Payment Checkout & Ledger Service  ·  View 21 of 24  ·  Operations

Release and Rollout

How a system holding other people's money is changed, and the one thing that cannot be rolled back.

Editable source SVG draw.io All views
Source Pull request 2 reviewers Posting rule change finance sign-off Build Signed image + SBOM Forward-only migration no destructive DDL Gates Ledger balance property test hard gate Replay last 24 h of events byte-identical CDE scope diff no new PAN path Canary Shadow post new rules, not booked 1% of merchants 30 min watch Promote Authorization pods rolling, drain in-flight Ledger poster one version at a time Reverse Image rollback minutes Posted entries never rolled back correct forward shadow first on regression Release and Rollout — Changing a System That Holds Money Application we own Security / platform Data store Decision point Opportunity Risk / gap synchronous failure / alternate A posting-rule change ships shadowed before it books anything. Code rolls back; ledger entries do not — they are corrected forward. v 1.0 · owner Payments Platform Architecture · date 2026-10

Decisions

  • A posting-rule change ships shadowed first: new rules evaluated, nothing booked, output diffed against the live rules (ADR-10).
  • Code rolls back in minutes. Posted ledger entries never roll back — they are corrected forward, which is why the gate matters more than the rollback.
  • Replaying the last 24 hours of events through a candidate poster must produce byte-identical transactions. That is a hard gate, not a test suite.
  • A change that widens PCI scope is blocked at the CDE scope diff, not discovered at the next audit (ADR-11).

Decisions

  • Forward-only migrations: no destructive DDL on an append-only store.
  • One ledger-poster version runs at a time, so two posting-rule versions can never book the same event.

Risks

  • The replay gate takes as long as the replay does, and it will become the slowest part of the pipeline as volume grows. The temptation to sample it is the main way this control decays.
◀  The Loop That Must Close All views Trust Zones and What Crosses Them  ▶
Solution Architecture v1.0 · open source, self-hosted on Kubernetes across two in-country data centres · Payments Platform Architecture · 2026-10 · 24 views · 18 architecture decision records21-release-and-rollout