Find your next learning step
Re-promotion after rollback is a controlled experiment in restored authority. Monitoring must test both operational behaviour and the lineage claims that justified the return. If failures recur through more than one inherited pathway, another temporary rollback may no longer be enough. A permanent authority cap can preserve a useful advisory or dual-approval role while preventing repeated attempts to regain automation without credible new evidence.
Open the chapter contents · Topology root · Gold Standard of Education · How X Works
Chapter contents
Choose the route closest to the decision, or read from Chapter 1. The chapters remain open; these grouped routes are a navigable index.
Route 1 · Define the decision
Route 2 · Work the ledgers
Route 3 · Transfer the method
Route 4 · Check limits and evidence
Route 5 · Ask and continue
CHAPTER 1 OF 12 · DEFINE THE DECISION
1. Freeze the re-promotion claim and ceiling
Record the release, topology, evidence set, authority stage, exclusions, safeguards, monitoring window and maximum stage currently eligible. The old pre-rollback ceiling does not return automatically.
Name the conditions that would trigger ordinary review, rollback, lineage reopening or consideration of a permanent cap.
CHAPTER 2 OF 12 · DEFINE THE DECISION
2. Monitor lineage as an operating variable
Track declared code, feature, threshold, analyst and evidence transfers. Provenance alerts matter because a rule can perform well while its claimed independence quietly changes.
Cross-lineage recurrence means that materially similar failure or contamination appears through more than one inherited path. It requires tracing, not simply counting incidents.
CHAPTER 3 OF 12 · WORK THE LEDGERS
3. Build a re-promotion monitoring register
Topology rule S2 returns to bounded automatic authority after a locked recovery trial.
| Monitor | Release boundary | Trigger | Observed | Response |
|---|---|---|---|---|
| False unlocks | At most 1 per 200 | Two in 200 | 2 | Rollback |
| Novel topology | Always abstain | Any automatic action | All abstain | Pass |
| R5 lineage | No cached script | Any recurrence | None | Pass |
| C1 lineage | Declared helper only | Undeclared transfer | Threshold macro found | Reopen |
| S1 analyst exposure | Blind scoring | Outcome access | One access event | Quarantine subset |
The false-unlock trigger rolls S2 back, while the C1 and S1 findings open a multi-lineage investigation.
CHAPTER 4 OF 12 · WORK THE LEDGERS
4. Work a permanent-cap decision
The board reviews S2 alongside earlier R5 and S1 incidents.
| Cap criterion | Rule | Evidence | Result | Decision |
|---|---|---|---|---|
| Repeated automatic-stage failure | Two qualified recurrences | S1 and S2 | Met | Consider cap |
| Independent repair path | No new evidence channel available | Same operational stream | Met | Limit confidence |
| Lower-stage utility | Dual approval below error budget | Passes 300 cases | Met | Preserve role |
| Safeguard reliability | Novel topology abstains | All pass | Met | Support cap |
| Material new mechanism | Would justify future review | None now | Not met | Cap remains permanent |
The decision allows reconsideration only if a materially new mechanism and independent evidence channel are documented, not merely another threshold revision.
CHAPTER 5 OF 12 · WORK THE LEDGERS
5. Distinguish a cap from retirement
A cap sets the highest permitted authority stage for a continuing role. Retirement removes the role. The cap should name actions, populations, safeguards and who can review exceptional future evidence.
Remove automation paths above the cap so users cannot recreate them informally through configuration or local scripts.
CHAPTER 6 OF 12 · TRANSFER THE METHOD
6. Control cross-lineage recurrence
Represent each relevant release, transfer, activity and agent. Quarantine exposed evidence branches, compare implementation diffs, review access logs and reserve an independent subset where possible.
Do not declare every descendant contaminated. Trace material influence and explain why unaffected branches remain usable.
CHAPTER 7 OF 12 · TRANSFER THE METHOD
7. Changed-context transfer: adaptive routing cap
Transfer the method to an adaptive routing rule that twice fails under automatic operation after repairs from different prior lineages. Dual approval continues to improve decisions.
The network authority caps the rule at dual approval, removes automatic execution and retains novel-topology abstention. Future automation requires a materially new routing mechanism and sealed evidence source.
CHAPTER 8 OF 12 · TRANSFER THE METHOD
8. Connect recovery trials, monitoring and restart limits
Start with rollback recovery trials and multi-lineage contamination control. Use post-promotion monitoring and authority rollback for the earlier trigger design.
Return to restart-family limits and global evidence budgets when repeated attempts consume shared evidence across the family.
CHAPTER 9 OF 12 · CHECK LIMITS AND EVIDENCE
9. Limits and common misconceptions
A permanent cap is not proof that the rule is bad. It can preserve a useful role whose consequence remains supported. Nor should a cap be called permanent if ordinary tuning can remove it without an exceptional review.
Cross-lineage recurrence is not established by superficial similarity alone. Trace mechanisms and influence. Strong lower-stage performance does not supply evidence for a higher automatic stage.
CHAPTER 10 OF 12 · CHECK LIMITS AND EVIDENCE
10. Practical evidence and cap checks
Archive the re-promotion claim, release hash, topology, authority stage, exposures, metrics, safeguards, incidents, rollback, lineage transfers, access logs, quarantined subsets and investigation results.
For a permanent cap, retain the criteria, prior recurrences, lower-stage utility, disabled paths, permitted actions, exception threshold, review authority, user notice and ongoing monitor.
CHAPTER 11 OF 12 · ASK AND CONTINUE
11. Frequently asked questions
Can a permanent cap ever change?
Only through the exceptional route defined in the decision, typically requiring a materially new mechanism and independent evidence rather than routine repair.
Why not retire the rule?
Retirement is unnecessary when a lower authority stage remains useful, safe and credibly supported.
Does a provenance graph prove contamination?
No. It records asserted relations; reviewers must still establish whether a transfer materially influenced the claim or evidence.
CHAPTER 12 OF 12 · ASK AND CONTINUE
12. Sources and next reading
The W3C PROV-O Recommendation provides relations for derivation, revision, generation, invalidation, collections and bundles. The PROV Data Model organises provenance across entities, activities, agents, derivations, bundles and collections. These sources support explicit lineage; the topology and routing cases are original teaching examples.
Continue through the Topology root, the Gold Standard of Education and How X Works.
Top · Contents · Previous · How X Works