Release Coordinator Documentation

Two-Layer Enforcement Architecture

1. Primary Security Layer: GCP IAM & Deployer-SA Impersonation
2. Per-app deployer service accounts enforce zero-trust identity boundaries (ww-deployer@nifty-condition-503506-j1.iam.gserviceaccount.com for WorkWingman rungs).
3. Every gcloud invocation issued by rc (Cloud Run, Cloud Build, Cloud Storage, Artifact Registry) executes strictly via --impersonate-service-account=<sa>.
4. If a rung declares a deployer service account and impersonation cannot be applied or fails, rc fails closed immediately rather than falling back to human developer credentials.

5. Cloud IAM roles restrict direct service mutation (roles/run.admin, roles/storage.admin, etc.), and execution identities are logged in executedAs provenance/deploy records.

6. Ergonomic Guardrail Layer: PreToolUse Client Hook (rc hook-pretool)

7. Intercepts local developer/agent CLI calls (gcloud run deploy, gcloud storage rsync, gcloud artifacts docker tags, docker push, git push).
8. Demands an active rc claim token; fails-closed if unverified or missing.