. They
 use the operator's .NET SDK and project dependencies but bundle no runtime,
 framework package, MCP server, hook, or native Hermes extension. The cloud
-deployment routing workflow is also portable guidance: it routes Azure work to
-Microsoft's official Azure Skills plugin but does not claim that Azure MCP is
-automatically installed or configured in Hermes.
+deployment routing workflow and Dockerized-service release/deployment workflow
+are also portable guidance: they route Azure work to Microsoft's official Azure
+Skills plugin and define a clean-CI, exact-digest release contract, but do not
+claim that Azure MCP, provider credentials, or production deployment adapters
+are automatically installed or configured in Hermes.
 
 The exported Python workflows are portable guidance. They guide `uv`-managed
 agent services, FastAPI services, FastMCP services, and tests while relying on

diff --git a/plugins/agent-portability-skills/.codex-plugin/plugin.json b/plugins/agent-portability-skills/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "agent-portability-skills",
-  "version": "9.26.1",
+  "version": "9.27.0",
   "description": "Maintainer skills for Socket-owned agent skill portability, Codex plugin surfaces, and host adapter guidance.",
   "author": {
     "name": "Gale",

diff --git a/plugins/agent-portability-skills/pyproject.toml b/plugins/agent-portability-skills/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "agent-portability-skills-maintenance"
-version = "9.26.1"
+version = "9.27.0"
 description = "Maintainer-only Python tooling baseline for Agent Portability Skills."
 requires-python = ">=3.11"
 dependencies = []

diff --git a/plugins/agent-portability-skills/uv.lock b/plugins/agent-portability-skills/uv.lock
diff --git a/plugins/agentdeck/.codex-plugin/plugin.json b/plugins/agentdeck/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "agentdeck",
-  "version": "9.26.1",
+  "version": "9.27.0",
   "description": "Local Codex runtime utilities for thread, hook, and app-server workflows.",
   "author": {
     "name": "Gale",

diff --git a/plugins/android-dev-skills/.codex-plugin/plugin.json b/plugins/android-dev-skills/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "android-dev-skills",
-  "version": "9.26.1",
+  "version": "9.27.0",
   "description": "Android, Kotlin, Java, Gradle, Android Gradle Plugin, testing, lint, UI implementation, and release-readiness workflow skills.",
   "author": {
     "name": "Gale",

diff --git a/plugins/apple-creator-studio-skills/.codex-plugin/plugin.json b/plugins/apple-creator-studio-skills/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "apple-creator-studio-skills",
-  "version": "9.26.1",
+  "version": "9.27.0",
   "description": "Human-facing and Computer Use-aware Apple Creator Studio workflows for Final Cut Pro editing, Motion templates, Compressor delivery, Logic Pro production, MainStage concert preparation, and GarageBand projects.",
   "author": {
     "name": "Gale",

diff --git a/plugins/apple-dev-skills/.codex-plugin/plugin.json b/plugins/apple-dev-skills/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "apple-dev-skills",
-  "version": "9.26.1",
+  "version": "9.27.0",
   "description": "Apple development workflows for Codex, including macOS privacy permissions, sandbox file access, entitlement diagnosis, virtualization, SwiftPM, Xcode, app extensions, media, provisioning, SwiftUI, AppKit, Safari, security, OpenAPI, and DocC.",
   "author": {
     "name": "Gale",

diff --git a/plugins/apple-dev-skills/pyproject.toml b/plugins/apple-dev-skills/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "apple-dev-skills-maintainer"
-version = "9.26.1"
+version = "9.27.0"
 description = "Maintainer tooling for the apple-dev-skills repository"
 requires-python = ">=3.10"
 dependencies = []

diff --git a/plugins/apple-dev-skills/uv.lock b/plugins/apple-dev-skills/uv.lock
diff --git a/plugins/cardhop-app/.codex-plugin/plugin.json b/plugins/cardhop-app/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "cardhop-app",
-  "version": "9.26.1",
+  "version": "9.27.0",
   "description": "Cardhop.app workflow guidance plus a bundled local MCP server for contact capture and updates on macOS.",
   "author": {
     "name": "Gale",

diff --git a/plugins/cardhop-app/mcp/pyproject.toml b/plugins/cardhop-app/mcp/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "cardhop-app-mcp"
-version = "9.26.1"
+version = "9.27.0"
 requires-python = ">=3.13"
 dependencies = [
     "fastmcp>=3.0.2",

diff --git a/plugins/cardhop-app/mcp/uv.lock b/plugins/cardhop-app/mcp/uv.lock
diff --git a/plugins/cloud-deployment-skills/.codex-plugin/plugin.json b/plugins/cloud-deployment-skills/.codex-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "cloud-deployment-skills",
-  "version": "9.26.1",
-  "description": "Codex skills for routing cloud deployment work through official provider plugins, MCP servers, CLIs, and Socket-owned deployment guidance.",
+  "version": "9.27.0",
+  "description": "Codex skills for routing cloud deployment work through official provider plugins, MCP servers, CLIs, and a reusable Dockerized-service release and deployment contract.",
   "author": {
     "name": "Gale",
     "email": "mail@galewilliams.com",
@@ -23,13 +23,18 @@
     "mcp",
     "cloudflare",
     "vercel",
-    "fly.io"
+    "fly.io",
+    "docker",
+    "oci",
+    "github-actions",
+    "github-releases",
+    "supply-chain-security"
   ],
   "skills": "./skills/",
   "interface": {
     "displayName": "Cloud Deployment Skills",
     "shortDescription": "Cloud provider and deployment routing guidance for Codex.",
-    "longDescription": "Guide Codex agents through cloud deployment routing, official provider plugin selection, credential and mutation safety checks, and provider handoffs. Socket delegates AWS work to the official AWS Agent Toolkit and Azure work to Microsoft's Azure Skills plugin, keeping Socket focused on thin cross-provider decisions instead of duplicating provider MCP, CLI, or deployment workflows.",
+    "longDescription": "Guide Codex agents through cloud deployment routing, official provider plugin selection, credential and mutation safety checks, and a reusable Dockerized-service release contract: clean GitHub Actions builds, main-anchored tags, immutable image digests, release manifests, release-published production deployment, approval, health checks, and exact-digest rollback. Socket delegates AWS work to the official AWS Agent Toolkit and Azure work to Microsoft's Azure Skills plugin, keeping Socket focused on thin cross-provider decisions instead of duplicating provider MCP, CLI, or deployment workflows.",
     "developerName": "gaelic-ghost",
     "category": "Developer Tools",
     "capabilities": [
@@ -39,7 +44,8 @@
     "websiteURL": "https://github.com/gaelic-ghost/socket/tree/main/plugins/cloud-deployment-skills",
     "defaultPrompt": [
       "Choose the right cloud deployment path and route AWS or Azure work through the applicable official provider plugin when appropriate.",
-      "Decide whether this deployment should use an official provider plugin, provider CLI, MCP server, framework-owned deploy workflow, or a Socket-owned provider skill."
+      "Decide whether this deployment should use an official provider plugin, provider CLI, MCP server, framework-owned deploy workflow, or a Socket-owned provider skill.",
+      "Set up or audit a Dockerized backend release path that builds in clean GitHub Actions, deploys only a published release manifest digest after production approval, verifies health, and rolls back by exact digest."
     ],
     "brandColor": "#22D3EE",
     "composerIcon": "./assets/cloud-deployment-icon.svg",

diff --git a/plugins/cloud-deployment-skills/AGENTS.md b/plugins/cloud-deployment-skills/AGENTS.md
@@ -8,6 +8,7 @@ This file is the Cloud Deployment Skills child-repo override for work done from
 - Root [`skills/`](./skills/) is the authored workflow surface.
 - The repo root is the Codex plugin root through [`.codex-plugin/plugin.json`](./.codex-plugin/plugin.json).
 - Keep this plugin focused on provider selection, official-tool routing, deployment readiness, and cross-provider handoffs.
+- Own the provider-neutral release contract for Dockerized backend and cloud services: clean GitHub Actions builds, main-anchored tags, immutable image digests, release manifests, release-published deployment triggers, production approval, exact-digest deployment, health verification, and rollback handoff.
 - Keep framework-specific application implementation in the owning stack plugins such as `server-side-swift`, `web-dev-skills`, `python-skills`, `dotnet-skills`, `rust-skills`, and `server-side-jvm`.
 
 ## Local Rules
@@ -22,3 +23,4 @@ This file is the Cloud Deployment Skills child-repo override for work done from
 - Keep provider-specific skills small and explicit. Add a new provider workflow only when it removes real routing ambiguity or covers a provider that does not already offer a first-party agent plugin.
 - Do not commit machine-local credentials, profiles, `.env` files, cloud state, generated deployment artifacts, or local cache paths.
 - Use repo-local files, checked-out provider config, provider CLIs, and official provider documentation before making claims about current deployment behavior.
+- Keep project worktrees development-only. Release artifacts must come from clean GitHub Actions checkouts; deployment adapters must deploy the manifest digest and must never rebuild source on a host.