Chaos Engineering Platform  ·  View 15 of 21  ·  Runtime

Scheduling and the Promotion Ladder

How a definition earns the right to run unattended, and what it never earns.

Editable source SVG draw.io All views
Non-production Staging run adapter proving Attended Ad-hoc attended owner watching 3 consecutive passes Scheduled Recurring unattended allowed windows Window closed → skip Gated Canary suite pre-promotion Pipeline verdict Continuous Continuous verification low intensity, always on Game day Coordinated session facilitated, sequenced Detect / mitigate times class eligible verdicts recorded schedulable if peak same definitions gate proven stable gaps become plan human timings Scheduling — The Promotion Ladder from Ad-hoc to Continuous Application we own Decision point Interface / broker Security / platform Data store synchronous failure / alternate A definition only becomes unattended by earning it. Nothing reaches continuous verification on its first day. v 1.0 · owner Reliability Architecture · date 2026-09

Decisions

  • Nothing runs unattended on its first day. Three consecutive passing attended runs is the price of a schedule.
  • A scheduled run whose window closes is skipped, not queued. A resilience test deferred into peak hours is worse than one not run.
  • Continuous verification is the last rung, not the first: it is the only mode where nobody is watching and nobody scheduled it today.

Assumptions

  • Three consecutive attended passes before a definition becomes schedulable; canary suites gate promotion in the deployment pipeline.
  • Two automatic suspensions a day from the incident feed, which makes skipping normal rather than exceptional.

Deliberate omission

  • Demotion is not drawn. A definition that starts failing is suspended by the fault-class rules on view 13 rather than by a separate ladder.