System · Accepted state
Essay · 06 · Operating modellibrary/on-promotion-discipline.md

On promotion discipline

Every promotion produces an evidence bundle. Every rollback is ready before the promotion is approved.

Promotion is the controlled path from "a candidate model appears better" to "this model is trusted enough to serve a real workflow." Without that path, the best specialist in the world is just a result on a slide.

Six states, explicit transitions

A candidate specialist moves through explicit states:

candidate → eval-accepted → shadow → canary → production-accepted → deprecated

Modelsmith packages the specialist artifact and governs the state machine. You control shadow and canary deployment in your own infrastructure. Modelsmith supplies the artefact, the rollback contract, and the evidence bundle.

Where a human belongs

Not every transition needs a human. Eval-accepted is a purely mechanical check against the governed set. But humans belong at the judgement gates:

  • Approving new eval rubrics and policy boundaries
  • Approving baseline selection when the comparison set is business-critical
  • Approving high-impact dataset inclusion
  • Reviewing high-severity failures or ambiguous regressions
  • Approving movement from shadow to canary
  • Approving production promotion
  • Approving rollback when impact is ambiguous and no emergency policy applies
  • Resolving conflicts where quality, latency, cost, and business risk disagree
The human is the judge. The agent is the mechanic. The platform enforces the record.
The line we hold

Evidence, not anecdote

Every promotion produces an evidence bundle. Which evals moved. Which regressions appeared. Which examples drove the improvement. What the rollback path is. What policy gate was crossed, and by whom.

This is the artefact that lets a new team member, six months into the future, reconstruct why a specialist is serving. It is also the artefact that lets a compliance reviewer believe you. Both matter.

Rollback is ready before promotion is approved

The single discipline that separates platforms you can trust from platforms you cannot: the rollback artefact exists before the promotion is approved. Not after the incident. Not during the incident. Before.