The Gold Standard · Anthropology
Make the decision path visible
A repair is not automatically an improvement. A synchronisation can copy an unverified owner into every directory, replace an independent alternate with the same failed dependency or remove the only route that could produce an effect receipt. When that happens, continuing the rollout turns one bad edge into a system-wide failure.
The gold standard detects harmful repair quickly, freezes the affected version, restores the last route known to reach authorised decision points and then redesigns from preserved evidence. Rollback is a controlled recovery, not an attempt to pretend the failed change never happened.
Choose the route closest to your decision
Chapter contents
Chapters 1–3
Chapters 4–6
Chapters 7–9
Chapters 10–12
CHAPTER 1 OF 12 · RECOGNISE BAD REPAIR
1. Define rollback around consequential reach
Rollback restores a contact-graph version whose owners, alternates and authority were previously verified at the decision point. It is not simply the most recent backup or the oldest available file.
Name the affected appeal decision, the failed repair version, the candidate restoration version and the evidence that each route could produce an operational effect.
CHAPTER 2 OF 12 · RECOGNISE BAD REPAIR
2. Set triggers for stopping a repair
Stop deployment when a new version reduces reachability, merges independent routes, assigns authority to an inactive role, produces contradictory receipts or fails at more than one consumer.
A warning should pause only the affected change while evidence is gathered. Predetermined triggers reduce the temptation to continue because a rollout is almost finished.
Evidence check
Check whether the scope, owner and decision consequence are explicit before continuing.
CHAPTER 3 OF 12 · RECOGNISE BAD REPAIR
3. Preserve the failed state before changing it
Capture the approved graph, deployed copies, sync logs, directory snapshots, notices, receipts, cache state and timestamps. Record who initiated, approved and observed the change.
Preservation lets reviewers distinguish a bad source record from a correct source corrupted during transfer. It also protects the appeal history from retrospective editing.
| Field | Evidence |
|---|---|
| Failed version | Observed harmful change |
| Stop trigger | Predefined threshold |
| Restore version | Verified route |
| Authority | Named decision owner |
CHAPTER 4 OF 12 · CONTAIN PROPAGATION
4. Quarantine incorrect synchronisation
Disable the job or connector that spreads the disputed version, invalidate unsafe caches and prevent local copies from automatically overwriting restored routes. Label all affected systems with the containment time.
Do not disconnect unrelated notification services. Bound quarantine to consumers and decisions that could receive the incorrect graph.
CHAPTER 5 OF 12 · CONTAIN PROPAGATION
5. Choose the last known-good route by evidence
A candidate route should have a signed or attributable version, verified role ownership, independent alternates and recent effect receipts. Check that organisational changes have not made it obsolete since its last successful use.
Last known-good is a claim to test, not a comforting label. A backup can be internally consistent yet no longer current.
Evidence check
Ask a second reviewer to reconstruct the example from the preserved evidence and stated assumptions.
CHAPTER 6 OF 12 · CONTAIN PROPAGATION
6. Worked example: repair writes the same inactive owner everywhere
After two dead letters, a team updates the panel contact graph. A mapping error copies the former secretary into the primary, alternate and escalation fields, then synchronises that version to the appeal register and router. The apparent consistency hides complete loss of reach.
The owner stops the sync, preserves the bad mapping and restores the prior duty-role route, whose authority and effect receipt are reverified with the registry. Changed-context check: if the old duty role was abolished during the same week, the prior version is not safe to restore; containment remains while a new independently verified route is approved.
| Area | Action |
|---|---|
| Sync job | Pause |
| Caches | Invalidate |
| Decision gate | Hold affected closure |
| Evidence | Preserve snapshots |
CHAPTER 7 OF 12 · RESTORE SAFELY
7. Validate restoration before reopening decisions
Test the primary and alternate separately, confirm their dependencies differ and require an authorised effect receipt. Compare every consuming system with the restored version and record any intentional local exception.
A successful test message is insufficient when the recipient cannot alter the relevant registry state. Validation must reach the consequence.
CHAPTER 8 OF 12 · RESTORE SAFELY
8. Reconcile the failed-repair window
Identify notices, closures and delegations processed after the bad version became effective. Determine which followed the incorrect graph and whether the intended authority acted through another valid route.
Reopen only outcomes for which the routing error could be material. Preserve stable decisions with their evidence so repair stays proportionate.
Evidence check
Verify that the control still reaches the intended decision under a changed but plausible context.
CHAPTER 9 OF 12 · RESTORE SAFELY
9. Prepare a corrected repair as a new change
Resolve the source defect, review mappings, test in a representative environment and assign a new version rather than reusing the failed identifier. Require staged deployment and consumer acknowledgements.
A new change record preserves the difference between failed, restored and corrected states. That history supports later recurrence analysis.
| Test | Pass condition |
|---|---|
| Primary route | Authorised effect |
| Alternate | Independent success |
| Consumers | Same version |
| Receipt | Returned to appeal |
CHAPTER 10 OF 12 · PREVENT REPEAT FAILURE
10. Exercise rollback before the next incident
Test source corruption, partial deployment, stale cache, unavailable approver and a last-known-good version that has itself expired. Confirm who can stop sync and who decides whether restoration is safe.
A tabletop exercise reveals missing authority, but a technical restoration test is also needed where systems can transform or reject the older graph.
CHAPTER 11 OF 12 · PREVENT REPEAT FAILURE
11. State rollback limits and misconceptions
Rollback does not prove that every notice sent under the failed version was harmless. It cannot restore an owner whose authority ended, and it may reintroduce older vulnerabilities.
State residual exposure, untested consumers and compensating controls. The goal is the safest verified route available while a durable correction is prepared.
Evidence check
Confirm that versions, notices and unresolved limits remain visible in the final record.
CHAPTER 12 OF 12 · PREVENT REPEAT FAILURE
12. Audit repair and rollback as one lifecycle
Track failed deployments, stop time, propagated consumers, restored version, validation evidence, affected decisions, repeat defects and corrective-release performance.
The gold standard makes a bad repair recoverable without erasing it. Evidence-led rollback protects the appeal while preserving what the next change must learn.
| Measure | Warning |
|---|---|
| Spread count | Wide propagation |
| Restore age | Obsolete backup |
| Unreconciled decisions | Residual exposure |
| Repeat mapping error | Root cause open |
Frequently asked questions
Is rollback always safer than keeping the repair?
No. Restore only when the previous route is still authorised and demonstrably safer than the failed version.
Should the failed version be deleted?
No. Remove it from execution but preserve its configuration, logs and evidence for reconciliation and root-cause review.
What if no last known-good route remains valid?
Keep the affected decision contained and establish a newly verified route instead of restoring obsolete authority.
When can synchronisation restart?
After the source defect is corrected, mappings are tested, consumers are staged and consequential owners acknowledge the new version.
Continue through verified routes
Core routes
Anthropology subject root · Gold Standard of Education · Gold Standard directory · How X Works hub
Specialist routes
- Contact-graph version drift, stale alternates and recurrence prevention
- Dead-letter recovery recurrence, broken contact graphs and notification resilience
- Revocation propagation failure modes, dead-letter notices and recovery ownership
- Revocation-chain gaps, orphaned delegates and authoritative closure