Prompt & Configuration Registry  ·  View 13 of 21  ·  Runtime

Promotion and Its Gates

Four automatic gates, three human ones, and the one operation that skips the second set.

Editable source SVG draw.io All views
Request Promote to production one key or a set Atomic set all or none Automatic gates Schema & variables Policy lint safety settings Secret scan Eval threshold verdict on this digest Human gates Second approver Owning group high-risk keys Open incident? Commit Pointer write etcd, linearisable Audit entry actor, rationale, digest Outcome Live at declared % Held awaiting a person Rejected reason on the digest below threshold incident open recorded on request Promotion — The Gates a Change Passes Through Application we own Decision point Data store Security / platform Risk / gap failure / alternate event / async Rollback enters at Commit and skips the human gates. That is the only difference between the two operations. v 1.0 · owner Platform Architecture · d 2026-09

Decisions

  • Automatic gates run on the digest, not on the draft. A verdict is bound to the exact artefact that will serve, which is what makes the promotion record honest.
  • Rollback enters at Commit and skips the human gates. That is the only difference between promotion and rollback, and it is deliberate (ADR-04).
  • A promotion spanning several keys is atomic: three keys become visible as one transition or not at all, because a half-applied behaviour change is a behaviour nobody designed.

Assumptions

  • ≈ 200 promotions/day at peak with 20 concurrent (stated assumption) — low enough that a linearisable pointer store is never the bottleneck.
  • An open incident on a key blocks promotion by default. Overriding it is allowed, recorded, and named after the person who did it.
  • Evaluation verdicts are available for a digest within ≈ 11 minutes, so the gate is a precondition on promotion rather than a step inside it.

Risks

  • Gate fatigue. Seven gates on a 200-a-day flow is a strong incentive to mark keys low-risk so the human gates fall away. The risk classification therefore has to be owned outside the team that promotes.
  • "Held" is the state most likely to be misread as "failed" and worked around. It is given its own outcome box for exactly that reason.
◀  Resolution Path All views Propagation and Convergence  ▶
Solution Architecture v1.0 · open source, self-hosted on Kubernetes · Platform Architecture · 2026-09 · 21 views · 17 architecture decision records13-promotion-and-gates