more updates

Reviewed-on: #8

skills/sdlc/SKILL.md

@@ -23,7 +23,7 @@ Three long-lived branches map to the three deployment environments:
 
 | Branch | Environment | Who merges | Prerequisites for merge |
 |--------|-------------|-----------|-----------|
-| `dev`  | Dev         | Engineer | None (self-merges after CI passes) |
+| `dev`  | Dev         | Engineer | CI passes |
 | `uat`  | UAT         | Engineer | QA code review approval |
 | `main` | Production  | Engineer | UAT validation & CTO code review |
 
@@ -65,16 +65,26 @@ Gitea branch protection requires CI checks to pass.
 2. **UAT** fail → back to **Engineer** (return to Phase 1).
 3. **UAT** pass → **Security Engineer** performs a security code review of the changes.
 4. **Security** fail → back to **Engineer** (return to Phase 1).
-5. **Security** pass → **Engineer** opens a PR from `uat` to `main`.
+5. **Security** pass → Begin Phase 4.
+
+### Phase 4 — Production Promotion
+
+1. **Engineer** opens a PR from `uat` to `main`.
+2. **CI** fail → back to **Engineer** (return to Phase 1).
+3. **CI** pass → **CTO** performs code review.
+4. **CTO** rejected → back to **Engineer** (return to Phase 1).
+5. **CTO** approved → **Engineer** merges PR.
 6. **CI** fail → back to **Engineer** (return to Phase 1).
-7. **CI** pass → Begin Phase 4.
+7. **CI** pass → Begin Phase 5.
 
-### Phase 4 — Production
+### Phase 5 — Production Deployment
 
-1. **CTO** performs code review.
-2. **CTO** approved → **Engineer** merges PR.
-3. **CTO** rejected → back to **Engineer** (return to Phase 1).
-4. **CI** deploys automatically to Production (`https://demo.groombook.dev`).
+1. **Engineer** opens a PR against `groombook/infra` to update the relevant Kustomize overlay with the new image tag.
+2. **CI** fail → back to **Engineer** (return to Phase 1).
+3. **CI** pass → **QA** performs code review.
+4. **QA** rejected → back to **Engineer** (return to Phase 1).
+5. **QA** approved → **Engineer** merges PR.
+6. **Flux** reconciles `groombook/infra` on merge and rolls out the updated pods to production (`https://demo.groombook.dev`).
 
 ## Infrastructure
 
@@ -88,11 +98,11 @@ Gitea branch protection requires CI checks to pass.
 ## Authentication
 
 * **Framework:** Better-Auth.
-* **OAuth Providers:** GroomBook (Authentik), Google and Apple.
+* **OAuth Providers:** GroomBook (Authentik), Google, and Apple.
 * **SSO:** Authentik OIDC at `https://auth.farh.net` (credentials in `authentik-credentials` secret).
 * **Never build custom authentication.**
 
-## Deployment — 2-stage Flux GitOps
+## Continuous Integration & Deployment
 
 **Stage 1 — CI (runs in each application repo):**
 - Triggered automatically on every merge to `main`
@@ -107,16 +117,6 @@ Gitea branch protection requires CI checks to pass.
 
 **Policy — Flux Image Tag Automation is DENIED.** Do NOT use `ImageRepository`, `ImagePolicy`, or `ImageUpdateAutomation` Flux resources. Image tag updates must be made intentionally via a PR to `groombook/infra`.
 
-**To deploy a change:**
-1. Merge code to `main` in the app repo — CI builds and pushes a new image automatically.
-2. Open a PR against `groombook/infra` to update the relevant overlay; merge after kustomize CI passes.
-3. Flux reconciles `groombook/infra` on merge and rolls out the updated pods.
-
-**To force a rollout without a manifest change:**
-```bash
-kubectl rollout restart deployment/<name> -n <namespace>
-```
-
 ## Infrastructure as Code
 
 Terraform (OpenTofu) is deployed via the **Flux OpenTofu Controller** in a GitOps fashion. Submit Terraform configurations via a PR to `groombook/infra` — the tofu controller reconciles them on merge.