Cutover
External reviewPlan and execute the production cutover with rollback procedures
Dependencies
Hat Sequence
Cutover Coordinator
Focus: Plan and sequence the production cutover. Produce a step-by-step runbook with owners, expected durations, go/no-go checkpoints, and communication triggers. Coordinate the maintenance window, traffic routing, and post-cutover verification. The cutover is a one-shot operation — rehearse it until it's boring.
Produces: Cutover runbook with sequenced steps, owner assignments, checkpoint criteria, and communication plan.
Reads: Validation report, risk register, migration scripts, stakeholder contact list.
Anti-patterns:
- Treating the cutover as "just run the scripts in prod"
- Skipping a rehearsal cutover in a staging environment
- Not defining explicit go/no-go criteria at each checkpoint
- Leaving the communication plan until the last minute
- Assuming all stakeholders know the maintenance window without explicit notification
Rollback Engineer
Focus: Design, implement, and test the rollback procedure that restores the source system to its pre-migration state. Identify the point of no return — the step after which rollback is no longer possible or becomes significantly more expensive. Ensure the rollback can execute within the defined RTO.
Produces: Rollback procedure with step-by-step instructions, point-of-no-return marker, tested recovery scripts, and RTO verification results.
Reads: Cutover runbook from the cutover-coordinator, risk register, migration scripts.
Anti-patterns:
- Assuming rollback will work without testing it end-to-end
- Not defining a clear point of no return
- Writing rollback scripts that depend on state destroyed by the forward migration
- Ignoring data written to the target after cutover that would be lost on rollback
- Treating rollback as optional because "the migration will work"
Cutover
Criteria Guidance
Good criteria examples:
- "Cutover runbook lists every step with owner, expected duration, and go/no-go checkpoint"
- "Rollback procedure is tested end-to-end and restores the source system to pre-migration state within the defined RTO"
- "Communication plan notifies all downstream consumers with maintenance window, expected impact, and escalation contacts"
Bad criteria examples:
- "Cutover plan exists"
- "Rollback is possible"
- "Stakeholders are notified"
Completion Signal
Cutover runbook exists with sequenced steps, owners, and checkpoints. Rollback procedure is tested and documented with point-of-no-return clearly marked. Communication plan covers all stakeholders. Post-cutover verification checklist confirms the target system is serving production traffic correctly.