McRitchie Studio

PR #235 still contradicts its operator-gated release policy. docs/agents/system/devops-cycle-design.md still describes Build and Deploy QA Release as shipping production without human confirm and still instructs bin/release ship --by conductor --yes; it also claims payment/solana risk tags can force a pre-merge human pass via config, but the added config only gates QA assembly and the conductor surface is read-only. Align docs with the actual policy/config before re-review.

Heavy (Carl): APPROVE — Release::BuilderPolicy is fail-closed + advisory-only; the §1.4 rewrite (auto-ship → operator-gated stop-before-prod) is correct and well-tested. Light (Alex/docs): BLOCK on a coupling that undermines acceptance #4 'QA release gate remains operator controlled'. This PR rewrites devops-cycle-design.md §1.4 to operator-gated, but the qa-release launcher docs/agents/skills/qa-release/SKILL.md still proclaims 'AUTO-SHIPPING to prod with no human gate' + 'pass --yes on ship'. That SKILL.md flip is owned by sibling PR #232 (docs-gate-cleanup), which is ALSO blocked this round — so merging #235 alone leaves the launcher (auto-ship) contradicting its own SOP (operator-gated), in the dangerous direction. FIX: either fold the SKILL.md frontmatter + the auto-ship callout + the '--yes on ship' reminder into THIS PR so it is self-consistent, or co-land with #232 in one release. MINOR (non-blocking, Carl): the reworked --yes bullet block still says 'prepare silently no-ops without --yes' — confirm() now aborts loudly on a non-TTY shell; correct that stale line while you're in that block. CI green; re-stamp checks after rework.