← The Factory

Release, Deployment & Rollback

Can deploy is not may deploy: staged rollout, health gates, and automatic rollback.

low confidence

Confidence: low. Evidence: surprisingly thin as a distinct area. Last substantive change: 2026-07.

This subsystem owns the step from an accepted change to a running one: how software reaches production, and how it comes back if it misbehaves.

The conclusion

Being able to deploy is not permission to deploy. Promotion should be a separate, deterministic capability with signed evidence, staged rollout, health gates, automatic rollback, and an accountable release policy. Deploy, break, fix, and rollback all belong inside the factory boundary, not just up to the merge.

How the thinking got here

For a long time the merged pull request was treated as the finish line. Production systems made it clear that the finish line is further out: a factory that can build but cannot safely release, observe, and roll back is only half a factory. Deployment turns out to be underexamined relative to how much it matters.

Credible alternatives, and when each is right

Approach Right when
Human release manager high-stakes or irreversible releases
GitOps policy declarative, auditable delivery
Canary or blue-green catching regressions before full exposure
Feature flags and progressive delivery decoupling deploy from release
Immutable releases reproducibility and clean rollback
Autonomous low-risk deploy only reversible changes with strong health gates

Where it fails and what we still don't know

Failures include rollbacks that do not actually restore state, schema and database changes that cannot be reversed, and irreversible external effects. Case studies mention deployment, but comparative evidence on autonomous release is limited. Open questions include rollback correctness, database and schema changes, mobile and edge releases, and autonomous change freezes.

What would change our mind

A documented autonomous release path with tested rollback across schema and external effects would move deployment from a human-owned step to a governed factory capability.

Evidence and further reading

No directly supporting research captured yet; the current position is provisional.