[braboj]

infra/deployment.md keeps the deployment rules that hold on any target and drops the cloud, hybrid and offline product choices.

Section (ID kept)	Before	After
Targets	Cloud/hybrid/offline table	Declare each target in the context file; note what differs
Certificates	ACM, step-ca, Vault PKI, CFSSL per target	Automated renewal; expiry is an incident; roots via config management; renewal and revocation on reachable endpoints
Load balancing	ALB, F5, Citrix, HAProxy, MetalLB	Public ingress only via a health-checking LB or proxy; private services may resolve each other directly; prefer L7 for HTTP
DNS	Route 53, BIND, Consul, etcd	Resolve by name; hostnames resolve before deploy; clock sync
Registries	ECR, Harbor, Athens, devpi, Verdaccio, env vars	Sign and scan before production; mirror where public registries are unreachable; verify before mirroring
Secrets	Cloud secret services, Vault topologies, Shamir	Runtime injection; rotation; platform identity; recovery free of unreachable services; break-glass
Network	Per-target assumptions	Documented segments and endpoints; defined boundary crossings; firewall rules in git; hidden-call audit offline

• All eight section IDs stay; no reference elsewhere changes
• Retained in place, so chain reach is unchanged: connectivity assumptions, automated renewal, dependency verification
• No SHOULD or MAY in the file before or after
• Manifest description and migration-guide row updated
• Add a fleet-scale axis to base-deployment: deploy mechanism (and its rationale) is scale-dependent #717 (fleet-scale axis) now targets a product-neutral file
• Fork side: Imbra-Ltd/imbra-ai-templates#58

Score	Before	After
deployment	95.4	99.4

Checks

• Smoke 35/35; conformance 12 passed, 0 failed, 1 not applicable; readings read
• Fork sync, redundancy audit, resolve, sync_docs --check, score ratchet
• markdownlint, pre-commit hooks

Closes #2084.

🤖 Generated with Claude Code