Continuity runbook: Rollback production

Task

A second maintainer can roll back a Heroku release on opencreorg when a deploy is bad, without confusing slug rollback with database rollback.

Success criteria

• Runbook docs/continuity/runbooks/rollback-production.md (skill continuity-rollback-production)
• Operator lists heroku releases and only rolls back after a human types the exact vNNNN
• Stops if the bad release may have migrated Postgres (Alembic); documents that slug rollback does not undo the DB
• Knows ALEMBIC_GUARDRAIL_FAIL on release: means stop rolling back blindly

Context

• Prod deploy force-pushes to the Heroku git remote (.github/workflows/deploy.yml)
• Procfile release: runs scripts/check_alembic_revision_guardrail.py

Constraints

• existing maintainers only
• Agent must not heroku rollback unprompted
• No config dumps

Agent prompt

See Agent prompt in docs/continuity/runbooks/rollback-production.md.

Start with docs/continuity/runbooks/rollback-production.md, then read .github/workflows/deploy.yml, Procfile, and scripts/check_alembic_revision_guardrail.py. Confirm the runbook covers exact-release confirmation, the distinction between slug and Postgres rollback, and the ALEMBIC_GUARDRAIL_FAIL stop condition without permitting unprompted rollback or config dumps.