Trust / Release pipeline
A red test suite will not start the service
Every change reaches production through a pipeline that runs the full automated test suite and refuses to restart the application if the suite fails.
The interesting number is not the test count. It is that the deployment is gated on the result rather than the result being advisory.
The question this answers
What stops a bad change from reaching our claims data?
A gate, not a review. The full suite runs on every release and a failure stops the deployment mechanically. Structure changes run under a separate deploy account during a release — the everyday database account can never change structure at all.
What happens between a commit and your data
The gate
The Full Suite Runs
Every test, not a selected subset chosen for speed. A partial run is a partial answer, and partial answers are how regressions reach production.
A Failure Stops The Restart
The pipeline refuses to bring the new version up. Nobody decides whether the failure was important — that judgment call is exactly what goes wrong at 6pm on a Friday.
Least Privilege For Structure
The everyday database account cannot change structure. Structure changes run under a deploy account during a release, and each production deploy prints the one line to run on the standby.
Vocabulary Checks Run As Tests
Automated checks fail the build if invoicing and premium-billing language cross. The most expensive conceptual confusion in the domain is enforced by the test suite.
The Build Is Recorded
Every support ticket records the platform build it was raised on, read from the deploy marker, so a fault is tied to the exact version you were running.
The build, in figures
Numbers that describe the shipped platform
These describe what runs today. They are not projections, and they do not count work in progress.
Measure
Current
Automated Tests Per Release
2,757, run in full, gating the restart
Schema Migrations
245, ordered and reversible
Tenant-wall Database Changes
187, enabling row-level security on every tenant table
Databases
Eight, split by what the data is and how long it lives
Vocabulary Enforcement
Automated checks fail the build on invoicing/billing language crossover
Scheduled-job Monitoring
Dead letters kept with their arguments; host, model and connector checks alert Waypoint
Where we are honest
What a test suite does not prove
A gated pipeline is a strong engineering position. It is not a claim about uptime, and we will not dress it up as one.
Tests Prove Intent, Not Correctness
A test suite encodes what we believed should be true. A defect nobody thought to test for passes the suite as happily as correct code.
This Is Not A Redundancy Story
A gated pipeline says changes are safe to deploy. Availability is a separate question — see backups and recovery for the standby region and the restore targets.
A Target, Not A Contract
Our uptime target is 99.9%, measured every minute by an outside monitor. Ask us what we have actually run against it.
Read next
Ask what our last failed release did
Every platform has one. The useful question is what the pipeline did about it, and how long production was affected — which for a gated suite is usually “nothing reached production”.