Meridian Field Services: instructional example, not project evidence
Each stage proves a claim before the next runs. One immutable artifact, promoted by reference; a rebuild anywhere breaks the provenance chain and fails the check.
| Stage | Proves | Gates run here |
|---|---|---|
| 1 · build | The four services compile and package: one immutable versioned image set per commit | unit |
| 2 · verify | Logic and contracts hold against production-shaped dependencies | integration · contract |
| 3 · stage-deploy | Production-shaped runtime works: images promoted by reference | smoke + liveness (DV-1, DV-2[1]) · e2e critical · a11y |
| 4 · prod-deploy | Real traffic holds: rolling deploy behind the health gates (§3) | health gates |
Provenance: image digest pinned commit-to-production. Credentials: the platform's workload identity issues short-lived stage-scoped tokens (machine identity[2]); the build runner cannot deploy. The pipeline definition lives as code in the repository, cited.
Gates SELECT from the strategy's ladder: every row is a citation; "informational" never means ignored.
| Gate (cites the ladder) | Stage | Status | Owner | Note |
|---|---|---|---|---|
| unit[3] | 1 | BLOCKING | Committing engineer | Fix before merge |
| contract[3] | 2 | BLOCKING | API owner | Instantiates the promises (endpoint specs[4]) |
| integration[3] | 2 | BLOCKING | Feature engineer | n/a |
| e2e critical paths[3] | 3 | BLOCKING | QA owner | The pilot-critical set only (risk prioritization[3]) |
| performance nightly[5] | off-path | informational | E. Sandoval | Promotion rule: two consecutive nightly regressions past 10% on any PS series turns it blocking |
| accessibility audit[6] | 3 | informational | QA owner | Promotion rule: flips blocking at pilot exit (§4 question) |
No test layer defined here: the strategy owns what exists; this table only wires.
What: rolling replaces instances behind the health check; blue-green doubles capacity for a clean cutover; canary splits traffic against live metrics. Why considered: pilot traffic is one hub; a meaningful canary slice of one hub's dispatchers is too small to move the metrics before full exposure, and blue-green's capacity double buys nothing at four services. Findings: rolling wins at pilot; the canary re-decision trigger is hub three, when traffic can carry a meaningful slice (deployment strategy[7]).
Rollback, automated: triggers cited from the rollback triggers[1]: error-rate and latency ceilings watched by the platform's release automation; breach rolls back without a meeting; the release owner's manual pull authority (OD-1[7]) complements the automation. Branch flow: trunk-based with short-lived branches and flags; feature-branch flow rejected (integration pain outweighs release-scheduling control for one team) (branch flow[7]).
| DORA measure | Target | Measured from |
|---|---|---|
| Deployment frequency | on demand; ≥ weekly during pilot | Pipeline data, computed in the delivery dashboard (dashboards[8]) |
| Lead time for changes | < 1 day | |
| Change-failure rate | < 10% | |
| Time to restore | < 1 h (the automation's ceiling) |
| Question | Owner | Answer by | Blocks |
|---|---|---|---|
| Does the accessibility gate flip to blocking at pilot exit or at the week-6 value review (two candidate events, one gate)? | QA owner | Sep 26, 2026 | The gate table's stage-3 row only |