Schema compatibility is a build gate, not a runtime discovery — a breaking Avro change fails the merge request
Vulnerability scan blocks on critical; policy check is OPA Gatekeeper on the rendered manifests
Staging runs the peak load profile, 25 000 events/s, on every release train rather than quarterly
Config as a first-class artefact
Rules, templates and quotas live in a repository and ship through the same gates as code
A rule change is versioned, reviewed and revertible, which is what makes requirement six — change rules without redeploying producers — safe rather than merely possible
Config-only changes skip the image build but not the gates or the audit record
Assumptions
Two approvals for code; change advisory board only for schema and retention changes
Automatic rollback triggers on an SLO burn rate above 2× within 10 minutes of a canary step
