CI/CD Platform · View 17 of 22 · Operations
Decisions
- Build once, promote the bits. The artefact that reaches production is byte-identical to the one that passed staging, which is the only thing that makes "did we ship what we tested" answerable.
- Gates are evaluated by a decision service outside the pipeline, so a pipeline author cannot weaken the gates that apply to their own deployment.
- Rollback repoints to a retained previously-deployed digest. It is an ordinary operation with a latency target, not a disaster procedure.
Deliberate omissions
- Progressive delivery — canary and blue-green driven by target telemetry — is Phase 3 in the requirement and is not drawn. The deployment lock and pointer model support it without change.
- Per-environment configuration stores are not shown; they belong to the runtime platform, not to this one.
Risks
- Break-glass override is necessary and is the most likely control to be abused. It is recorded with actor, reason and expiry, and its usage count is a watched signal in view 18.
