Engineering
Quality bar
The eight gates every change ships through, the four-step release process and our postmortem discipline. Numbers are current; we publish them every quarter.
Eight gates
Every change clears all eight, every time
| Gate | Target | Current | Scope |
|---|---|---|---|
| Unit + integration coverage | ≥ 85% | 89.4% | Every PR; merges blocked below target. |
| Change failure rate (DORA) | < 5% | 2.1% | Trailing 90 days; tracked per service line. |
| Mean time to restore (MTTR) | < 45 min | 21 min median | P1 incidents only; published in the integrity report. |
| Deployment frequency | ≥ 30 / week | 47 / week median | Production deploys across all services. |
| Two-reviewer rule | 100% | 100% | No solo merges; one reviewer must hold release manager role. |
| Automated security scan | Zero criticals | 0 open | SAST + dependency + container scan on every merge. |
| Migration safety review | 100% | 100% | Every schema change reviewed by DBA + on-call before merge. |
| Feature flag gating | 100% of net-new endpoints | 100% | Risky paths default off; ramp via percentage rollout. |
Release process
Four steps from merge to one hundred percent
Pre-merge
Static analysis, type-check, unit and integration tests, contract tests against staging upstream platforms.
Canary
Five percent of traffic for thirty minutes with synthetic monitors and error budget guardrails.
Ramp
Twenty-five, fifty, one hundred percent in fifteen-minute steps; automatic rollback on SLO breach.
Post-deploy
Release manager signs off; deploy is annotated in the integrity log with a link to the change and tests.
When we miss
Postmortem discipline
- Within twenty-four hours of resolution we publish a blameless postmortem in the internal log.
- Within seventy-two hours we publish a customer-facing summary in the transparency report when impact > P3.
- Every postmortem ships with at least one durable fix and one detection improvement, tracked to completion.
- We do not close postmortems until the durable fix lands and the detection runs in production for fourteen days.
See the work
Live SLOs sit on the status page; the multi-year ledger lives in uptime history; the engineering retrospectives are in the integrity report.