Consumer Messaging Platform — WhatsApp-Class System  ·  View 22 of 23

CI/CD and Environment Progression

How a change reaches production and what stops a bad one — including the gates that exist specifically because this system carries cryptography.

Editable source SVG draw.io All views
Source
Source
Protocol Schemas
Versioned, compat checked
Protocol Schemas...
Monorepo
Trunk based
Monorepo...
Build
Build
Hermetic Build
Pinned toolchain
Hermetic Build...
Reproducible Client Build
Publicly verifiable
Reproducible Client Build...
SAST & Dependency Scan
SAST & Dependency Scan
Gates
Gates
Unit & Protocol Conformance
Unit & Protocol Conformance
Crypto Test Vectors
Known-answer tests
Crypto Test Vectors...
Performance Budget
p99 fanout
Performance Budget...
Pre-production
Pre-production
Development
Development
Staging
Synthetic load replay
Staging...
Canary
0.1% of devices
Canary...
Production
Production
Regional Rollout
AZ by AZ
Regional Rollout...
Feature Flags
Server-side kill switch
Feature Flags...
Verify
Verify
Rollback
One command, 5 min
Rollback...
SLO Watchdog
Auto-halt on burn
SLO Watchdog...
auto-rollback on error budget burn
auto-rollback on error budget burn
block and reopen
block and reopen
CI/CD and Environment Progression
CI/CD and Environment Progression
Application we own
Application we own
Decision point
Decision point
failure / alternate
failure / alternate
Client releases are staged over days; a protocol change ships behind a flag ahead of the client.
Client releases are staged over days; a protocol change ships behind a flag ahead of the client.
v 1.0 · owner Platform Architecture · date 2026-08
v 1.0 · owner Platform Architecture · date 2026-08Text is not SVG - cannot display

Gates that matter here

  • Crypto known-answer tests run on every build; a ratchet regression must never ship
  • Protocol conformance is checked against the previous two client versions
  • A performance budget on fanout p99 blocks a merge, not just a release

Client releases

  • Clients are staged over days and cannot be recalled once installed
  • A protocol change ships behind a server-side flag ahead of the client that uses it
  • Reproducible builds let third parties verify the shipped binary matches the source

Reversibility

  • SLO watchdog halts a rollout automatically on error-budget burn
  • Rollback is one command and completes in five minutes
  • Feature flags provide a kill switch that does not require a deployment
Solution Architecture v1.0 · Platform Architecture · 2026-0822-cicd-environments