> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zookooree.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Station 5: Deploy

> Controlled release into service: a certified unit receives its place, its duties, and its leash.

Deployment is not a celebration; it is a controlled transfer. The unit leaves the high-frequency inspection zone of the line for the low-frequency inspection zone of production — with its certificate carried intact, its autonomy dialed up in stages, and a way to pull it back confirmed before it starts.

## Entry gate

A signed, current Certificate of Conformance. No certificate, no deployment — an uncertified unit is inventory, and inventory does not ship.

## Standard work

**The progressive-autonomy dial.** Capabilities as runtime flags; canary stages — dogfood, then 1%, 10%, 50%, GA; the kill switch retained forever; and *measure before expanding* — baseline error and escalation rates gate each widening of the dial.

**Mechanical export.** Deployment to the runtime substrate is a mechanical export from the certified BOM — no re-authoring, no drift between what was certified and what runs. This station is the only one that speaks the runtime's language; everything upstream is runtime-agnostic by construction, which is the sovereignty seam described in [Open Source and Decentralization](/open-source-and-decentralization).

**Least privilege.** The unit receives exactly the access its work order justifies, recorded as part of its deployment record — the practice, in principle, is on the [Credentials and Security](/credentials-and-security) page; the specifics live in the private registry.

**Registration with the watchers.** The unit's recurring obligations — the artifacts it owes and their deadlines — are declared to the silence watchdog before the unit starts. A unit that is not registered for silence monitoring is not deployed; it is abandoned in advance.

## Exit gate

Deployed context matches BOM hashes exactly; monitoring configured; obligations registered; kill switch tested. A deployment is complete when the unit can be *recalled*, not merely when it is running.

## Escalation

The founding cautionary tale: the factory's own export pipeline once shipped empty context placeholders — a deploy that does not carry the certified context is deploying an uncertified unit. That class of failure halts the deployment; the fix goes to the pipeline (the die), not the instance.

## Enforcement

Two rows of the compilation table land here:

* **Row 8 — export/deploy integrity:** `export/validate-export.py`, the poka-yoke — it fails when any exported agent context is empty or a known placeholder, or when a manifest references a missing path. The design's fuller form diffs deployed context against BOM hashes and refuses on mismatch.
* **Row 9 — progressive autonomy:** capability flags plus staged rollout configuration plus the kill-switch runbook.

## Self-audit

| Claim                                                                                              | Source                                       |
| -------------------------------------------------------------------------------------------------- | -------------------------------------------- |
| Autonomy dial: flags, canary stages, kill switch forever, measure before expanding                 | docs/factory-design.md:150                   |
| Deployment is mechanical export from the certified BOM                                             | docs/factory-design.md:150                   |
| Station 5 is the only station that speaks the runtime's language; parts portable by construction   | docs/factory-design.md:255                   |
| Empty-placeholder export is precisely the forbidden failure; poka-yoke diffs context vs BOM hashes | docs/factory-design.md:150                   |
| Deployment = transfer to low-frequency inspection zone                                             | docs/factory-design.md:34                    |
| Rows 8–9 of the compilation table                                                                  | docs/factory-design.md:201–202               |
| Export validator: fails on empty/placeholder context or missing manifest path, fail closed         | export/validate-export.py (module docstring) |