\

Production Safety Boundaries

GWEB uses defense in depth for normal production deployment.

The accepted model includes independent controls such as:

1. tenant CLI does not expose normal prod restart/apply/rollback;
2. deployment-controller mutation policy excludes prod;
3. production environment registry disables normal mutation;
4. CI policy disables direct production CI.

The controlled production-promotion path is separate from these normal deployment commands.

This is intentional: failure in one normal-mutation control should not automatically make production writable.