checking-release-readiness

Checking Release Readiness

Overview

Release readiness is a careful, audited decision you write down. It is not a mood. It ties seven things together before a candidate becomes the accepted version: the baseline (the version everyone agreed is correct), the evidence status, the leftover risk, the rollback plan, the monitoring plan, the handoff, and the release decision itself.

Decision contract

• Claim checked: the candidate has evidence, visible custody and coupling, rollback, monitoring, and residual risk that is accepted or made a blocker; for trust-bearing work the declared coupling profile meets the consequence-specific minimum.
• Artifact observed: verification.md/trace.md statuses and CI status -> the decision recorded in ship.md.
• Decision affected: block -- the ship.md ship/block/defer/ship-with-risk release decision.
• Failure class: unevidenced-or-unsafe-release (a gap or missing rollback treated as shippable).
• Next action: block the release; record the gap, its owner, and a recheck trigger.

When to Use

• A Standard change record is getting close to merge or release.
• A pull request changes how users see the system, its security, its dependencies, what an agent may do, or how it runs in production.
• Evidence gaps have to be accepted or made into blockers.
• A quick candidate is being promoted into a baseline, a public claim, a release, or any other state that carries trust.
• A handoff, a support handoff, a lesson from real operation (OPEX), or a cautious decision stance needs to be stated plainly.

When Not to Use

• The work is a local Quick change record with no effect on a release.
• An incident is still being contained or rolled back.

Inputs

• ship.md, verification.md, trace.md, the pull request status, the CI status, the rollback plan, the monitoring plan, and the open risks.
• docs/02-operating-system/change-control-packets.md.

Process

1. Confirm the baseline and the artifacts the change affects.
2. Confirm the question to decide has been answered by evidence, not by confidence. Review who generated, selected, transformed, captured, retained, and presented the load-bearing evidence, then inspect the actor, context, mechanism, authority, and resource axes rather than treating reproducibility or a second role name as automatic independence.
3. Review each evidence status and each open gap. Check for drift building up: does the shipped change still serve the goal anchor, with the non-goals (the things ruled out of scope) still uncrossed? See staying-on-mission.
4. Confirm a rollback or restore path.
5. Confirm the monitoring and the checks you will run after release.
6. State why the decision is cautious enough given what is still uncertain, and confirm the change still delivers the value it was for and that the value outweighs the residual risk — a candidate that ships clean but no longer delivers its value should defer, not ship. For a high-stakes release, state the argument, not just the pile of evidence -- the top claim ("this is safe to ship") and why the evidence discharges it -- then run a defeater hunt: name what would have to be true for the decision to be wrong, and whether the evidence rules it out (this is the release-level form of the questioning-attitude falsification step).
7. Record one decision: ship, block, defer, or ship with named leftover risk. Name the verdict owner and its authority-axis coupling to the actor; for trust-bearing or irreversible work, any coupled authority must be explicitly accepted or block. See docs/02-operating-system/actor-evidence-independence.md. This verdict records what the admitted evidence supports — it is a separate state from whether the change may be applied now.
8. For a change that takes a real-world action, record an apply-clearance call separate from the verdict: may it be applied now? Check that required approvals are present, the release/maintenance (freeze) window is open, external state is unchanged since verification (the verdict is not stale), deployment policy is satisfied, and rollback is ready at apply-time. Clearance is cleared to apply / hold / lapsed, owned by the operator/policy layer, and re-checked at apply-time — a ship verdict is not a standing authorization. Mark not applicable when the change makes no real-world action.
9. Name the owner, the trigger to abort, whether a handoff is needed, the trigger for an operating lesson (OPEX), and the trigger to record a new baseline.