Skip to content
HoldField

RolloutWorks

Evidence-backed waves, not remote control

Coordinate rollout waves, hold points, risks, approvals, rollback readiness, and hypercare while each station remains the local authority — no station is promoted automatically and nothing here commands the cell.

Rollout waves

  1. Wave plan
  2. Gate results
  3. Hold point
  4. Risk register
  5. Rollback readiness
  6. Hypercare plan
  7. Decision log
  8. Executive summary

RolloutWorks coordinates waves, gates, holds, risk, rollback readiness, and hypercare while each station stays the local authority. Gate results can hold or block, risks stay visible, and nothing here promotes a station, applies a pack, or commands the cell.

Step 01

Wave plan

Plan station expansion in controlled waves — a plan is guidance for humans, not a command.

Inputs

  • FleetWorks station rollups
  • EvidenceWorks packets
  • SignedPacks status
  • Commissioning state
  • Risk register
  • Customer constraints
  • Rollback readiness

Proof generated

  • Wave plan receipt
  • Station scope
  • Required gates
  • Blocker list
  • Customer-review requirement

Where it appears in the app

  • RolloutWorks
  • FleetWorks
  • Commissioning
  • SignedPacks
  • CustomerTrust

AI Sense support

  • Suggests a rollout order
  • Identifies blocked stations
  • Explains the required proof before a wave

Safety boundary

  • A wave plan cannot promote a station or command hardware.

Step 02

Gate results

Each station in a wave is evaluated against the full gate set — pass for review, hold, or blocked.

Inputs

  • Evidence completeness
  • Coverage completeness
  • Commissioning status
  • Signed-pack compatibility
  • Known-bad coverage
  • Escape risk
  • False-reject risk
  • Rollback readiness
  • Customer-review requirement
  • Local-authority status

Proof generated

  • Gate result receipt
  • Pass / hold / blocked state
  • Evidence references
  • Reason codes

Where it appears in the app

  • RolloutWorks
  • EvidenceWorks
  • SignedPacks
  • Commissioning

AI Sense support

  • Explains why a station passed, held, or blocked
  • Flags a missing gate input
  • Ranks which station needs a human look first

Safety boundary

  • Gate results cannot override a safety block or force readiness.

Step 03

Hold point

A hold point pauses expansion for a station until its blockers are resolved by a human.

Inputs

  • Lighting drift
  • Known-bad miss
  • Coverage completeness
  • Escape candidate state
  • Customer-review requirement
  • Rollback readiness
  • Signed-pack compatibility
  • Recovery-lock state

Proof generated

  • Hold-point receipt
  • Blocker list
  • Owner role
  • Required evidence
  • Review deadline

Where it appears in the app

  • RolloutWorks
  • FleetWorks
  • AI Sense
  • CustomerTrust

AI Sense support

  • Groups hold reasons
  • Recommends the human checks to clear a hold
  • Explains each hold severity

Safety boundary

  • A hold point cannot clear recovery, approve production, or hide a risk.

Step 04

Risk register

Rollout risk stays visible until resolved or formally reviewed — no risk is accepted automatically.

Inputs

  • Known-bad miss events
  • Coverage blockers
  • Escape candidates
  • False-reject clusters
  • PLC route mismatches
  • Commissioning gaps
  • Signed-pack blockers
  • Rollback gaps
  • Customer-review gaps
  • Audit-chain issues

Proof generated

  • Risk entry receipt
  • Severity
  • Evidence references
  • Owner role
  • Status

Where it appears in the app

  • RolloutWorks
  • FleetWorks
  • Governance
  • CustomerTrust

AI Sense support

  • Detects repeated rollout risks
  • Flags unsupported risk acceptance
  • Explains each risk severity

Safety boundary

  • The risk register cannot accept risk automatically or erase a blocker.

Step 05

Rollback readiness

No controlled-use rollout without rollback readiness — a verified path back to the previous safe state.

Inputs

  • Previous pack reference
  • Rollback owner
  • Rollback trigger
  • Rollback evidence requirement
  • Customer communication plan
  • Deadline
  • Receipt chain

Proof generated

  • Rollback readiness receipt
  • Previous-version hash
  • Rollback path verification
  • Omissions list

Where it appears in the app

  • RolloutWorks
  • SignedPacks
  • Improvements
  • Trust

AI Sense support

  • Flags a missing rollback owner
  • Flags a stale rollback reference
  • Flags missing rollback evidence

Safety boundary

  • Rollback readiness does not execute a rollback or change station behavior.

Step 06

Hypercare plan

After rollout approval, a hypercare window watches risk signals and recommends human escalation.

Inputs

  • Drift
  • Escapes
  • False rejects
  • Coverage gaps
  • Recovery events
  • Support tickets
  • Review backlog
  • Station health

Proof generated

  • Hypercare plan
  • Watch window
  • Thresholds
  • Escalation rules
  • Support handoff references

Where it appears in the app

  • RolloutWorks
  • Ops metrics
  • SignalOps
  • AI Sense

AI Sense support

  • Detects early degradation
  • Recommends human escalation
  • Explains the watch thresholds

Safety boundary

  • Hypercare can recommend a hold or rollback review, but cannot command a hold or rollback.

Step 07

Decision log

Every rollout decision is append-only and reviewable — history is recorded, never erased.

Inputs

  • Wave events
  • Gate results
  • Hold points
  • Risk entries
  • Rollback-readiness records
  • Hypercare plans
  • Executive summaries
  • Actor role

Proof generated

  • Decision receipt
  • Actor role
  • Safe actor reference
  • Receipt hash
  • Previous hash
  • Timestamp

Where it appears in the app

  • RolloutWorks
  • Trust
  • Governance
  • CustomerTrust

AI Sense support

  • Flags a missing decision
  • Flags a broken chain
  • Flags a stale packet or unsupported claim

Safety boundary

  • The decision log records history. It cannot erase a prior decision.

Step 08

Executive summary

Executives see rollout health and next actions — not station control, and never a production approval.

Inputs

  • Wave status
  • Station recommendations
  • Open hold points
  • Top risks
  • Rollback readiness
  • Hypercare status
  • Known limitations

Proof generated

  • Executive summary
  • Omissions list
  • AI Sense summary
  • Summary hash

Where it appears in the app

  • RolloutWorks
  • CustomerTrust
  • SignalOps
  • Trust

AI Sense support

  • Creates customer-safe explanations
  • Removes unsupported claims
  • Highlights the next human checks

Safety boundary

  • The executive summary cannot approve production or change station authority.

AI Sense explains rollout risk, never approves

AI Sense

One reading layer across every RolloutWorks step

Observes evidence, finds missing proof, explains uncertainty, ranks human checks, and prepares handoffs — it never commands hardware.

Reads

  • Evidence bundles
  • Review events
  • QA decisions
  • Vision Twin drift
  • Commissioning blockers
  • Governance decisions
  • Station registry
  • Ops metrics

Produces

  • Findings
  • Evidence-gap warnings
  • Work-package hints
  • Commissioning questions
  • Support summaries

Never

  • No PLC writes
  • No force PASS
  • No recovery clear
  • No robot commands
  • No camera/light commands
  • No production approval
  • No evidence mutation
  • No QA decision mutation

AI Sense observes evidence and guides humans — it records nothing and changes nothing. It does not command a station, write a PLC, clear recovery, reset safety, force a pass, approve production, sign off, or mutate any review, QA decision, commissioning, governance, evidence, or runtime state. Every recommendation is a suggestion for a human to carry out; the PLC and safety circuit remain authoritative.

Customer-safe executive summary

Rollout health by reference, never station control

The redacted executive summary carries wave status, per-station recommendations, open hold points, ranked risks, rollback readiness, the hypercare status, and an explicit omissions list — so an executive can review rollout health without any station ever handing over raw internals or being commanded.

wave_status
wave lifecycle by reference — never a production approval
station_recommendations
per-station recommendation + blocker/warning trail
open_hold_points
holds that must be cleared by an owning role
top_risks
ranked risk-register entries (type + severity)
rollback_readiness
verified path back to the previous safe state
hypercare_status
watch window + signals watched after rollout
known_limitations
what the rollout view cannot know or control
omissions
explicit list of what was withheld
summary_hash
integrity fingerprint of the redacted summary

The summary never contains raw images or evidence frames, raw PLC coils or registers, private keys or signing secrets, authority tokens, camera, lighting, or robot command payloads, operator personal identity or local file paths.

Signed-in teams run this operationally in the HoldField app, under RolloutWorks — where rollout posture, the wave planner, the station gate matrix, hold points, the risk register, rollback readiness, the hypercare plan, an append-only decision log, and the redacted executive summary are recorded as administrative proof, and where every station stays the local authority: nothing here promotes, applies, activates, or commands a station. Open the workspace →

Second-site replication

From one station to the next — without losing control

HoldField turns a validated station into a repeatable rollout packet: machine template, evidence requirements, safety deltas, commissioning checklist, measured value, and open risks. Every new site still requires validation. The PLC controls. Safety protects. HoldField proves what changed.

  1. 1. Reusable station template

    A validated station becomes a template (machine I/O, evidence schema, operator console, commissioning checklist) — reusable only after site validation, never copied as production-ready.

  2. 2. Target-site comparison

    Line count, part family, PLC family, and safety system are profiled before anything moves; unknown target data fails closed.

  3. 3. Safety delta

    E-stop, STO, guard, and reset architecture are compared; a different or unknown safety boundary blocks live rollout planning.

  4. 4. Evidence delta

    Camera, gage, coverage, and receipt requirements are compared; reduced evidence can never support a stronger production claim.

  5. 5. Commissioning checklist

    The hardware, PLC, safety, station, and network deltas become the controls engineer’s revalidation checklist — FAT/SAT still required.

  6. 6. Measured value

    Escape reduction, review-time reduction, and audit completeness are tracked from a real baseline; without a cost basis no dollar figure is invented.

  7. 7. Open risks

    Safety-boundary, PLC, evidence, and rollback gaps are surfaced as expansion risks; a critical blocker can never be accepted away by software.

Deployment closeout & conversion

Deployment closeout — a buyer decision packet, not a production approval

Deployment closeout turns measured evidence, open risks, security readiness, deployment readiness, and support posture into a customer decision packet for expansion — without fabricating ROI or bypassing station gates.

  1. 1. Deployment closeout

    Closeout packages measured outcomes, acceptance status, open risks, and readiness into a customer decision packet — it never approves production or bypasses station gates.

  2. 2. Measured outcomes

    Value is computed only from measured or customer-provided inputs; with no cost baseline we show operational metrics, never a fabricated dollar figure.

  3. 3. Acceptance status

    Accepted, accepted-with-conditions, continue-shadow, needs-improvement, or blocked — an unresolved accepted escape or a known-bad miss forces blocked.

  4. 4. Open risks

    Every risk is surfaced with an owner and a mitigation; a safety or critical risk can never be accepted away or hidden.

  5. 5. Technical, security, deployment, support readiness

    Each station shows its own local readiness; simulator-only proof is never sold as hardware readiness, and closeout cannot upgrade readiness.

  6. 6. Expansion scope

    Sites, lines, and stations for the next phase, with unverified capabilities labeled by readiness and dry-run integrations labeled dry-run.

  7. 7. Commercial readiness gate

    Ready-for-proposal only when technical, security, support, and procurement evidence support it — a technical blocker always blocks the gate.

  8. 8. Proposal inputs

    Structured scope, responsibilities, assumptions, and pricing assumptions for a future proposal — not a binding contract and not an invoice.

  9. 9. Customer decision packet

    What was proven, what was not proven, open risks, and the recommended next step — redacted, with no raw evidence and no fake ROI.