CI/CD Platform  ·  View 06 of 22  ·  People and journeys

Journey — Promote a Release, Then Take It Back

Moving a digest is cheap. Deciding whether the new version is the cause is not.

Editable source SVG draw.io All views
Release owner one of 9 business units Goal — Ship exactly the bits that passed staging, and undo it in minutes if it is wrong Trigger — A green run on a release tag of the main branch Done when — Production on a known digest, with evidence for every gate that passed 1 · Verify 2 · Approve 3 · Deploy ◆ moment of truth 4 · Watch ◆ moment of truth 5 · Roll back What they do Checks the digest Approves in the UI Watches the deploy Reads target SLOs Picks the last digest What the platform does Verifies attestation Evaluates every gate Takes the deploy lock Moves the pointer Records gate evidence Repoints, no rebuild How it feels Confident Fine Exposed Where it hurts Gate denies, reason unclear Is this us or the target? Rebuild would cost 20 min What the platform gains Same bits as staging No interleaved deploy Rollback in 5 minutes Journey — Promote a Release, Then Take It Back The trough is the watch, not the deploy. Promoting a digest is cheap; deciding whether the new version is the cause is not. v 1.0 · owner Platform Engineering · date 2026-09

The finding

  • The trough is Watch. The release owner can promote in seconds and roll back in minutes, and still spend forty minutes deciding whether the target's degradation is theirs.
  • That is a requirement wearing an operational costume: the gate service needs the target environment's SLO health as an input, and the deployment record needs to be correlatable with the target's own telemetry.

What build-once buys here

  • The digest in production is byte-identical to the one that passed staging, so "did we ship what we tested" has a cryptographic answer.
  • Rollback repoints to a retained digest in p95 ≤ 5 min with no rebuild. A rebuild-per-environment design cannot offer this, because the bits would be new.

Assumptions

  • Promotion decision to deployment started p95 ≤ 60 s; rollback p95 ≤ 5 min, ceiling 15 min; a 30-minute soak in staging.
◀  Journey — A Pull Request From a Fork All views Layered Architecture  ▶
Solution Architecture v1.0 · Amazon Web Services · Platform Architecture · 2026-0906-journey-promote-and-roll-back