comment about rule 6: "Use version control"
Surely there are many reasons forcing any reasonable process to use version control, but reproducibility IMHO is not.
Burning everything (all archives, the VM to build, all sources, packages and tools) on DVDs and store together with a suited hardware in a safe allows to reproduce this version without version control.
Actually policies exists requiring storing every release as ZIP archive(s) on WORM (write once, read many) media.