Term Kind Topic What it is
Bake Time concept Multi-Region Rollout The deliberate wait between rollout steps, sized by how long the fault you are watching for takes to appear.
Build Attestation concept Supply-Chain Provenance A signed statement about how an artifact was produced — by which builder from which source — that a deployment gate can verify rather than trust.
Configuration as Change Config-Code Parity, Data Deployment Rigour, Non-Code Change Control concept Change Management vs CD Applying the review, validation, staging and rollback discipline of code deployment to configuration, content and data updates - because they change production behaviour, ship more often, and are interpreted w…
Configuration Drift concept IaC Modules & Drift The gap that opens between the infrastructure your code describes and the infrastructure that actually exists.
Environment Ladder concept Environment Strategy The ordered set of environments a change climbs, where each rung is justified by a distinct claim it can prove that the one below cannot.
Fork-Triggered Build Privileged Trigger, Pwn Request concept Pipeline Secrets A continuous-integration trigger that runs a workflow in the base repository's privileged context while its inputs come from an outside contributor - so the pipeline executes attacker-authored code with its ow…
Leading Health Signal In-Band Invariant Signal, Detection-Latency Gate concept Deployment Strategies A rollout gate input whose latency is shorter than the damage it indicates - the property that decides whether any bake time can catch a defect, as distinct from how much traffic the rollout exposes.
Mutable Image Tag Repushed Tag, Tag Drift concept Artifact Management A registry tag that can be repointed to different content, so the same reference resolves to different artefacts over time or in different places - which makes deployments unreproducible and audit answers wrong.
Pipeline Stage Contract concept Delivery & Release Engineering What each pipeline stage promises the next — an artifact of a stated shape plus a specific claim about it that has been verified.
Policy Failure Mode Admission Fail-Open, Fail-Closed Policy concept Policy as Code What an admission-time policy engine does when it cannot be reached - fail open and allow the change, or fail closed and block it - decided per policy class rather than globally, because a uniform answer is wr…
Recovery Load Restoration Surge, Post-Incident Backlog, Catch-Up Traffic concept Rollback & Forward Fix The traffic generated by a system returning to service - reconnections, queued work, cold caches, retries - which is qualitatively different from steady-state load and routinely turns a short incident into a l…
Release Tarball Divergence Archive-Repository Gap, Distributed-Source Divergence concept Supply-Chain Provenance The gap between a project's reviewed source repository and the source archive that downstream actually builds, which is a trust boundary most supply-chain controls assume does not exist.
Release Unit Promotable Set, Deployment Bundle concept Delivery & Release Engineering The complete set of inputs a promotion must move together - artefact digest, configuration revision, flag defaults and schema version - because promoting only the artefact leaves the rest as untested variables.
Restore-Only Rollback No-Downgrade Path, Backup-Dependent Reversal concept Rollback & Forward Fix The state of a system that cannot be returned to its previous version by deploying it, so the only reversal available is restoring from backup - which converts a minutes-long rollback into a recovery operation…
Reverse Compatibility Window Revert Window, Rollback Precondition concept Rollback & Forward Fix The period during which every live consumer must still accept the previous version's output, because a rollback of one component is a forward-incompatible change for everything downstream of it.
Rolling Update Surge concept Deployment Strategies The extra capacity a rolling deployment temporarily adds, and the unavailability it is permitted, which together decide whether the rollout is safe under load.
Unmanaged Change Surface Out-of-Band Change Path, Ungated Change concept Deployment Gates Every mechanism that can alter production without passing through the deployment pipeline - so the organisation's rollout controls apply to a fraction of its changes and the incidents come from the rest.
Untrusted Build Step Third-Party CI Step, Curl-Pipe-Shell Step concept Pipeline Secrets Any pipeline step whose code you do not control and did not review - a downloaded script, a third-party action, a plugin - which runs with the whole job's credentials and network access.