decision-canon/examples/DEC-EX-003-incident-rollback.md

DEC-EX-003 — Roll back the checkout API

Situation: incident-response decision.

Checkout started failing after a deploy. The rollback was ordered before the cause was known. The next day's observation contradicted the decision-time assumption. Both moments are on this object. Fields that were not known at either moment are absent.

decision:
  identity:
    id: DEC-EX-003
    title: Roll back the checkout API
    namespace: decision-canon/examples
  question:
    text: The checkout API is failing after the 14:10 deploy. Roll back, forward-fix, or wait?
    trigger: The error rate stayed above the paging threshold for ten minutes.
  kind:
    primary: choice
  state:
    lifecycle: observed
    since: "2026-05-11T15:05:00Z"
  frame:
    situation: New checkout sessions fail. Payments that were already taken are completing.
    horizon: The next hour.
    assumptions:
      - The 14:10 deploy is the only material change.
  alternatives:
    - id: A
      label: Roll back
      action: Restore the previous release.
      reversibility:
        level: easy
        delay: About ten minutes.
    - id: B
      label: Forward-fix
      action: Patch the suspected null check and deploy that patch.
    - id: C
      label: Wait
      action: Watch for fifteen more minutes before changing production.
  uncertainty:
    known_unknowns:
      - Whether the errors come from the deploy or from a downstream timeout.
    reducible:
      - A log comparison could show whether the new build is on the error path.
    irreducible:
      - Sessions that already failed cannot be reconstructed by this decision.
  commitment:
    selected: A
    by: incident lead
    at: "2026-05-11T14:28:00Z"
    mode: ordered
    confidence: low
    reservations:
      - The cause was not confirmed. Rollback was chosen because it was reversible.
  execution:
    intended_actions:
      - Restore the previous release.
    responsible:
      - incident lead
    status: completed
    completed_at: "2026-05-11T14:41:00Z"
  outcome:
    observations:
      - The error rate returned to baseline after the rollback.
    unintended_effects:
      - The price test in the new release stopped with it.
    occurred_at: "2026-05-11T14:45:00Z"
  learning:
    expected: Checkout recovers if the deploy is the cause.
    observed: Checkout recovered. The next day the same error returned without that deploy, from the downstream timeout.
    deviations:
      - The assumption that the deploy was the only material change was false.
    lessons:
      - The reversible rollback was still the commitment to make under that uncertainty.
      - The later observation does not replace the decision-time assumption.
  temporal:
    decision_time: "2026-05-11T14:28:00Z"
    observed_at: "2026-05-12T09:00:00Z"