Prompt & Configuration Registry · View 05 of 21 · People and journeys
The trough, and what answers it
- Orient is the bottom of the line: six things changed today and the fleet may not be uniform. The engineer cannot act until they know which digest served the bad window.
- This is a data requirement, not an interface requirement — the registry must already hold the last ten digests that served production and the window each one served (ask.md §6).
- Version skew is made a metric rather than a surprise, precisely so this phase has an answer instead of a theory.
Decisions this journey forces
- Rollback requires no approval. An approval gate on the reverse operation is an availability decision disguised as a control (ADR-04).
- Rollback is the same mechanism as promotion, run backwards — so the path is exercised every day rather than once, under pressure.
- The kill switch exists for the case where rollback is not enough: it detaches the key from every experiment and serves the declared safe default in one action.
Residual risk
- The confirming signal lags the revert by around ten minutes, so the engineer hands over without certainty. Accepted: the alternative is holding traffic on a suspect version until a slow metric agrees.
- A rollback that is not the fix costs a second cycle. The kill switch bounds that cost, at the price of the feature degrading to its default.
