The platform is promoted only from P6-backed evidence with observation, stop conditions, ownership, and tested rollback.
Milestone 4.E.3 — Staged Rollout & Operator Readiness
Status: Planned — promotion consumes E1/E2 and P6 evidence. Outcome: The platform is promoted safely with observation, stop conditions, on-call ownership, and supportability. Track: Track E — Release Readiness & Phase Exit Dependencies: 4.E.1, 4.E.2, 4.P.5, 4.P.6, Track D scope Estimated effort: 2 weeks Gate: G3 promotion
Scope and deliverables
Execute dark launch (internal) → 1% → 10% → 25% → 100% with bake windows and thresholds for error rate, p99, SSE lag, queue depth, cost anomaly, auth failures, deletion backlog, cache isolation, and tenant-negative results. Publish on-call runbook, escalation tree, kill switches, support bundle, and an immutable promotion ledger entry per stage.
Each entry links P6/E1/E2 artifacts, image/artifact digest, schema/configuration version, owner, metric snapshot, go/no-go rationale, and tested rollback command. High-impact actions remain disabled unless their P1/P3 evidence is present.
Verification and rollback
Abort and rollback must be exercised during the promotion exercise. The post-promotion window must have no unowned P0/P1 breach. A guardrail breach halts the stage and restores the prior immutable digest; the operator origin can be disabled without taking down public docs.
Findings addressed
F4-010, F4-011, F4-014.
Exit checklist
- Stage ladder and bake windows are executed or signed off as an explicit exception.
- P6, E1, and E2 manifests link to each promotion stage.
- Abort/rollback transcript and kill-switch inventory are attached.
- On-call support bundle is reviewed.
- Post-promotion observation completes without an unowned P0/P1 breach.
Last updated on