2.0 KiB
2.0 KiB
Portfolio rollback record
Create one record per rollback attempt. Keep credentials, secret key material, private scanner evidence, and private server paths out of this document and Git. A rollback uses a newly signed rollback manifest; an old release manifest is never replayed.
Authorization
- Incident/change reference:
- Authorized by:
- Authorization timestamp (UTC):
- Operator:
- Reason and observed failure:
Fenced release state
- Canonical public URL:
- Current signed manifest digest:
- Current immutable release ID:
- Current fence:
- Approved rollback target artifact digest:
- Newly signed rollback manifest digest:
- Rollback manifest expiry:
- Expected predecessor digest:
- Expected fence:
- External approval/ledger revision:
Verification before pointer change
- Rollback target is an existing immutable release directory.
- Target artifact hashes match the newly signed rollback manifest.
- Signature, scope, issuer epoch, approval/ledger state, expiry, predecessor, and fence verify.
- Readiness and internal smoke checks pass.
- A concurrent activation has not changed the current digest or fence.
Outcome
- Activation start timestamp (UTC):
- Activation finish timestamp (UTC):
- Result: succeeded / failed without pointer change / failed after pointer change
- New current signed manifest digest:
- New fence:
- Atomic activation receipt digest:
- Public smoke report digest:
- Public smoke result:
- Previous/current release still recoverable:
- Additional containment or follow-up:
Post-rollback checks
- Canonical HTTPS response is 200 and reports the expected manifest digest.
- Alternate hosts redirect to the canonical URL in one permanent hop.
- Security, cache, compression, MIME, and range headers pass.
- Canonical/OG/JSON-LD/robots/sitemap agree.
- JavaScript-disabled content remains substantive and accessible.
- No source maps, private identifiers, or credentials are public.
- Incident and Search Console/crawl implications are recorded if applicable.