Release record テンプレート

このページは、記入用テンプレートを誤ってサイトのメタデータとして解釈しないよう、原文をコードとして表示しています。

原本をダウンロード

---
schema: codex-delivery/release@1
document_id: "REL-<<required: environment-date-sequence>>"
change_id: "CHG-<<required: YYYYMMDD-slug>>"
risk_tier: "<<required: R0 | R1 | R2 | R3>>"
document_status: draft
decision_state: UNKNOWN
owner: "<<required: release owner>>"
evidence_as_of: UNKNOWN
commit_sha: "<<required: full exact source Git object ID>>"
supersedes: N/A — releases are append-only events
refs:
  - TASK-<<required>>
  - PR-<<required>>
---

# Release, rollout, rollback, and observation record

## Release identity

- Environment / region / tenant boundary: `<<required>>`
- Planned window / actual start: `<<required>>`
- Release owner / rollback owner / incident owner: `<<required>>`
- Decision authority: `<<required>>`
- Release state: `planned | ready | deploying | deployed | released | exposed | canary | observing | stable | paused | rollback_requested | rolling_back | rolled_back_verified | rollback_failed | incident`
- Current state: `<<required>>`
- Approved deploy manifest ID/digest: `<<required: reviewed source/build/artifact plus intended target/config/runtime authority>>`
- Latest runtime promotion manifest ID/digest: `<<required after deploy, or PENDING>>`
- Current approval binding: `<<required: applicable manifest + stage + target/cohort/blast radius + enabled traffic/webhook/queue/cron/tool-effect surfaces and capability + expiry>>`

## Immutable fingerprint

| Component | Exact identity | Evidence/hash | Last-known-good |
|---|---|---|---|
| Reviewed PR tuple / source tree | <<required>> | <<required>> | <<required>> |
| Merge/source commit and tree | <<required: full Git object ID and tree>> | <<required>> | <<required>> |
| Dependency lock / SBOM materials | <<required>> | <<required>> | <<required>> |
| Build workflow / builder identity | <<required>> | <<required>> | <<required>> |
| Build run + provenance subject/materials | <<required>> | <<required>> | <<required>> |
| Artifact/image/package digest | <<required: immutable digest>> | <<required>> | <<required>> |
| Schema/migration | <<required or N/A with reason>> | <<required>> | <<required>> |
| Runtime/config/feature flags | <<required>> | <<required>> | <<required>> |
| Model/prompt/retrieval/tool/policy | <<required or N/A with reason>> | <<required>> | <<required>> |
| IaC/deployment spec + runtime identity | <<required>> | <<required>> | <<required>> |
| IAM/policy boundary + DB role/RLS/grants | <<required or N/A with reason>> | <<required>> | <<required>> |
| Secret/credential IDs, versions, scopes | <<required: identifiers only, never values; or N/A with reason>> | <<required>> | <<required>> |
| External credential scope + network/egress policy | <<required or N/A with reason>> | <<required>> | <<required>> |
| Intended deployment target | <<required>> | <<required>> | <<required>> |
| Actual deployment/runtime/authority receipt | <<required after suspended deploy: target plus observed artifact/config/identity/IAM/DB-role/credential-scope/egress, or PENDING>> | <<required or PENDING>> | <<required>> |

Before stage 0, the approved deploy manifest proves `reviewed tuple → merge/source tree → trusted build/provenance → artifact digest` plus intended target, schema/config/flag/model/tool-policy, IaC, runtime identity/authority, credential scope, and network identities. After deploy, the runtime/authority receipt proves what actually runs; a runtime promotion manifest links that receipt to the approved deploy manifest. Release/exposure approval uses the promotion manifest. A bound runtime identity change needs a new manifest and gates. A stage/cohort/blast-radius/expiry-only change on an unchanged current promotion manifest needs a fresh stage gate snapshot and approval, not an invented new artifact manifest.

## Readiness gates

Each required gate needs positive evidence for the exact manifest applicable to that stage. `Required=yes` permits only `PASS/FAIL/UNKNOWN`; `N/A` is valid only with `Required=no`, a reason, approver, and time.

| Gate ID | Required in current stage? | Applies before | Criterion | Evidence ID/path/hash | Fresh until/maturity | Result | Owner |
|---|---:|---|---|---|---|---|---|
| GATE-AC | yes | deploy | all required ACs proven | <<required>> | <<required>> | PASS/FAIL/UNKNOWN | <<required>> |
| GATE-REVIEW | yes | deploy | exact tuple reviewed, no open veto | <<required>> | until binding tuple changes | PASS/FAIL/UNKNOWN | <<required>> |
| GATE-BUILD-BIND | yes | deploy | reviewed tuple through trusted build maps to artifact and intended target/config | <<required>> | until any bound identity changes | PASS/FAIL/UNKNOWN | <<required>> |
| GATE-SUPPLY-CHAIN | yes | deploy | producer/consumer/deployer privilege flow reviewed; provenance subject/materials and artifact handoff trusted | <<required>> | until workflow/ref/runner/permission/artifact flow changes | PASS/FAIL/UNKNOWN | <<required>> |
| GATE-AUTHORITY-INTENDED | <<required: yes for auth/tenant/external effect or runtime authority R2/R3; otherwise no with proof>> | deploy | intended IaC/runtime identity, IAM/policy, DB role/RLS/grants, credential IDs/versions/scopes, egress and trigger authority are least-privilege and reviewed | <<required>> | until intended authority changes | PASS/FAIL/UNKNOWN/N/A | <<required>> |
| GATE-EFFECT-FENCE | yes | suspended deploy | trusted upstream receipt proves candidate traffic/webhook/queue/cron/startup/tool-effect ingress fenced; only named migration exception | <<required>> | until any fence/trigger changes | PASS/FAIL/UNKNOWN | <<required>> |
| GATE-RUNTIME-BIND | <<required: no for pre-deploy; yes before enabling any candidate ingress/effect>> | ingress activation/release/exposure | actual runtime receipt matches approved deploy manifest; promotion manifest fixed | <<required>> | until runtime/target/config changes | PASS/FAIL/UNKNOWN/N/A | <<required>> |
| GATE-AUTHORITY-DRIFT | <<required: yes for auth/tenant/external effect or runtime authority R2/R3; otherwise no with proof>> | before ingress activation and continuous | actual runtime identity, IAM/policy, DB role/RLS/grants, credential versions/scopes, and egress match the approved authority manifest | <<required>> | until authority/credential/network drift | PASS/FAIL/UNKNOWN/N/A | <<required>> |
| GATE-ACTIVATION-BIND | <<required: no before first activation; yes before an enabled/expanded stage is considered active>> | after enable, before stage traffic/effects count | trusted activation receipt's actual cohort, ingress/effect capability, and remaining fences exactly match the approval | <<required>> | until cohort/effect/fence changes | PASS/FAIL/UNKNOWN/N/A | <<required>> |
| GATE-THREAT | <<required>> | <<required stage>> | threat decision is SHIP; no active residual High/Critical; all required Low/Medium acceptances current | <<required>> | <<required>> | PASS/FAIL/UNKNOWN/N/A | <<required>> |
| GATE-EVAL | <<required>> | <<required stage>> | frozen criteria met, critical failures zero | <<required>> | <<required>> | PASS/FAIL/UNKNOWN/N/A | <<required>> |
| GATE-MIGRATION | <<required>> | deploy | rehearsal, backup/restore, reconciliation ready | <<required>> | <<required>> | PASS/FAIL/UNKNOWN/N/A | <<required>> |
| GATE-ROLLBACK | yes | every stage | class-specific recovery tested | <<required>> | <<required>> | PASS/FAIL/UNKNOWN | <<required>> |
| GATE-OBS-READY | yes | deploy | monitor definitions, expected denominators/watermarks, alert/action owner and runbook ready | <<required>> | <<required>> | PASS/FAIL/UNKNOWN | <<required>> |
| GATE-TELEMETRY-LIVE | <<required: no for pre-deploy; yes before exposure/expansion>> | exposure/expansion | deploy marker, actual producer/schema/monitor versions, heartbeat and coverage live | <<required>> | <<required>> | PASS/FAIL/UNKNOWN/N/A | <<required>> |
| GATE-ACTION | <<required>> | before effect | consequential AI/external effects have approval/effect ledger and compensation | <<required>> | approval/effect verification expiry | PASS/FAIL/UNKNOWN/N/A | <<required>> |
| GATE-INCIDENT | yes | every stage | no open incident invalidates this manifest/stage/gate | <<required>> | checked immediately before stage start | PASS/FAIL/UNKNOWN | <<required>> |
| GATE-BUSINESS | <<required>> | release/exposure | support/comms/contract/billing readiness | <<required>> | <<required>> | PASS/FAIL/UNKNOWN/N/A | <<required>> |

Each gate row points to its own immutable evidence artifact. Test/eval gates use the `EVID run manifest`; runtime/authority use receipts; telemetry/incident/business use versioned snapshots or events. Do not transcribe a PASS from another document. `Required=yes + N/A` is invalid and yields `UNKNOWN`. A non-waivable failure or active critical veto yields `STOP`; a known remediation/approval wait yields `PAUSE`; any required non-PASS, stale manifest, open invalidating incident, or missing coverage yields `UNKNOWN`. Only all gates required for the current forward stage at `PASS`, with no higher-priority state, yields `SHIP`.

## Forward-stage decision event

- Active non-waivable veto: `yes/no — IDs`
- Known remediable blocker: `yes/no — IDs`
- Missing/stale/immature required evidence: `yes/no — IDs`
- Derived state: `STOP | PAUSE | UNKNOWN | SHIP`
- Actor / time / rationale: `<<required>>`
- Stage requested: `deploy | release | expose | expand | continue`
- Gate snapshot / applicable deploy or runtime promotion manifest digest: `<<required>>`
- Approval event ID/hash: `<<required>>`
- Approval binding: `<<required: exact manifest + stage + target/cohort/blast radius + enabled traffic/webhook/queue/cron/tool-effect surfaces and capability + expiry>>`

`Derived state` is computed output, not an editable promotion. Record this event append-only; do not rewrite it after the outcome is known. Any binding component change needs a fresh event.

## Emergency recovery event

Recovery does not wait for the failed forward gate to become `SHIP`; a `STOP`, incident, or guardrail breach may be its trigger. It uses separately pre-authorized, least-privilege recovery powers and verified post-conditions.

- Trigger / incident / stop signal: `<<required>>`
- Action requested: `contain | fence | rollback | quarantine | compensate | forward-repair`
- Affected manifest/stage/target/in-flight scope: `<<required or UNKNOWN; UNKNOWN uses the safest bounded containment>>`
- Recovery authority / runbook version / expiry: `<<required>>`
- Non-waivable recovery constraints: `<<required: e.g. do not destroy evidence, do not cross tenant, do not double-pay>>`
- Expected post-condition and verification due: `<<required>>`
- Event state: `AUTHORIZED | EXECUTING | VERIFIED | FAILED | UNKNOWN`
- Actor / time / evidence: `<<required>>`

An emergency event authorizes only the named recovery action and scope. It does not authorize a new forward release. After recovery, forward movement needs current manifests, rerun gates, and a fresh forward-stage approval.

## Migration and data contract

- Migration sequence: `<<required: expand → migrate → contract, forward-only, or N/A with reason>>`
- Compatibility window: `<<required>>`
- Backup ID / restore rehearsal / RPO / RTO: `<<required or N/A with reason>>`
- Backfill batches/checkpoints: `<<required or N/A with reason>>`
- Reconciliation query and expected totals: `<<required or N/A with reason>>`
- Irreversible point and explicit approval: `<<required or N/A with reason>>`
- Forward repair/compensating action: `<<required>>`

### Migration rehearsal evidence

| Contract | Production-shaped input/profile | Boundary/concurrency case | Pre/post invariant/checksum | Lock/replica/disk/time | Partial stop/restart | Old/new code compatibility | Restore/forward repair evidence | Result |
|---|---|---|---|---|---|---|---|---|
| schema/migration ID+hash | <<required: counts, skew, largest tenant/object, synthetic/redacted provenance>> | <<required>> | <<required>> | <<required>> | <<required or N/A with reason>> | <<required>> | <<required>> | PASS/FAIL/UNKNOWN |

An empty-table smoke test alone cannot authorize a migration against a nonempty or concurrently written production system. Backfill work must have checkpoint/resume and reconciliation. If no backfill is required, prove why and still test schema locks, concurrent writes, old/new app coexistence, resource headroom, and the forward-repair path applicable to this change.

## Rollout plan

### Pre-deploy effect fence

Customer exposure 0 is not effect exposure 0. Before candidate code starts, obtain a receipt from a trusted upstream control plane that fences every applicable traffic route, webhook delivery, queue consumer, scheduler/cron, startup hook, and tool/external-effect credential. A named migration may run only under its separately approved migration identity and scope.

- Fence manifest and receipt ID/hash: `<<required>>`
- Fenced ingress/effect surfaces / exceptions: `<<required: traffic, webhook, queue, cron, startup, tool authority; named migration only if applicable>>`
- Trusted controller / actor / time / expiry: `<<required>>`
- Suspended deployment mode: `<<required: replicas 0, trigger disabled, no effect credential, or equivalent>>`
- Verification before start: `<<required>>`

Deploy the candidate in suspended mode. Verify runtime and authority receipts against the approved deploy manifest. Only then may a fresh, scope-bound approval ask a trusted control plane to enable each ingress/consumer/scheduler/tool authority. Every enable or expansion produces an immutable activation receipt containing the actual cohort, enabled capabilities, controller/policy version, and residual fences. Compare it to the approval before declaring the stage active or counting traffic/effects. Missing/mismatched scope is `UNKNOWN` or `STOP`, and never “fails open.”

| Stage | Customer/traffic scope + webhook/queue/cron/tool authority | Start condition | Success signal | Stop trigger | Max duration | Authority/owner |
|---|---|---|---|---|---|---|
| 0 | customer exposure 0; every candidate effect ingress fenced; named migration only | deploy gates + trusted fence receipt | suspended runtime/authority receipt matches | fence/receipt mismatch or autonomous effect | <<required>> | <<required>> |
| 1 | <<required: synthetic/internal/small cohort + explicitly enabled ingress/effect surfaces>> | runtime/authority gates + fresh activation approval + matching trusted activation receipt | <<required>> | <<required>> | <<required>> | <<required>> |
| 2 | <<required>> | fresh expansion approval + matching trusted activation receipt | <<required>> | <<required>> | <<required>> | <<required>> |

Small traffic may not support statistical comparison. Use deterministic invariants, synthetic probes, full-case review, and explicit x/n without inventing precision.

## Monitors and actionability

| Signal/query | Baseline/window | Success/guardrail | Alert/stop trigger | Delay/maturity | Action/runbook | Owner |
|---|---|---|---|---|---|---|
| Core journey | <<required>> | <<required>> | <<required>> | <<required>> | <<required>> | <<required>> |
| Error/latency | <<required>> | <<required>> | <<required>> | <<required>> | <<required>> | <<required>> |
| Auth/tenant/billing/data | <<required>> | <<required>> | <<required>> | <<required>> | <<required>> | <<required>> |
| AI quality/cost/authority | <<required or N/A>> | <<required>> | <<required>> | <<required>> | <<required>> | <<required>> |
| Support/complaint | <<required>> | <<required>> | <<required>> | <<required>> | <<required>> | <<required>> |

Logs and artifacts must exclude credentials, payment data, and unnecessary personal/customer data.

### Telemetry coverage contract

| Stage/signal | Expected events or eligible denominator | Observed events | Event-time watermark / max lag | Schema + producer + monitor version | Collection heartbeat | Coverage/missing | State |
|---|---:|---:|---|---|---|---|---|
| <<required>> | <<required>> | <<required>> | <<required>> | <<required>> | <<required>> | <<required>> | PASS/FAIL/UNKNOWN |

Zero observed failures is not evidence when expected events, watermark, heartbeat, or coverage is missing/stale. Such a stage is `UNKNOWN` and may not expand.

For auth, tenant, or consequential external-effect changes, runtime authority drift is also a guardrail. Missing receipt/mismatch is `UNKNOWN`; an observed privilege broadening, cross-tenant path, unexpected credential scope, or unapproved egress/write target is a non-waivable `STOP` and incident trigger.

## Rollback and compensation by class

“Rollback available” is not a sufficient answer. Fill every applicable class.

- Overall recovery mode: `reversible | forward-only | externally irreversible | mixed`
- `rollbackable`: `true | false — class IDs and reason`
- Pre-rollback ingress fence: `<<required: stop new requests/events/writes and authority>>`
- In-flight work: `<<required: requests/transactions/queues/webhooks/jobs drain, cancel, quarantine, or replay rule>>`
- Partial rollback detection/recovery: `<<required>>`
- Old code × new schema/data/config/runtime-authority compatibility: `<<required: matrix covering current IaC, identity/IAM, DB role/RLS/grants, rotated credential ID/version/scope, egress; plus evidence>>`
- Maximum event/queue/cache lag and re-verification due: `<<required>>`

`GATE-ROLLBACK=yes` always means the applicable recovery mode was positively tested; it does not falsely claim reversal of a forward-only or externally irreversible effect. Those classes require containment, forward repair/compensation, bounded exposure, and explicit authority.

### 1. Feature flag / configuration

- Trigger and authority: `<<required>>`
- Exact action/version: `<<required>>`
- Last rehearsal / duration: `<<required>>`
- Post-condition query: `<<required>>`

### 2. Code / artifact

- Last-known-good digest: `<<required>>`
- Exact deployment command/runbook: `<<required>>`
- Last rehearsal / duration: `<<required>>`
- Post-condition query: `<<required>>`

### 3. Model / prompt / retrieval / tool / policy

- Route/version to restore: `<<required or N/A with reason>>`
- Cache/index/session implications: `<<required>>`
- Exact action / last rehearsal: `<<required>>`
- Post-condition eval/query: `<<required>>`
- Consequential action/effect ledger ID/hash: `<<required for write/send/pay/delete/permission/publication, otherwise N/A with proof>>`
- Proposal/approval/precondition/idempotency/effect verification current: `<<required>>`

### 4. Data / schema

- Code backward compatibility: `<<required or N/A>>`
- Restore/forward-fix/compensation: `<<required>>`
- Data created after release: `<<required: preserve/reconcile/delete with authority>>`
- Reconciliation and verification: `<<required>>`
- Expected recovery time/data loss: `<<required>>`

### 5. External effects

- Effects that cannot be undone: `<<required: email/payment/publication/deletion/third-party write or N/A>>`
- Idempotency/audit IDs: `<<required>>`
- Cancellation/refund/correction/notification: `<<required>>`
- Approval and customer/legal owner: `<<required>>`
- Verified final state: `<<required>>`

### Rollback failure

- Escalation/incident trigger: `<<required>>`
- Containment when rollback fails: `<<required>>`
- Evidence preservation: `<<required>>`
- Quarantined/replayable in-flight items and final disposition: `<<required>>`

## Execution events

Append one row per event. Separate deploy, release, exposure, rollback, and verification.

| Time | Event | Actor | Applicable manifest + stage + target/cohort + enabled ingress/effect capability | Approval event/scope/expiry | Result | Evidence/runtime/authority/activation receipt | Next state |
|---|---|---|---|---|---|---|---|
| <<required>> | deploy_started | <<required>> | <<required>> | <<required>> | <<required>> | <<required>> | deploying |

## Post-release verification

- First exposure at / cohort / denominator: `<<required or exposure 0>>`
- Immediate observation due/completed: `<<required>>`
- Value maturity due/completed: `<<required or N/A with reason>>`
- Incident maturity due/completed: `<<required or N/A with reason>>`
- Same-definition baseline/candidate cutoff: `<<required>>`

| Observation | x/n or value | Unknown/missing | Expected/guardrail | Evidence | Result |
|---|---|---|---|---|---|
| Core behavior | <<required>> | <<required>> | <<required>> | <<required>> | PASS/FAIL/UNKNOWN |
| Security/billing/data invariants | <<required>> | <<required>> | <<required>> | <<required>> | PASS/FAIL/UNKNOWN |
| Customer value | <<required>> | <<required>> | <<required>> | <<required>> | PASS/FAIL/UNKNOWN |
| Cost/support/rework | <<required>> | <<required>> | <<required>> | <<required>> | PASS/FAIL/UNKNOWN |

## Final observation decision

- Decision: `continue | hold | expand | change | rollback | incident | unknown`
- Derived state: `STOP | PAUSE | UNKNOWN | SHIP`
- Actor / time / evidence: `<<required>>`
- Residual risk / limitation: `<<required>>`
- Follow-up task/incident IDs: `<<required or N/A>>`
- Reopen trigger: `<<required>>`