Bundle deploy preflight evidence for support

README.md

@@ -254,7 +254,7 @@ checks quickstart handoff evidence for first-run package health, HTTP/team
 handoff, demo, deploy, support, permissions, preflight, client, dashboard, and
 artifact inventory coverage. It also
 checks support/doctor handoff evidence for operator refresh, no-remediation
-doctor output, release-manifest binding, and hashed support inventory. It also
+doctor output, deploy/preflight evidence, release-manifest binding, and hashed support inventory. It also
 checks deploy/preflight handoff evidence for templates, placeholders,
 secret-reference manifests, provider-shaped production refs, and non-local bind
 defaults. It also checks the
@@ -595,11 +595,12 @@ or pass `--release-manifest` so the doctor can confirm the package manifest,
 package lock, archive checksum, and install receipt hashes still line up.
 Run `dist/agentk-sidecar/bin/agentk-sidecar-support-bundle --json` when an
 operator needs one support artifact. It refreshes the operator handoff, runs
-the sidecar doctor, inventories package manifest/lock/release manifest,
-dashboard, store, trace, and notification evidence with byte counts and
-SHA-256 hashes, adds ticket-attachment guidance for operator handoff, doctor,
-package, trace, store, approvals, notification drafts, and release manifest
-files, then writes
+the sidecar doctor, refreshes deploy/preflight handoffs, inventories package
+manifest/lock/release manifest, deployment, preflight, dashboard, store, trace,
+and notification evidence with byte counts and SHA-256 hashes, adds
+ticket-attachment guidance for operator handoff, doctor, deploy handoff,
+production preflight, package, trace, store, approvals, notification drafts,
+and release manifest files, then writes
 `sidecar/.agentk/support-bundle/support-bundle.json` and
 `sidecar/.agentk/support-bundle/support-bundle.md` without uploading anything
 to a hosted service.
@@ -960,7 +961,7 @@ to recreate the package, archive, checksum, and release manifest in a
 repo-local smoke root, execute the packaged HTTP and team handoff checks,
 safe-agent demo, dashboard, sidecar check, store export/check/sync, operator
 handoff artifact, support bundle JSON/Markdown, deploy handoff JSON/Markdown,
-release-manifest check, sidecar doctor release-manifest binding,
+production preflight JSON/Markdown, release-manifest check, sidecar doctor release-manifest binding,
 Slack/GitHub/email payload exporters, and Postgres dry-run push
 launchers, then write one JSON evidence report with SHA-256 and byte counts for
 the required handoff artifacts before a release branch or tag. Then run

docs/mcp-proxy.md

@@ -307,7 +307,8 @@ install receipt hashes. It is a local/team sidecar alpha support artifact, not
 a hosted SaaS readiness check.
 Run `<package>/bin/agentk-sidecar-support-bundle --json` when a reviewer or
 operator needs one support archive. It refreshes the operator handoff, runs the
-sidecar doctor, and writes support-bundle JSON/Markdown with hashed package,
+sidecar doctor, deploy handoff, and production preflight, then writes
+support-bundle JSON/Markdown with hashed package, deployment, preflight,
 dashboard, store, trace, notification evidence, and ticket-attachment guidance
 for local/team handoff.
 Run `<package>/bin/agentk-sidecar-permissions-handoff --json` when a team wants

docs/productization-plan.md

@@ -352,8 +352,8 @@ The safest first productization slice is the local team sidecar path:
     install receipt hashes into the support report.
     `sidecar-package-support-bundle` and the packaged
     `bin/agentk-sidecar-support-bundle` launcher compose the operator handoff,
-    sidecar doctor, and hashed evidence inventory into one archiveable
-    support-bundle JSON/Markdown artifact.
+    sidecar doctor, deploy/preflight handoffs, and hashed evidence inventory
+    into one archiveable support-bundle JSON/Markdown artifact.
 14. The subprocess MCP gateway has an operator-configurable
     `max_client_messages` cap, exposed on `mcp-proxy-stdio` and generated
     sidecar bundles, so runaway clients cannot hold one proxy session forever.

docs/release-checklist.md

@@ -153,8 +153,9 @@ hardening, redacted probes, and permission-checked review APIs. It also checks
 quickstart handoff evidence for first-run package health,
 HTTP/team handoff, demo, deploy, support, permissions, preflight, client,
 dashboard, owner-specific next actions, and artifact inventory coverage. It checks support/doctor handoff
-evidence for operator refresh, no-remediation doctor output, release-manifest
-binding, hashed support inventory, and ticket-attachment guidance, plus accepted-limit checks that keep
+evidence for operator refresh, no-remediation doctor output, deploy/preflight
+evidence, release-manifest binding, hashed support inventory, and
+ticket-attachment guidance, plus accepted-limit checks that keep
 hosted SaaS, live IdP, production secret retrieval, public internet gateway, and
 similar deferred-scope claims out of the alpha handoff. The same ticket
 checks deploy/preflight handoff evidence for templates, placeholders,

docs/v0.2-alpha-release-notes.md

@@ -71,8 +71,9 @@ filesystem-shaped workflows.
   dashboard, owner-specific next actions, artifact inventory, and local
   non-hosted scope.
   The ticket also checks support/doctor handoff evidence for operator handoff
-  refresh, no-remediation doctor output, release-manifest binding, hashed
-  support inventory, ticket-attachment guidance, and local non-hosted scope.
+  refresh, no-remediation doctor output, deploy/preflight evidence,
+  release-manifest binding, hashed support inventory, ticket-attachment
+  guidance, and local non-hosted scope.
   The ticket checks publication handoff evidence for strict finalization,
   signed tag evidence, package archive hash, final release notes, owner-scoped
   publication steps, and `release-publication-check` coverage before a
@@ -146,8 +147,9 @@ filesystem-shaped workflows.
   and Markdown remediation output.
 - Packaged support bundle:
   `agentk-sidecar-support-bundle` refreshes the operator handoff, runs the
-  sidecar doctor, and writes one archiveable support-bundle JSON/Markdown report
-  with hashed package, dashboard, store, trace, and notification evidence.
+  sidecar doctor, deploy handoff, and production preflight, then writes one
+  archiveable support-bundle JSON/Markdown report with hashed package,
+  deployment, preflight, dashboard, store, trace, and notification evidence.
 - Packaged safe-agent demo handoff:
   `agentk-sidecar-demo-handoff` refreshes the credential-free
   GitHub/Postgres/Slack/filesystem demo evidence and writes one archiveable
@@ -243,8 +245,9 @@ These limits are explicit alpha scope, not hidden caveats:
   artifact for the same local proof. The packaged `agentk-sidecar-doctor`
   command adds one support/remediation report for install or update checks and
   can bind that report to the package release manifest. The packaged
-  `agentk-sidecar-support-bundle` command combines the handoff, doctor, and
-  hashed evidence inventory into one archiveable support artifact. The packaged
+  `agentk-sidecar-support-bundle` command combines the handoff, doctor,
+  deploy/preflight handoffs, and hashed evidence inventory into one archiveable
+  support artifact. The packaged
   `agentk-sidecar-dashboard-handoff` command refreshes the demo trace, renders
   the static dashboard, syncs the durable team store, and writes one
   JSON/Markdown dashboard readiness artifact. The