Shipyard

Architecture

Each environment holds its own flag documents. Evaluation hashes a sample user into a bucket and applies targeting rules. A synthetic error/latency series backs a health gate. Rollback writes history. No live traffic is observed.

Environment → flag document → cohort and percentage evaluation → exposure estimate → optional health gate → rollback or continue.

Decisions

• — Keep development, staging, and production configurations isolated.
• — Explain every audience decision from deterministic targeting plus rollout percentage.
• — Treat kill-switch as an immediate disable that still records history.

Trade-offs

• — Percentage rollouts limit blast radius and they create split-brain behavior across users.
• — Health gates stop bad releases and they can halt a rollout on noisy synthetic errors.
• — Per-environment flags prevent accidental prod changes and they drift if not reviewed.

Failure modes

• — A user outside the targeted cohort stays off even at 100% if the rule excludes them.
• — Simulating the incident fixture trips the health gate on the selected flag.
• — Rollback disables the flag in the current environment only.

Evaluation

Exposure estimates use a fixed sample population. Health uses a seeded series. Both are demo calculations.

Production extensions

Proposed — not implemented in this portfolio.

• — Back evaluation with a real flag service and consistent hashing.
• — Join release health to production SLOs and automated hold.
• — Add change tickets and approval gates for production flags.