release: verify production portfolio deployment

docs/deployment/rollback-record-template.md

@@ -0,0 +1,55 @@
+# Portfolio rollback record
+
+Create one record per rollback attempt. Keep credentials, secret key material, private scanner evidence, and private server paths out of this document and Git. A rollback uses a newly signed rollback manifest; an old release manifest is never replayed.
+
+## Authorization
+
+- Incident/change reference:
+- Authorized by:
+- Authorization timestamp (UTC):
+- Operator:
+- Reason and observed failure:
+
+## Fenced release state
+
+- Canonical public URL:
+- Current signed manifest digest:
+- Current immutable release ID:
+- Current fence:
+- Approved rollback target artifact digest:
+- Newly signed rollback manifest digest:
+- Rollback manifest expiry:
+- Expected predecessor digest:
+- Expected fence:
+- External approval/ledger revision:
+
+## Verification before pointer change
+
+- [ ] Rollback target is an existing immutable release directory.
+- [ ] Target artifact hashes match the newly signed rollback manifest.
+- [ ] Signature, scope, issuer epoch, approval/ledger state, expiry, predecessor, and fence verify.
+- [ ] Readiness and internal smoke checks pass.
+- [ ] A concurrent activation has not changed the current digest or fence.
+
+## Outcome
+
+- Activation start timestamp (UTC):
+- Activation finish timestamp (UTC):
+- Result: succeeded / failed without pointer change / failed after pointer change
+- New current signed manifest digest:
+- New fence:
+- Atomic activation receipt digest:
+- Public smoke report digest:
+- Public smoke result:
+- Previous/current release still recoverable:
+- Additional containment or follow-up:
+
+## Post-rollback checks
+
+- [ ] Canonical HTTPS response is 200 and reports the expected manifest digest.
+- [ ] Alternate hosts redirect to the canonical URL in one permanent hop.
+- [ ] Security, cache, compression, MIME, and range headers pass.
+- [ ] Canonical/OG/JSON-LD/robots/sitemap agree.
+- [ ] JavaScript-disabled content remains substantive and accessible.
+- [ ] No source maps, private identifiers, or credentials are public.
+- [ ] Incident and Search Console/crawl implications are recorded if applicable.