| DEPLOY_001_CONFIG_OUTSIDE_CODE | Config ist vom Code getrennt | must |
| DEPLOY_002_CONFIG_VALIDATION_AT_BOOT | Config wird beim Start validiert | must |
| DEPLOY_003_SECRETS_NOT_VERSIONED | Secrets sind nie versioniert | must |
| DEPLOY_004_SECRET_ROTATION | Secrets haben Rotation und Fallback | should |
| DEPLOY_005_ORDERED_DEPLOYMENT_STEPS | Deployments sind geordnet | must |
| DEPLOY_006_MIGRATION_DEPLOY_PLAN | Migrationen haben Deploy-Plan | must |
| DEPLOY_007_BACKUPS_AND_RESTORE_TESTS | Backups werden restore-getestet | must |
| DEPLOY_008_FEATURE_FLAGS_WITH_EXPIRY | Feature Flags haben Ablaufdatum | should |
| DEPLOY_009_RUNTIME_PROCESS_SUPERVISION | Runtime-Prozesse werden ueberwacht | must |
| DEPLOY_010_OPCACHE_DEPLOY_INVALIDATION | OPcache ist Deployment-bewusst | must |
| DEPLOY_011_SECURITY_HEADERS_BY_ENVIRONMENT | Security Header sind pro Umgebung definiert | should |
| DEPLOY_012_ASSET_VERSIONING | Assets sind versioniert | must |
| DEPLOY_013_NO_CLIENT_EXPOSED_INTERNAL_CONFIG | Interne Config geht nicht an den Client | must |
| DEPLOY_014_ROLLBACK_WITH_DATA_COMPATIBILITY | Rollback beachtet Datenkompatibilitaet | must |
| DEPLOY_015_TARGET_SCHEMA_DRIFT_BLOCKS_MIGRATION | Schema-Drift blockiert Migrationen | must |
| DEPLOY_016_PRODUCTION_MIGRATION_REQUIRES_EXPLICIT_TARGET_APPROVAL | Prod-Migrationen brauchen Target-Freigabe | must |
