Start Building

Lesson 75: Waiver Renewal Post-Promotion Audit Export for Rollback Evidence and Incident Lineage in RPG Live-Ops

Lesson 74 gave you a single-row promotion decision packet. Operations reality is that promotions are followed by deploys, hotfixes, and sometimes rollbacks. If you cannot prove what reviewers believed at promote time, post-incident reviews become opinion panels.

In this lesson, you will build a post-promotion audit export routine that snapshots the packet into long-retention storage and links it to rollback or incident lineage when execution diverges from the recorded verdict.

Content creator workspace illustration representing durable records and audit-friendly exports

What this lesson solves

You need:

  1. An immutable-enough archive copy of the promotion packet row after promote decision time
  2. A stable export_batch_id you can cite in tickets, runbooks, and regulator questions
  3. A binding path from live divergence (rollback, sev-1, customer impact) back to the exact packet that authorized risk

Prerequisites: Lesson 74 promotion decision packet fields.
Expected time: 95-115 minutes including one tabletop rollback drill.

Align field names with Lesson 74: Waiver Renewal Promotion Decision Packet Template for Scorecard, Playbook, Corrective Acceptance, and Executive Exceptions in RPG Live-Ops so exports do not invent a parallel vocabulary.

What you will build

  1. A post_promotion_audit_export_policy.md contract
  2. A post_promotion_audit_export_log.csv append-only schema (or equivalent event log)
  3. A minimum retention matrix tied to risk class
  4. One rollback rehearsal script that references export ids

Step 1 - Define export policy

Create post_promotion_audit_export_policy.md and specify:

  • which promotion_decision values trigger mandatory export (promote always; hold optional for learning)
  • maximum delay between decision timestamp and export completion
  • who may run export jobs versus who may read archives
  • legal hold behavior (freeze pointers, not silent deletes)

Step 2 - Author post_promotion_audit_export_log.csv

Append one row per successful export. Suggested columns:

column purpose
export_row_id monotonic id
promotion_packet_id Lesson 74 reference
promotion_decision_at_utc copied for audit convenience
export_batch_id batch label for nightly or per-window jobs
archive_uri object store or doc system pointer
retention_class standard, extended, or regulated
content_integrity_reference checksum or signed manifest id
exported_at_utc completion time
export_operator_ack who ran the job
rollback_event_id empty until divergence
incident_ticket_id empty until linked
divergence_summary short text when linked
link_owner_ack who bound rollback or incident to this export

Treat the log as append-only in practice: corrections add a new row with correction_of_export_row_id if your tooling allows.

Step 3 - Retention matrix

Define retention by retention_class:

  • standard: default quarters for operational audit
  • extended: executive exception paths or repeated yellow lanes
  • regulated: jurisdictions or partners with explicit evidence rules

Document where retention is enforced (bucket policy, ticket archive, etc.).

Step 4 - Bind divergence

When rollback or sev-1 happens:

  1. Locate the export row for the promoting packet id
  2. Set rollback_event_id or incident_ticket_id
  3. Write divergence_summary as factual deltas, not blame prose
  4. Require link_owner_ack from release ops or incident commander

Without a link row, your incident timeline will float free of the promotion record.

Step 5 - Rollback rehearsal

Run a tabletop:

  1. Take a historical promote decision
  2. Simulate "bad deploy" two hours later
  3. Practice retrieving archive_uri and confirming content_integrity_reference
  4. Time how long it takes to attach the export to a mock incident

If retrieval exceeds your incident SLA, fix storage paths before you need them live.

Success check

  • Every production promote in scope has a matching export row within policy delay
  • Rollback runbook cites export_batch_id or export_row_id
  • Incident templates include a required field for promotion packet linkage

Common mistakes

Mistake: Exporting before the decision timestamp is final

Fix: key off Lesson 74 promotion_decision_at_utc, not export job start time.

Mistake: Letting engineers delete exports to save cost

Fix: tier storage; never delete; legal hold overrides cost debates.

Mistake: Storing only PDFs without structured ids

Fix: keep the csv log or event stream as the index; PDFs are exhibits.

Pro tips

Mini challenge

  1. Pick one old promote without an export discipline.
  2. Reconstruct what you wish had been archived.
  3. Draft the export log row you would require next time.

FAQ

Is this the same as backup?

No. Backups protect systems. Audit exports protect decision provenance for governance.

Do we export if promote was cancelled?

Policy choice. Many teams export hold decisions for training data; others skip to reduce noise. Write the rule explicitly.

Who owns the integrity reference?

Typically release ops or platform engineering, not the feature team, to reduce conflict of interest.

Lesson recap

You now have a post-promotion audit export pattern that preserves promotion packets for audits and binds them to rollback and incident lineage when reality diverges from the promote verdict.

Next lesson teaser

Continue to Lesson 76: Waiver Renewal Decision Replay Checklist for Post-Promote Telemetry Slice Divergence in RPG Live-Ops, which replays scorecard, playbook, and packet fields against bounded live telemetry slices after promote.

Related learning