Steward the Release: CI/CD, Change and Operating What You Build

All courses / AI Developer / Module 2 / Chapter 11

Learning objectives

After the lesson the participant can:

• Classify the controls on a release path by whether the change can alter them
• Explain the four properties of a gate the change cannot alter
• Review how each of the delivery metrics can be distorted by AI-assisted change
• Design a rehearsed revert with authority, access and time outside the pipeline

Key concepts

A gate the change cannot alter

A gate with four properties: its definition is out of reach of the change, it executes out of band, its oracle is independent of the generator, and it is shown to work by dated seeded faults. A pipeline file in the same repository does not qualify.

Progressive delivery

Exposing a change to a growing share of users or systems while measuring its effect, with the ability to stop and revert at each step: feature flags, canaries and rings, and rollback. A flag is a production change in its own right.

Approve classes, not items

A class that is low in blast radius, reversible and covered by a strong gate can be approved once, with an expiry. Human judgement is reserved for what is irreversible or security-critical, and a model may score a change but not approve it.

Change volume per owner is a budget

The number and size of changes a team can understand and run is finite. You build it, you run it survives rising volume only if the owner is in the ownership record before the change and the generator is never the sole responder to its own failure.

The Revert test in practice

Authority: the owner or deputy may use the stop without asking. Access: the stop works when the pipeline does not. Time: the rehearsed time to restore is shorter than the time in which harm accrues. A revert not exercised in the last 90 days is marked not tested.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. What cannot be rolled back in your own services, and how is that marked before the change is approved?
2. Deployment frequency rises when a team ships many small generated changes, whether or not they matter. Which of your reported metrics would move without anything improving?
3. Nordvik Region has a contract and a small platform team; Hansa Mutual has a platform, a policy repository and an agent mandate. How does each put the same control in place?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. Which control does Table 11.1 class as one the change can alter?

   1. Required status checks and branch rules set at organisation level
   2. The pipeline definition file in the same repository
   3. Policy as code in a separate repository with its own owners
   4. Synthetic journeys owned by the quality function
   Show the answer

   B. The pipeline definition file in the same repository
   A change can edit the file that defines its own checks when the pipeline definition sits in the same repository. The other three lie outside the change's write permissions or are owned by someone else.

2. How does the chapter say a revert that has not been exercised in the last 90 days should be recorded?

   1. As passed, provided that the pipeline rollback step exists
   2. As failed, which blocks all further releases of the service
   3. As waived, with the approval of the engineering manager
   4. As not tested, a legitimate entry that is not the same as passed
   Show the answer

   D. As not tested, a legitimate entry that is not the same as passed
   Rehearsal is the evidence for the Revert test. A revert not exercised within the period the book recommends is marked not tested, which is honest and distinct from passed.

3. Why does the class approval in CHG-HM-2030-0415 expire on the delegation profile's review date?

   1. So that the class approval does not outlive the evidence behind it
   2. So that the supplier contract can be renegotiated at the same time
   3. So that each update receives an individual approval after that date
   4. So that the agent's credentials are rotated once a year
   Show the answer

   A. So that the class approval does not outlive the evidence behind it
   The class approval for patch-level dependency updates is valid until 2031-03-30, the profile's review date. The chapter gives the reason directly: the class should not outlive its evidence.