Rollout Checklist

Fleet rollouts fail at the weakest checkpoint. A rollout checklist from sixteen days inside a production fleet: one entry per checkpoint, one threshold per entry, one owner per threshold.

The checklist is short on purpose. Long checklists are how gaps hide.

The entries

Every checkpoint in the fleet gets four questions, answered before rollout, in writing. What is it authorized to do. What did verification observe it actually doing. What is the gap between those two. Who owns the threshold that watches the gap.

The four questions compress the entire fleet-security posture. Authorization is policy. Observation is verification. The gap is the honest part, and it is never zero. The owner is the difference between a threshold and a decoration.

Why one owner per threshold

Shared ownership is how thresholds die. When everyone owns a threshold, the alert fires into a channel, the channel debates, and the moment passes. An agent loop completes in seconds. The threshold's owner has to be a person, or a system with a person's authority, empowered to interrupt without convening a meeting.

The sixteen days taught this one directly. The gap that mattered had a threshold, and the threshold had a channel, and the channel had eleven members. It had no owner. The behavior crossed the threshold twice before anyone closed the loop.

The rollout itself

New checkpoints enter the fleet behind the thresholds, not ahead of them. The checklist runs before the checkpoint ships, not after the first incident. Anything that cannot answer the four questions does not join the fleet, because anything that cannot answer them becomes the floor the whole fleet stands on.

The checklist is short on purpose. If an entry takes a paragraph to answer, the answer is not ready, and neither is the rollout.