Blue/green or canary
New code takes traffic gradually and can be pulled back instantly, so a bad release affects a slice, not everyone.
← The K-Framework
★ Amplification · 10× ThroughputLayer 11 of 16Visual guide
PILLAR B · LAYER 05 · B.05Automated Rollback.
Safe deploys, reversible changes.
What a CEO/CTO needs to know
A deploy without a tested rollback is a bet. Ask when the team last actually ran the rollback, not when they last wrote it down.
A deploy is watched against health. Healthy, it stays; unhealthy, it rolls back automatically.
[WHAT IT IS]
The engineer’s view, in plain language.
Deploys without rollback are bets. Every release is paired with a rollback path someone has actually tested. Feature flags for what you want to half-ship. Schema migrations that run both directions. The team recovers from a bad deploy in minutes.
[HOW WE BUILD IT]
What “done right” looks like.
Reversible migrations
Schema changes are validated in both directions in CI, so a rollback does not strand the database in a state nothing can read.
Rehearsed, not documented
The rollback procedure is run on staging the same week as launch, so it is muscle memory rather than a wiki page nobody trusts.
[MATURITY LADDER]
Where does your build sit?
Four rungs from absent to production-grade. Level 3 is the target, and the only one that survives a real production incident.
L0
Absent
Deploys are all-or-nothing. Rollback is manual and untested. Migrations are forward-only.
L1
Ad-hoc
Rollback is theoretically possible but has never been rehearsed.
L2
Managed
Canary or blue/green exists, but migrations are not reversible or rehearsed.
L3Target
Production-grade
Gradual rollout, reversible migrations validated in CI, and a rollback rehearsed on staging at launch.
[VALIDATE IT YOURSELF]
How to check it’s really there.
You do not need to read the code. Ask these questions and demand these artifacts. Vague answers are the finding.
★ Ask your team
- ?When did we last actually execute a rollback, not just document one?
- ?Can our schema migrations run backwards?
- ?How long from 'this deploy is bad' to 'it is reverted'?
★ Demand to see
- Canary or blue/green deploy infrastructure with feature flags
- Schema migrations validated both directions in CI
- A rollback procedure rehearsed on staging near launch
● WHAT L0 LOOKS LIKE
The failure mode, in production.
A bad deploy at 2 a.m. The rollback is a wiki page nobody has run in a year. The migration is forward-only. The team is hand-editing the production database. Customer trust takes the hit.
Want this layer audited in your stack?
We run the K-Framework against your AI build and hand you the gap list, ranked by what it will cost you in production.