--- slug: "Rollout" name: "Rollout" type: "Protocols" layer: "Society" ref: "Rollout#ea8c" sema_id: "sema:Rollout#mh:SHA-256:ea8c8bdf3303e53d240d6393a776de33ff7c0980a269539d6eb22a8b35e430b4" tags: ["Society","Protocols"] updated: 2026-11-11 mindscape: "bootstrap" index_url: https://mindscape.world/scapes/bootstrap.json url: https://mindscape.world/bootstrap/Rollout/ related: ["ExecutionManifest","Break","Canary","CircuitBreaker","Compensate","EjectionSeat","Act","RolloutManifest","Deploy","OrchestrationLoop","RealizationProtocol","BlueGreen"] --- # Rollout Progressive deployment with canary gating and recorded compensation Layer: Society ยท Category: Protocols ## Mechanism Creates a durable [RolloutManifest](https://mindscape.world/scapes/bootstrap/RolloutManifest.md) before enabling the [EjectionSeat](https://mindscape.world/scapes/bootstrap/EjectionSeat.md) or dispatching work, then executes the approved `operation_sequence` in an [ExecutionManifest](https://mindscape.world/scapes/bootstrap/ExecutionManifest.md) as state-changing [Act](https://mindscape.world/scapes/bootstrap/Act.md)s inside a [CircuitBreaker](https://mindscape.world/scapes/bootstrap/CircuitBreaker.md) envelope. Before dispatching any canary or forward state-changing action, Rollout creates a `prepared` manifest entry containing a discoverable idempotent inverse for [Compensate](https://mindscape.world/scapes/bootstrap/Compensate.md) that is safe to invoke when the forward outcome is unknown. The entry becomes `armed` before the action is sent, and its `outcome: unknown` is replaced only when an outcome is observed. If no safe inverse can be prepared, Rollout refuses that action and enters the same terminal cleanup path as a breaker trip. Rollout first runs a bounded real-path [Canary](https://mindscape.world/scapes/bootstrap/Canary.md). `proceed` is the sole authorization for full execution or commitment of canary progress. On `caution` or `abort`, unless preempted by [EjectionSeat](https://mindscape.world/scapes/bootstrap/EjectionSeat.md), Rollout invokes [Break](https://mindscape.world/scapes/bootstrap/Break.md), invokes [Compensate](https://mindscape.world/scapes/bootstrap/Compensate.md) for every armed canary entry whose outcome is effectful or `unknown`, records the result, permits only DESTROY or RECYCLE, freezes the manifest, and terminates this run; retry requires a new Rollout. An inverse-preparation failure or breaker trip, unless preempted by [EjectionSeat](https://mindscape.world/scapes/bootstrap/EjectionSeat.md), invokes [Break](https://mindscape.world/scapes/bootstrap/Break.md), stops forward execution, invokes [Compensate](https://mindscape.world/scapes/bootstrap/Compensate.md) for every armed entry whose outcome is effectful or `unknown`, records every per-inverse result, freezes the manifest, and terminates this run; neither breaker recovery nor retry resumes it, and either requires a new Rollout. A received [EjectionSeat](https://mindscape.world/scapes/bootstrap/EjectionSeat.md) signal always takes precedence over all cleanup paths: PAUSE suspends forward and compensation work and leaves the manifest open; TERMINATE stops new forward work, invokes [Break](https://mindscape.world/scapes/bootstrap/Break.md), permits best-effort [Compensate](https://mindscape.world/scapes/bootstrap/Compensate.md) during graceful shutdown without allowing acknowledgement or cleanup to block termination, and then freezes the manifest; EMERGENCY halts immediately with no compensation and no final-write guarantee, so only an incomplete immutable prefix with no guaranteed final outcome entry is available. Outside EMERGENCY, Rollout freezes the manifest when the run terminates. ## Invariants - No state-changing [Act](https://mindscape.world/scapes/bootstrap/Act.md) is attempted before the [RolloutManifest](https://mindscape.world/scapes/bootstrap/RolloutManifest.md) records its discoverable idempotent inverse, safe under an `unknown` outcome; otherwise it is refused as an inverse-preparation failure. - `proceed` alone authorizes full execution or committed [Canary](https://mindscape.world/scapes/bootstrap/Canary.md) progress. - `caution`, `abort`, inverse-preparation failure, or a [CircuitBreaker](https://mindscape.world/scapes/bootstrap/CircuitBreaker.md) trip starts no further forward work and, absent [EjectionSeat](https://mindscape.world/scapes/bootstrap/EjectionSeat.md) preemption, enters ordinary terminal cleanup. - Ordinary terminal cleanup invokes [Break](https://mindscape.world/scapes/bootstrap/Break.md), then [Compensate](https://mindscape.world/scapes/bootstrap/Compensate.md) for every effectful-or-`unknown` armed entry, records each inverse result, and terminates with the manifest frozen. - A terminated Rollout never resumes; retry and breaker recovery use a new Rollout. - A received [EjectionSeat](https://mindscape.world/scapes/bootstrap/EjectionSeat.md) signal preempts ordinary cleanup in favor of its selected mode. - PAUSE suspends forward and compensation work and leaves the Rollout and its manifest open. - TERMINATE starts no further forward work, invokes [Break](https://mindscape.world/scapes/bootstrap/Break.md), and permits best-effort [Compensate](https://mindscape.world/scapes/bootstrap/Compensate.md); Break acknowledgement and cleanup cannot block termination with a frozen manifest. - EMERGENCY halts immediately without cleanup or a final manifest write. - Outside EMERGENCY, the [RolloutManifest](https://mindscape.world/scapes/bootstrap/RolloutManifest.md) records every armed action, compensation action, and observed inverse result; at freeze, each forward entry contains its observed outcome or `unknown` if unobserved. ## Preconditions - [ExecutionManifest](https://mindscape.world/scapes/bootstrap/ExecutionManifest.md) is approved - [CircuitBreaker](https://mindscape.world/scapes/bootstrap/CircuitBreaker.md) is configured for the operation target and CLOSED - [Canary](https://mindscape.world/scapes/bootstrap/Canary.md) telemetry collection is active for the bounded path - [EjectionSeat](https://mindscape.world/scapes/bootstrap/EjectionSeat.md) readiness has a recorded successful test and its dedicated channel, operator key, and operator are available ## Postconditions - If the run terminates without EMERGENCY, the [RolloutManifest](https://mindscape.world/scapes/bootstrap/RolloutManifest.md) is frozen with each armed action and its observed or `unknown` outcome. - If EMERGENCY occurs, immediate halt is the only guaranteed outcome; the durable [RolloutManifest](https://mindscape.world/scapes/bootstrap/RolloutManifest.md) may contain only an incomplete immutable prefix with no guaranteed final outcome entry. ## Failure modes - Canary false positive: The bounded real path returns `proceed`, but full execution encounters conditions the canary did not cover. - Dirty compensation: One or more recorded inverse actions fails, leaving partial state; the failure remains in the [RolloutManifest](https://mindscape.world/scapes/bootstrap/RolloutManifest.md). - Forward execution drift: An attempted forward action does not match the next authorized action in the approved [ExecutionManifest](https://mindscape.world/scapes/bootstrap/ExecutionManifest.md) operation sequence. - Audit drift: An armed canary or forward action, or any compensation action, is absent from the [RolloutManifest](https://mindscape.world/scapes/bootstrap/RolloutManifest.md). - Emergency residue: [EjectionSeat](https://mindscape.world/scapes/bootstrap/EjectionSeat.md) EMERGENCY mode halts without cleanup, so effects from already attempted actions can remain. ## Signature - `Act(ExecutionManifest)` ## Builds on - [ExecutionManifest](https://mindscape.world/scapes/bootstrap/ExecutionManifest.md) (Infrastructure; Accepts) - [Break](https://mindscape.world/scapes/bootstrap/Break.md) (Infrastructure; Composes with) - [Canary](https://mindscape.world/scapes/bootstrap/Canary.md) (Society; Composes with) - [CircuitBreaker](https://mindscape.world/scapes/bootstrap/CircuitBreaker.md) (Infrastructure; Composes with) - [Compensate](https://mindscape.world/scapes/bootstrap/Compensate.md) (Infrastructure; Composes with) - [EjectionSeat](https://mindscape.world/scapes/bootstrap/EjectionSeat.md) (Society; Composes with) - [Act](https://mindscape.world/scapes/bootstrap/Act.md) (Infrastructure; References) - [RolloutManifest](https://mindscape.world/scapes/bootstrap/RolloutManifest.md) (Infrastructure; Yields) ## Used by - [Deploy](https://mindscape.world/scapes/bootstrap/Deploy.md) (Society; Composes with) - [OrchestrationLoop](https://mindscape.world/scapes/bootstrap/OrchestrationLoop.md) (Society; Composes with) - [RealizationProtocol](https://mindscape.world/scapes/bootstrap/RealizationProtocol.md) (Society; Composes with) ## Identity - Sema ID: `sema:Rollout#mh:SHA-256:ea8c8bdf3303e53d240d6393a776de33ff7c0980a269539d6eb22a8b35e430b4` - Ref: `Rollout#ea8c` - Supersedes: - `sema:Rollout#mh:SHA-256:42389087ff9ffd73d3de5c71f8509cf2cd974795babc71e862ec139c92ad5c78` - `sema:Rollout#mh:SHA-256:54d7bac8171164fb66054c97570c030967e0d5f568763a69a103eec26ac0aeeb` - `sema:Rollout#mh:SHA-256:8fc16ddf8f7add799ac8b49f7894f508be0b8378f995e57540cab8ec028eb996` - `sema:Rollout#mh:SHA-256:e4717541319b2a51a4b78b1278fc14a1b3fd4f6daf6719eb70c08c7193dfb629` ## Links - [Pattern page](https://mindscape.world/bootstrap/Rollout/) - [View in the interactive graph](https://mindscape.world/bootstrap/#Rollout) - [JSON](https://mindscape.world/scapes/bootstrap/Rollout.json) - [Index of all patterns](https://mindscape.world/scapes/bootstrap.json)