Meridian Field Services: instructional example, not project evidence
Backs the test strategy's release gate (CI gates[1]) across the declared tiers: dev, pilot (Toronto), production (deployment view[2]). Delivery model: single-shot deploys with one feature-flag kill-switch (suggestions); no canary infrastructure at pilot scale, named below where it matters. Agreed with E. Sandoval.
A health check answers "is it up"; the synthetic transaction answers "does it work". Every invocation is executable as written; a description of a command is not a command.
| Check | How invoked | Expected | Timeout | Owner | Auto |
|---|---|---|---|---|---|
| DV-1 API health | GET api/health | 200 and build sha matches the deploy | 10 s | on-call eng | yes |
| DV-2 synthetic assignment transaction | k6 run smoke/assignment_flow.js | Job created → three suggestions within 5 s → acceptance recorded → exactly one assignment event; catches what a 200 masks | 90 s | on-call eng | yes |
| DV-3 auth smoke | GET api/assignments (no token) | 401 (never data); links the security gate (SR-004[3]), duplicates nothing | 10 s | on-call eng | yes |
| DV-4 positions freshness | GET api/positions/staleness | Stale share < 5% | 30 s | on-call eng | yes |
| DV-5 notification round-trip | k6 run smoke/notify_sandbox.js | Delivered and confirmation received on the sandbox device | 120 s | on-call eng | yes |
| DV-6 board visual sanity (cutover day only) | Dispatcher loads the board | Suggestions render with reasons | n/a | M. Chen | manual: one-time human judgment at go-live, reason recorded |
Split, explicit: five of six automated; DV-6 manual with its reason. The critical flow (assignment) carries its synthetic transaction; edge cases live in regression, not smoke.
Gates scale by blast radius; a preview and production are not the same ceremony. Rows referenced by id, restated nowhere.
| Tier | Gate (checklist rows by id) | Promotion owner | Window |
|---|---|---|---|
| dev | DV-1 | feature team | n/a |
| pilot | DV-1..DV-5 + e2e critical path (gate table[1]) | K. Yamada | 30-min golden-signal watch |
| production (cutover) | full set incl. DV-6 | E. Sandoval | 60-min window |
The tier set matches the strategy ladder exactly: no tier without a gate, no gate without a tier.
Numbers on leading signals, one owner who may pull without a meeting, and the time-box that ends the debate. Prose criteria are debates scheduled for the worst possible moment.
| Trigger | Criterion (leading signal) | Owner | Time-box |
|---|---|---|---|
| RT-1 | api_error_rate > 2% over 10 min | on-call engineering lead (no meeting) | 30 min fix-in-place, then roll back regardless |
| RT-2 | suggestion_latency_p95 > 2 s sustained 15 min | same | same |
| RT-3 | assignment_write_failures > 0.5% over 5 min | same | immediate (no fix-in-place window); assignment integrity is the product |
The rolled-back version re-runs DV-1 through DV-5; the triggering signal must sit at baseline for 20 minutes before stand-down; owner, the same on-call engineering lead who pulled the trigger; the event and its verification logged. A rollback nobody verified is a hope, not a recovery.
| Question | Owner | Answer by | Blocks |
|---|---|---|---|
| Does hub-six rollout justify canary infrastructure (flipping the RT thresholds to per-slice evaluation)? | E. Sandoval | Aug 15, 2026 | The production gate's shape for rollout, not the pilot |
Omission note (how the canary block renders when the model has one): "Canary hooks engaged; error_rate carries critical: true (fails the canary regardless of the blended score); baseline window 1 hour of pre-deploy traffic."