Build once, sign, promote
The exact artifact that passed Verify is what runs in production — same digest, signed, with an SBOM and provenance. Nothing is rebuilt along the way.
← The ADLC loop
Release: ship small, watch closely, roll back fast.
The merged chess build is packaged once, signed, and promoted unchanged through staging into production behind a feature flag. A deploy agent ramps the canary while watching the SLOs — and pulls it back on its own when something breaks.
Artifact · built once Building
chess-server:1.4.0
Promotion path · same digest everywhere
realtime-chess-v1
flag off · dark launch
Production traffic 100% on 1.3.2
1.3.2 stable
1.4.0
SLOs · last 30 minutes
Error rate—
SLO 1%
Move latency p95—
SLO 150 ms
deploy-agent Idle
Release guardrails
Flags separate deploy from release
Code reaches production dark. Turning the feature on is a separate, instant, reversible decision — not another deploy.
Canaries with automatic rollback
Traffic ramps 1% → 5% → 25%. When eu-west's error rate burned the error budget 14× too fast, the deploy agent rolled back in 38 seconds — before most players noticed.
Humans informed, not on the critical path
On-call got a page with the full timeline and root cause. The fix went through the same verify and review loop as any other change.