Purpose and boundary
Deployment executes the release decision and retains its evidence.
Deployment puts an exact verified artefact and approved configuration into an environment. Release exposes it to intended users or traffic. Flag changes are risk-bearing production configuration.
It does not decide what to build. It does not replace Testing. It adds production evidence for an operable candidate, not a merged branch.
What starts here, what continues, and what feeds back
Before production, agree artefact identity, exposure, authority, signals, stops, observation, and recovery. Continue until the authority advances, pauses, recovers, or withdraws.
Testing continues against deployed configuration. Operations, product, and support watch health, value, and harm. Findings feed Design, Maintenance, and Requirements.
What happens here
Verify the exact candidate
Record one immutable release manifest: all subject/platform digests, source revision, build identifier, environment, configuration, IaC and migration revisions, flag state, approvers, and time.
OWASP CI/CD guidance informs pipeline protection. The Release verifier fails closed against Implementation’s exact provenance policy—signed envelope against its configured trust root and policy version; allowed predicateType; exact subject digest; trusted signer-builder pair; expected build type and parameters; and resolved immutable source and configuration dependencies. Hold a missing or failed condition. Before production release or exposure, the exact release manifest and subject identity, configured trust root and envelope authenticity, allowed predicateType, trusted builder, and controller/runtime readback are non-waivable. An exception permits only named non-release diagnostic work in an isolated environment; record authority, scope, reason, controls, expiry, and later verification. It never permits ordinary exposure.
Before exposure, NIST SSDF supports comparing a retained controller/runtime readback of every deployed digest and configuration, IaC, and migration revision with the manifest; hold a mismatch. Retain the manifest, configured trust root and policy version, protected release files, provenance, verification, readback, and decision evidence in protected, access-controlled, tamper-evident storage for policy retention. It must let authorised responders recheck the deployed release. Apply Implementation’s verified reproducibility rule; do not redefine it here.
Prepare the whole change and recovery
Prepare permissions, certificates, queues, workers, dashboards, alerts, runbooks, and secrets. Treat schema/data changes as release work. Add fields before writing, support old/new readers, backfill in batches, and remove old behaviour after transition.
Before exposure, name a tested rollback compatible with current data and configuration, and a tested roll-forward repair when rollback is unsafe. Each needs commands, owner, timing, communication, and user-effect checks. A flag does not reverse a destructive migration.
Expose deliberately
Use Google canary guidance only when segmentation fits. A canary is a time-bound treatment with a concurrent control, not a delay after deployment. Keep cohorts sticky and closed; split evidence by arm and version; avoid overlap. Without a valid control, use a documented reviewed path, not a canary.
The product record owns the normative gate. For guest checkout, the PRD decision gate and registered analysis plan are the only source for wave identity, allocation, closure, measurements, thresholds, authority, and re-exposure. Release and operations execute it without restating or weakening it.
Separate readiness, safety-stop, and statistical promotion gates. Readiness proves approvals, compatibility, integrity, observability, recovery, and a stop path. Safety stops pause exposure immediately; they do not wait for a sample, maturity, scheduled look, or decision-authority availability. Statistical promotion uses the registered population, estimand, denominator, control, maturity, confidence or precision method, and permitted looks—not aggregate attempts or unregistered inspection. Bake across representative traffic, load, delayed work, and time zones. A green job is not healthy-user evidence.
Treat flag creation, targeting, enablement, and disablement as controlled, audited production changes. Restrict who can make them, record the authorised rule and approver, verify the stop path, and retain each change. A readiness failure is a no-go. A deterministic safety failure pauses exposure immediately and starts the tested recovery route. An incomplete or failed statistical promotion look does not advance by itself; follow the product record’s registered hold, continued-holdback, or stop action, not automatic rollback.
For an emergency, state who may reduce which gates, minimum checks, reason, review point, and deferred checks. It does not remove accountability, safe pause and recovery, protected release-file verification, or later verification. Record the decision and complete deferred checks before ordinary exposure resumes.
Who owns what
The release coordinator keeps the plan, evidence, and communication coherent. The decision authority accepts residual risk and decides whether to expose, advance, stop, re-expose, or withdraw. A named operational pause authority may halt new exposure under a deterministic stop, but cannot re-enable or advance it. Engineering owns compatibility and repair; operations owns signals, alert response, and access; product owns audience and outcomes; security reviews delivery-path, vulnerability, and fraud risk; support reports new failure patterns. Each decision has one authority.
Start with and leave with
Start with a reviewed candidate, Testing evidence, recovery plan, verified identity and provenance, compatible migrations, observability, on-call cover, authority, audience, gate, observation period, and stop path.
Leave the manifest, protected verification, provenance, deployment readback, flag changes, gate evidence, incidents, recovery, and decision. It supports Maintenance.
Ready to continue, pause, or revisit when
- The manifest, protected verification, provenance, and deployment readback are recorded; authorised people can recheck the deployed release.
- Audience, applicable gate, observation, stop path, coordinator, decision authority, and operational pause authority are explicit.
- Monitoring, alerts, support guidance, and recovery work in production.
- The current wave passed its full representative observation, or the product record documents its registered hold, continued-holdback, stop, pause, or recovery decision.
Common mistakes
A successful pipeline is not a safe release. Do not use latest, accept unverifiable provenance, assume a flag reverses data, compare unlike populations, promote from weak evidence, or run a destructive migration without proven recovery.
Illustrative guest checkout
This fictional example uses invented names, figures, dates, and thresholds.
The guest-checkout team deploys version 2026.09.15.3 through the immutable manifest and Release verifier. Its retained controller/runtime readback matches every deployed digest and configuration, IaC, and migration revision. The additive migration makes the account ID optional and adds a guest-contact reference; signed-in checkout and existing reads stay compatible. The flag stays off. Before exposure, the team verifies order creation, confirmation email, lookup, dashboards, alerts, and the disable path.
The guest-checkout PRD decision gate is normative. When @checkout-sponsor authorises a registered wave, the release service uses its wave ID and allocation contract, then persists assignment, cohort membership, and verification evidence. It chooses neither a local rollout value nor a substitute cohort. Known returning-account customers stay on the unchanged path, outside the experiment. No other material change runs during comparison.
The record names @checkout-sponsor as decision authority and @release-manager as operational pause authority. A deterministic stop lets @release-manager disable new enrolment or the guest offer, preserve evidence, and start communications while already-started orders reach a safe, reconciled outcome; it never forces an account or cancels a valid order. Re-exposure follows only the recorded PRD decision gate. The coordinator records the manifest, flag, assignment, gate, incident, recovery, and decision evidence. A readiness failure is a no-go. A deterministic stop starts the tested rollback or roll-forward route. A statistical promotion look that does not pass does not advance alone; it follows the recorded hold, continued-holdback, or stop action.
Continue with
Read Testing before exposure and Maintenance afterwards. Return to Design or Implementation when findings need a decision or change.