Every release is signed off by a two-person manual regression pass whose evidence is a spreadsheet an auditor samples quarterly. You have been asked to automate the gate without weakening the audit position. Sequence it.

The sequence

1. Write down what the sign-off actually asserts, claim by claim, from what the two people really do rather than from the document. It is usually six to ten claims: the build came from reviewed source, the schema change is backward compatible, payment totals are right on five scenarios, the three regulated screens still render their disclosures. You cannot automate a gate you cannot enumerate, and this step alone usually finds two claims nobody has checked for a year.
2. Change the evidence format before changing the gate. Have the manual pass emit the record a machine would: artefact digest, claim identifier, verdict, who or what decided, timestamp, written to an append-only store. Now the auditor is already reading the new format while a human is still producing it, so the later switch changes the producer and not the position.
3. Automate one claim at a time, advisory first. The automated check runs on every release and records its verdict; the manual claim remains the gate. This is a parallel run, and its output is a disagreement log.
4. Promote on evidence, not on confidence. A claim becomes blocking after an agreed run of releases with no unexplained disagreement - ten releases is a reasonable bar on a fortnightly train. Each promotion is one line in the gate configuration and is reversible that afternoon.
5. Close the environment gap before retiring the pass. The manual testers verified the thing that was deployed; your automated checks verify an artefact. Add a post-deploy assertion that every host reports the digest that was signed, or the gate certifies something that may not be running.
6. Retire the manual pass, claim by claim, keeping the claim in the evidence record marked as automatically verified.

Where it diverges and how you would know

The disagreement log from step 3 is the instrument. Three patterns appear: the automated check is weaker than the human (it asserts presence where the human asserted correctness), the human was rubber-stamping (no disagreements ever, including on a release you deliberately broke - test this), or both are right and the claim was ambiguous. A claim with unexplained disagreements is not ready to be promoted, and the temptation to promote on schedule pressure is the way this migration fails.

SLSA's build track is useful vocabulary here: level 1 is provenance that merely exists and may be unsigned, level 2 requires a hosted platform that signs it. The same ladder applies to a quality gate - an evidence record is worth little until it is produced by something the submitter cannot edit.

The point of no return, and the honest duration

The point of no return is step 6 for the last claim, because the manual capability disappears within a quarter - the people are reassigned and the tacit knowledge goes with them. Keep one rehearsed manual claim as a break-glass path for six months.

Expect two to four releases per claim and six to ten claims: two to three quarters on a fortnightly train, with no reduction in manual effort in the first quarter, because step 2 adds work to the pass you are trying to remove. Budget for that honestly or the programme loses support at exactly the point where it has costs and no benefits.

When this is the wrong answer

When you release twice a year. A four-person-day regression pass twice a year is eight person-days; a two-quarter automation programme never pays that back. Spend the money on the evidence record and the post-deploy digest assertion instead, keep the humans, and revisit when release frequency changes - which is the actual trigger for this work, not the existence of manual testing.