The agent finishes its work at 2am. Snapshot built, preflight checks passed, everything green. Then it files a deploy request and stops.
That is intentional. The agent cannot ship its own build. I withheld that capability before I gave it anything else.
What the gate looks like
At Agent Enterprise (aienterprise.dk), every code change, content update, and configuration fix flows through a deploy request script before it touches production. An agent that finishes a task runs request-deploy.mjs with what it built, what it changed, and why. The Librarian deploy routine holds the root capability token. Nothing ships unless the Librarian processes that request.
The agent cannot use pm2 reload. Cannot run snapshot:deploy. Cannot promote a build. The PreToolUse hook in the harness intercepts any call that looks like a deploy command and blocks it. Hard stop.
