Kit Software-Delivery

Golden path spec: target users, stack, scaffolding, CI/CD, environments, observability and security defaults, Backstage catalog

CI/CD design: stages and gates, environments and promotion, OIDC secrets, SBOM and provenance, rollout and rollback, CICD-SEC review, DORA metrics, traceability

One reusable IaC module: inputs and outputs, guardrails, security baseline, tagging contract, SemVer rules, tests and policy as code, deprecation

Branching standard: model selection, naming, MUST/SHOULD rules, ruleset settings, SLSA Source mapping, merging, release branches, hotfixes, exceptions, metrics

Versioning policy: SemVer or CalVer rules, release types and cadence, changelog conventions, support tiers, LTS, CRA support period, backports, yanking

Feature flag standard: flag types and lifetimes, naming, metadata, lifecycle, rollout stages, kill switches, change control, testing, privacy, flag debt

Dependency policy: tiers, intake scoring, approved sources, lock files and SHA pinning, cooldown, update targets, malicious packages, licences, forks, metrics

Code ownership policy: ownership models, RACI, MUST/SHOULD rules, CODEOWNERS standard and example, review SLAs, escalation, orphaned code, transfers, metrics

Per-release checklist: planning and pre-mortem, freeze, QA, security, 2026 SBOM fields, VEX and advisories, signing, ring rollout, emergency rollback, sign-offs

Deployment runbook: release metadata, pre-deploy checklist, go/no-go, steps with verification, canary rollout, rollback, comms

Keep a Changelog + SemVer

Release notes: highlights, features, fixes, breaking changes with migration, deprecations with deprecation and sunset dates, CVE fixes, known issues, upgrade steps

Quarterly DORA five-metric report per service, definitions and formulas, data quality, capability assessment, survey data, findings, actions