Every route is governed. Here they all are.

# Install the strato CLI
$ curl -fsSL https://get.skyforge.io/strato | sh
$ strato login            # opens SS-01 OIDC device flow
$ strato tenant use acme

# Connect a repo and turn on hands-off deploys
$ strato apps connect storefront \
    --repo github.com/acme/storefront --branch main
$ strato autodeploy enable storefront --branch main

# Ship. checkout → build → test → scan → gate → admit → roll → route
$ git push origin main
  → run succeeded · deployed revision storefront-r9
  → https://storefront.acme.skyforge.app

# Auth is an SS-01 OIDC token + your tenant header.
export TOKEN=...            # from signup / API key
export TENANT=acme
export BASE=https://api.skyforge.io/api/v1

# 1. Create the app
curl -X POST "$BASE/apps" \
  -H "Authorization: Bearer $TOKEN" -H "X-Tenant-Id: $TENANT" \
  -H "Idempotency-Key: $(uuidgen)" -H "Content-Type: application/json" \
  -d '{"name":"storefront","repo":"git@github.com:acme/storefront.git","branch":"main"}'

# 2. Start the crash-safe deploy saga
SAGA=$(curl -sX POST "$BASE/apps/storefront/deploy/saga" \
  -H "Authorization: Bearer $TOKEN" -H "X-Tenant-Id: $TENANT" \
  -H "Content-Type: application/json" \
  -d '{"git_sha":"9b2c867","image":{"digest":"sha256:9f2c","signed":true,"sbom":true,"scanned":true},"gate":"pass"}')

# 3. Drive it to a terminal state — crash-safe, resumes at the failed step
curl -X POST "$BASE/apps/storefront/deploy/saga/$(echo "$SAGA" | jq -r .id)/advance?run=all" \
  -H "Authorization: Bearer $TOKEN" -H "X-Tenant-Id: $TENANT"