{
  "schema": "vedokrok.public-item.v1",
  "release_id": "MHC-RPUB-20260920-75ad787a",
  "url": "/knowledge/write-the-rollback-trigger-before-deployment",
  "id": "MHC-D-RESEARCH-0345",
  "version": "0.1.0",
  "title": "Write the rollback trigger before deployment",
  "summary": "'We will know when to roll back' is not a rollback condition.",
  "kind": "checklist",
  "body": "Before deployment, define observable signals that mean the change should stop or reverse: error rate, failed reconciliation, latency, business invariant, unexpected side effect or another relevant threshold. Also define who can call the rollback. This converts a stressful judgment into a prepared decision and reduces the temptation to wait for certainty while impact grows.",
  "limits": [
    "Thresholds can be noisy or incomplete; allow human escalation when evidence is serious but the predefined metric misses it."
  ],
  "topics": [
    "union-safe-change-operations"
  ],
  "intents": [],
  "source_ids": [
    "RS-0B17D9040762A762"
  ],
  "evidence": [
    {
      "claim": "AWS recommends documenting rollback criteria and the rollback or fix-forward plan before deploying a change.",
      "source_id": "RS-0B17D9040762A762",
      "role": "supports",
      "note": "Rollback is not always safer than fixing forward, particularly for irreversible data migrations; the strategy must match the change.",
      "locator": "Implementation guidance"
    }
  ],
  "use_when": [
    "A change can degrade service and people may hesitate to roll back once effort has been invested."
  ],
  "avoid_when": [
    "Thresholds can be noisy or incomplete; allow human escalation when evidence is serious but the predefined metric misses it."
  ],
  "example": "Rollback if more than 0.5% of updated records fail the post-write invariant or if replication backlog exceeds the agreed threshold for ten minutes.",
  "check": "A responder can decide whether the trigger fired without inventing a new rule during the incident.",
  "checklist": [
    "The rollback condition is observable during the rollout.",
    "The signal is tied to the change's real failure modes.",
    "An owner has authority to stop or reverse the rollout.",
    "The condition distinguishes rollback from a tolerable transient effect.",
    "The recovery path is known before the trigger fires."
  ],
  "sources": [
    {
      "id": "RS-0B17D9040762A762",
      "title": "OPS06-BP01 Plan for unsuccessful changes",
      "url": "https://docs.aws.amazon.com/wellarchitected/latest/framework/ops_mit_deploy_risks_plan_for_unsucessful_changes.html"
    }
  ],
  "relations": [
    {
      "from": "MHC-D-RESEARCH-0345",
      "to": "MHC-D-RESEARCH-0357",
      "type": "use_before",
      "url": "/knowledge/make-the-rollout-stop-itself-on-a-known-bad-signal"
    }
  ],
  "collections": [
    {
      "id": "RC-4F77BDBBF2481574",
      "title": "Change live systems without turning one mistake into a large one",
      "url": "/collections/change-live-systems-without-turning-one-mistake-into-a-large-one"
    }
  ]
}