diff --git a/.codex/agents/deployer.toml b/.codex/agents/deployer.toml
new file mode 100644
index 0000000..9e00ff0
--- /dev/null
+++ b/.codex/agents/deployer.toml
@@ -0,0 +1,5 @@
+name = "deployer"
+description = "Deployment-focused agent. It publishes the frontend using the checked-in OSS deploy script, packages the backend jar with Maven, and can upload/restart over SSH only after discovering or being given the target host, destination path, and remote run procedure."
+nickname_candidates = ["deployer", "deploy", "release", "publish"]
+sandbox_mode = "workspace-write"
+include_apply_patch_tool = false
diff --git a/.codex/config.toml b/.codex/config.toml
index a506614..464a13b 100644
--- a/.codex/config.toml
+++ b/.codex/config.toml
@@ -30,3 +30,8 @@ nickname_candidates = ["tester", "qa", "verify"]
 description = "Performs read-only review for bugs, regressions, and test gaps."
 config_file = ".codex/agents/reviewer.toml"
 nickname_candidates = ["reviewer", "review", "audit"]
+
+[agents.deployer]
+description = "Handles release-style delivery: build and publish the frontend to OSS, and package/upload the backend jar over SSH when deployment details are available."
+config_file = ".codex/agents/deployer.toml"
+nickname_candidates = ["deployer", "deploy", "release", "publish"]
diff --git a/AGENTS.md b/AGENTS.md
index fe48a52..becbbac 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -45,6 +45,23 @@ Important: there is no dedicated backend lint command and no dedicated backend t
 
 If you need one of these, run it explicitly from the file that already exists instead of inventing a new wrapper command.
 
+### Release and deploy commands
+
+- Frontend OSS publish from repo root:
+  `node scripts/deploy-front-oss.mjs`
+- Frontend OSS dry run from repo root:
+  `node scripts/deploy-front-oss.mjs --dry-run`
+- Frontend OSS publish without rebuilding from repo root:
+  `node scripts/deploy-front-oss.mjs --skip-build`
+- Backend package from `backend/`:
+  `mvn package`
+
+Important:
+
+- `scripts/deploy-front-oss.mjs` expects OSS credentials from environment variables or `.env.oss.local`.
+- The repository does not currently contain a checked-in backend deploy script. Backend delivery is therefore a two-step process: build `backend/target/yoyuzh-portal-backend-0.0.1-SNAPSHOT.jar`, then upload/restart it via `ssh` or `scp` using the real target host and remote procedure that are available at deploy time.
+- Do not invent a backend service name, process manager, remote directory, or restart command. Discover them from the server or ask only if they cannot be discovered safely.
+
 ## Role routing
 
 - `orchestrator`: default coordinator. It decides which specialist agent should work next, keeps cross-directory work aligned, and writes the final handoff. It should stay read-only.
@@ -53,6 +70,7 @@ If you need one of these, run it explicitly from the file that already exists in
 - `implementer`: code changes only. It owns edits in `backend/`, `front/`, `scripts/`, or docs, and may update nearby tests when the implementation requires it.
 - `tester`: verification only. It runs existing repo-backed commands and reports exact failures or missing commands. It should not rewrite source files.
 - `reviewer`: review only. It inspects diffs for correctness, regressions, missing tests, and command coverage gaps. It should stay read-only.
+- `deployer`: release and publish only. It builds the frontend and backend using existing commands, runs the checked-in OSS deploy script for the frontend, and handles backend jar upload/restart over SSH when credentials and remote deployment details are available.
 
 ## Default workflow
 
@@ -62,6 +80,7 @@ If you need one of these, run it explicitly from the file that already exists in
 4. Use `implementer` for the actual code changes.
 5. Use `tester` after implementation. Prefer the narrowest real command set that still proves the change.
 6. Use `reviewer` before final delivery, especially for cross-layer changes or auth/files/storage flows.
+7. Use `deployer` only after code is committed or otherwise ready to ship.
 
 ## Repo-specific guardrails
 
@@ -70,5 +89,7 @@ If you need one of these, run it explicitly from the file that already exists in
 - Backend local development behavior is split between `backend/src/main/resources/application.yml` and `application-dev.yml`; the `dev` profile uses H2 and mock CQU data.
 - Backend tests already exist under `backend/src/test/java/com/yoyuzh/...`; prefer adding or updating tests in the matching package.
 - Frontend tests already exist under `front/src/**/*.test.ts`; keep new tests next to the state or library module they verify.
+- For frontend releases, prefer `node scripts/deploy-front-oss.mjs` over ad hoc `ossutil` or manual uploads.
+- For backend releases, package from `backend/` and deploy the produced jar; do not commit `backend/target/` artifacts to git unless the user explicitly asks for that unusual workflow.
 
 Directory-level `AGENTS.md` files in `backend/`, `front/`, and `docs/` add more specific rules and override this file where they are more specific.
diff --git a/backend/AGENTS.md b/backend/AGENTS.md
index 78b5538..1e2718d 100644
--- a/backend/AGENTS.md
+++ b/backend/AGENTS.md
@@ -21,6 +21,12 @@ Run these from `backend/`:
 - `mvn test`
 - `mvn package`
 
+For backend release work:
+
+- The produced artifact is `backend/target/yoyuzh-portal-backend-0.0.1-SNAPSHOT.jar`.
+- The repository does not contain a checked-in backend deployment script.
+- Deployment therefore means: package locally, then upload and restart via `ssh` / `scp` using the actual remote host and remote process details available at deploy time.
+
 There is no dedicated backend lint command and no dedicated backend typecheck command in the checked-in Maven config or README. If a task asks for lint/typecheck, say that the backend currently does not define those commands.
 
 ## Backend rules
@@ -30,3 +36,4 @@ There is no dedicated backend lint command and no dedicated backend typecheck co
 - Respect the existing `dev` profile in `application-dev.yml`; do not hardcode assumptions that bypass H2 or mock CQU behavior.
 - If a change affects file storage behavior, note that the repo currently supports local storage and OSS-related migration/deploy scripts.
 - Prefer Maven-based verification from this directory instead of ad hoc shell pipelines.
+- For deploy work, never invent a remote directory, service name, or restart command. Discover them from the server or ask when discovery is impossible.
diff --git a/front/AGENTS.md b/front/AGENTS.md
index 7fdd07e..c495795 100644
--- a/front/AGENTS.md
+++ b/front/AGENTS.md
@@ -22,11 +22,18 @@ Run these from `front/`:
 - `npm run lint`
 - `npm run test`
 
+Run this from the repository root for OSS publishing:
+
+- `node scripts/deploy-front-oss.mjs`
+- `node scripts/deploy-front-oss.mjs --dry-run`
+- `node scripts/deploy-front-oss.mjs --skip-build`
+
 Important:
 
 - `npm run lint` is the current TypeScript check because it runs `tsc --noEmit`.
 - There is no separate ESLint script.
 - There is no separate `typecheck` script beyond `npm run lint`.
+- OSS publishing uses `scripts/deploy-front-oss.mjs`, which reads credentials from environment variables or `.env.oss.local`.
 
 ## Frontend rules
 
@@ -35,3 +42,4 @@ Important:
 - Preserve the current Vite alias usage: `@/*` resolves from the `front/` directory root.
 - If a change depends on backend API behavior, verify the proxy expectations in `vite.config.ts` before hardcoding URLs.
 - Use the existing `npm run build`, `npm run test`, and `npm run lint` commands for validation; do not invent a separate frontend verification command.
+- For release work, let the deployer agent publish `front/dist` through `scripts/deploy-front-oss.mjs` instead of manual object uploads.