Define the service boundary and ship target

Start with a one-page release brief. Name the current behavior, proposed behavior, affected cohort, operator, and explicit non-goals. The primary decision signal is signature rejects, duplicate rate, receive-to-ack latency, queue age, processing latency, retries, and dead-letter count. A release cannot be called successful merely because requests return 200. Specify the observation window, minimum useful traffic, and the exact threshold that means hold, promote, or stop. State what happens when telemetry is missing: missing evidence must produce hold, never promotion.

Write an invariant beside each boundary. Inputs must be authenticated and schema-valid. Decisions must be deterministic where user consistency matters. Outputs must identify the code or configuration revision that produced them. Side effects must be idempotent or reversible. The operating team must be able to execute this rollback without editing application code: pause workers while continuing durable inbox writes, disable the new event handler by type, and replay quarantined events after repair. These invariants become acceptance tests later.

Create release-brief.md in your lab notes with a hypothesis, baseline, target, guardrails, and owner. Use a table in the artifact if useful, but make every threshold executable. “Latency should be reasonable” cannot drive automation; “p95 under 1,800 ms for two consecutive 10-minute windows” can. Include the expensive failure modes—replayed deliveries, duplicate event IDs, out-of-order completion, malformed JSON, queue outages, and a provider retry storm—because an apparently positive average can hide cohort harm or operational instability.

The minimum evidence packet contains a configuration revision, test output, dashboard link, rollout timestamps, and rollback confirmation. For AI behavior, add a versioned golden dataset and grader version. A model score without the prompt, retriever, dataset, and grader revisions is not reproducible. For every metric, identify numerator, denominator, excluded traffic, and aggregation window.

Assign one release commander. That person may promote only after the named gates pass and may rollback immediately when a hard guardrail breaches. Separate reversible exposure changes from irreversible data changes. If a migration cannot be reversed safely, move it outside this release or use an expand-and-contract sequence.

Run a paper drill: the primary metric improves, but the guardrail degrades. The correct decision is hold or rollback, not “wait for the average to recover.” Then remove the primary dashboard for five minutes. The decision must again be hold. Record those decisions in the brief so an operator under pressure does not improvise policy.

Your deliverable is a signed release contract: one system boundary, one primary outcome, at least two guardrails, a minimum observation requirement, an owner, and a command-level rollback. It is complete only when a second person can distinguish promote, hold, and rollback from the written thresholds alone.