Most deploy checklists are theater: twelve boxes nobody reads. Ours is six, and each one has caught real incidents. If a check has not caught anything in two quarters, it gets cut.
The six checks
- Rollback in under 5 minutes — prove it, don't assume it. If rollback is slower than fixing forward, you don't have rollback; you have a hope.
- Feature flags on anything risky — if a change can be toggled off without a redeploy, its blast radius is one click.
- One synthetic transaction per critical path — running in production before customers find it. Login, checkout, search: one probe each, checked post-deploy.
- Dependencency diff review — not just new versions, but what they pull in. Half of our worst incidents were transitive deps nobody looked at.
- Budget the blast radius — canary to 5% and watch the error budget for 10 minutes. If the canary page takes longer than the deploy, the deploy is not safe.
- One person, one checklist — the deployer runs it aloud. Checklists run silently get skipped; checklists spoken get interrupted when something looks wrong.
What we dropped
Pre-deploy meetings (async review beats a meeting at 10am nobody prepared for). Manual QA of unchanged pages. Change-request tickets for config-only changes. Every removed item made the remaining checks sharper, because people actually finish six boxes.
The checklist is not the product. The caught incidents are.
All drills ship in the Ops Starter Kit ($29). Every kit in one download: Ops Mega Bundle ($49). Want it run for you, 24/7? Always-on ops desk.
Top comments (0)