Add the human decision, and the rollback that has to work

The prompt

Add an approval state, a sandbox deployment step, health checks, and a rollback path. Force a failed health check on purpose and confirm the run records the failure and executes (or clearly presents) the rollback.

Why it's built that way

Exit criterion: only approved, validated artifacts reach the sandbox environment. The capstone's required test here is specific: force a failed sandbox health check after deployment, and the run must record failure and execute or present the defined rollback path — an untested rollback is not a rollback.

What to do with the answer

If the forced failure didn't produce a clean rollback, fix that before treating this phase as complete — it's the one failure mode you don't want to discover in a real incident.