Rollout and Replay Gates

Pavri uses an evidence-gated rollout model to prevent untested policies from going live. Every policy must advance through a defined stage sequence, and promotion to enforcing stages requires replay evidence showing the policy behaves identically to historical sessions.

Rollout Stages

Policies move through five stages in order:

Stage	Description
draft	Policy is authored but not active. No traffic is evaluated.
observe	Policy evaluates sessions but results are only logged. No enforcement.
soft_enforce	Policy enforces decisions, but violations produce warnings instead of blocks.
enforce	Full enforcement. Policy blocks or allows based on rules.
rollback	Policy has been rolled back to a prior stage by an operator.

Promotion from observe to soft_enforce and from soft_enforce to enforce both require replay evidence. You cannot promote a policy to an enforcing stage without a passing replay job.

Replay Jobs

A replay job re-runs historical session events through the current policy version. The replay system:

1. Takes a snapshot of real session inputs from the observe stage
2. Feeds them through the policy evaluator
3. Compares the new decisions against the original decisions
4. Reports a verdict for each event: match, diverged, error, or timeout

Verdicts

Verdict	Meaning
match	The replayed decision matches the original decision exactly.
diverged	The replayed decision differs. The diff summary identifies which rules changed.
error	The evaluator threw an exception during replay.
timeout	Replay exceeded the configured wall-clock limit.

A replay job passes calibration when the ratio of match verdicts meets the configured threshold (default: 100% — zero divergences). Only a passing calibration unlocks the Promote button.

Viewing Rollout Evidence

Navigate to Policies in the dashboard, open a policy, and click Rollout to see:

• The current stage and previous stage
• The linked replay job ID and calibration result
• An evidence summary written by the operator
• Individual replay result cards showing match/diverged verdicts

Promoting a Policy

To promote a policy from observe to soft_enforce:

1. Ensure a replay job has run and calibration passed.
2. Go to Policies > [Policy Name] > Rollout.
3. Click Promote.
4. Confirm the two-step confirmation dialog.

Promotion is audited. All promote and rollback actions are logged with the operator identity and timestamp.

Rolling Back a Policy

If a policy causes unexpected behavior after promotion, operators with the role_admin role can roll back to the previous stage:

1. Go to Policies > [Policy Name] > Rollout.
2. Click Rollback.
3. Confirm the action.

Rollback sets currentStage to rollback and records the transition in the audit trail.

Kill Switches

Pavri provides emergency kill switches for operators responding to incidents:

Kill Switch	Effect
disable-enforcement	Reverts all policies to observe stage immediately.
freeze-rollouts	Blocks all promotion actions until unfrozen.
unfreeze-rollouts	Re-enables promotions.

When a rollout freeze is active, the Rollout Evidence page shows a kill-switch banner and the Promote button is disabled.

Kill switches are available to role_admin operators and are applied org-wide.

Replay Determinism

The replay system snapshots all non-deterministic inputs (timestamps, UUIDs, external call results) at the time of observation. Replays are deterministic: the same inputs must produce the same decisions. If your policy depends on real-time state that is not captured in the session snapshot, replay may diverge — this is by design and signals that the policy has a non-deterministic dependency.

API

The rollout API is available under /api/v1/governance/rollout:

GET  /api/v1/governance/rollout             # List all rollout states
GET  /api/v1/governance/rollout/{policyId}  # Detail + replay results
POST /api/v1/governance/rollout/{policyId}/promote   # Promote to next stage
POST /api/v1/governance/rollout/{policyId}/rollback  # Roll back

Promote returns:

• 200 OK on success
• 422 Unprocessable Entity with code: "evidence_required" when replay/calibration is missing
• 409 Conflict with code: "rollout_frozen" when a freeze kill switch is active