Production Release Gates

Use the production service readiness template to assemble target-specific evidence, owners, gaps, and next proof across the gates below. The template does not replace the exact release record or gate decision.

Gate progression

design -> sandbox -> shadow -> canary -> bounded execution or autonomy -> operations
any active gate -> pause or rollback
operations -> improve, expand, constrain, or retire

These review milestones apply to every selected decision mechanism. The table below shows the current closed machine representation for model and agent releases; its milestones are not values for solution-release.release_status.

paused, remediated, and retirement_planned are service-control states outside the model/agent release-status vocabulary. Preserve the last admitted manifest, record the operational decision, and issue a new digest-bound release or retirement record before resuming or changing deployment.

For a deterministic, optimization, or classical-ML-only system, use the target software delivery system to retain equivalent immutable design, build, configuration, data/policy, evaluation, approval, deployment, rollback, and retirement evidence. Do not create placeholder agent-system, behavior-bundle, evaluation-report, or solution-release artifacts. The gates and control requirements below do not become optional.

Gate 0 — Design

Controls: ARC-001, ARC-002, ARC-003, ARC-004, ARC-005, FDE-001, FDE-002, FDE-003, FDE-005, VAL-001, VAL-003, CTX-001, CTX-004, CTX-005, CTX-006, CTX-007, CTX-008, TOL-001, TOL-003, TOL-005, TOL-006, IAM-001, SEC-004, REL-004, STA-001, STA-003.

Gate 1 — Sandbox

Controls: ARC-002, DEL-002, CTX-002, CTX-005, CTX-008, TOL-001, TOL-002, TOL-003, TOL-004, TOL-005, TOL-006, IAM-001, IAM-002, IAM-003, SEC-001, SEC-002, SEC-003, SEC-005, SEC-006, SEC-007, REL-001, REL-002, REL-005, STA-002, EVA-002, EVA-007, CST-002.

Gate 2 — Shadow

Controls: ARC-005, FDE-003, FDE-005, VAL-001, ADP-001, DEL-001, DEL-002, CTX-001, CTX-002, CTX-003, CTX-005, CTX-006, CTX-007, CTX-008, CTX-009, TOL-002, TOL-004, TOL-005, IAM-002, IAM-003, SEC-004, SEC-005, REL-001, REL-002, REL-003, REL-004, REL-005, STA-001, EVA-001, EVA-002, EVA-003, EVA-005, EVA-006, EVA-007, HUM-001, HUM-002, HUM-003, OPS-001, OPS-005, OPS-007, CST-001, CST-002.

Gate 3 — Canary

Controls: FDE-003, VAL-002, ADP-001, ADP-002, DEL-001, DEL-002, CTX-002, CTX-006, CTX-007, CTX-008, CTX-009, SEC-002, SEC-006, SEC-007, REL-003, REL-005, EVA-001, EVA-003, EVA-006, HUM-001, HUM-003, OPS-002, OPS-004, OPS-006, OPS-007.

Gate 4 — Autonomy promotion

Use this gate whenever effect authority expands. For a non-agent route, read autonomy promotion as bounded-execution authority expansion. The machine-readable promotion unit below applies to model/agent releases; other target systems bind the same segment, effect class, evidence, approvals, and rollback conditions in their release record.

Promotion unit:

{
  "release_id": "workflow-agent-production",
  "version": "1.2.0",
  "target_segments": ["named-workflow-segment"],
  "autonomy_level": "execute_reversible",
  "release_digest": "sha256:...",
  "evaluation_report_uri": "reports/workflow-agent-1.2.0.json",
  "approvals": [
    { "role": "technical", "principal": "technical-owner", "bound_release_digest": "sha256:...", "approved_at": "ISO-8601" },
    { "role": "operational", "principal": "operational-owner", "bound_release_digest": "sha256:...", "approved_at": "ISO-8601" },
    { "role": "risk", "principal": "risk-owner", "bound_release_digest": "sha256:...", "approved_at": "ISO-8601" },
    { "role": "service", "principal": "receiving-service-owner", "bound_release_digest": "sha256:...", "approved_at": "ISO-8601" }
  ]
}

This is an excerpt, not a complete model/agent release artifact. When that route is selected, use the solution-release template and change management for the full release bundle and rollback evidence. Other routes retain the equivalent digest-bound record in the target software delivery system. Production approval is invalidated when any bound behavioral dependency changes.

Controls: ADP-002, DEL-001, CTX-004, IAM-002, IAM-003, SEC-005, REL-001, REL-003, REL-004, REL-005, STA-002, EVA-001, EVA-003, EVA-006.

Gate 5 — Improve, expand, or retire

Controls: ARC-005, FDE-004, VAL-002, VAL-003, ADP-001, ADP-002, CTX-006, CTX-007, CTX-008, CTX-009, TOL-006, SEC-001, SEC-002, SEC-004, SEC-006, SEC-007, STA-003, EVA-004, EVA-005, EVA-006, EVA-007, HUM-002, HUM-003, OPS-001, OPS-002, OPS-003, OPS-004, OPS-005, OPS-006, OPS-007, CST-001.

The control catalog is the source of truth for these sets. Repository validation compares every list above with each control's release_gates membership so documentation drift fails CI.

Automatic rollback triggers

• Any unauthorized, cross-tenant, duplicate, or prohibited effect
• Any evaluator-integrity failure
• Postcondition mismatch above zero-tolerance threshold
• Source freshness breach on a decision-bearing object
• Error-budget burn rate above declared threshold
• Trace completeness below forensic minimum
• Cost/run or parallel-worker circuit breaker
• Kill-switch, identity-revocation, or egress-control failure