Skip to content
HoldField

RolloutWorks

Evidence-backed waves, not remote control

Coordinate rollout waves, hold points, risks, approvals, rollback readiness, and hypercare while each station remains the local authority — no station is promoted automatically and nothing here commands the cell.

Step 01

Wave plan

Plan station expansion in controlled waves — a plan is guidance for humans, not a command.

Inputs

  • FleetWorks station rollups
  • EvidenceWorks packets
  • SignedPacks status
  • Commissioning state
  • Risk register
  • Customer constraints
  • Rollback readiness

Proof generated

  • Wave plan receipt
  • Station scope
  • Required gates
  • Blocker list
  • Customer-review requirement

Where it appears in the app

  • RolloutWorks
  • FleetWorks
  • Commissioning
  • SignedPacks
  • CustomerTrust

AI Sense support

  • Suggests a rollout order
  • Identifies blocked stations
  • Explains the required proof before a wave

Safety boundary

  • A wave plan cannot promote a station or command hardware.

Step 02

Gate results

Each station in a wave is evaluated against the full gate set — pass for review, hold, or blocked.

Inputs

  • Evidence completeness
  • Coverage completeness
  • Commissioning status
  • Signed-pack compatibility
  • Known-bad coverage
  • Escape risk
  • False-reject risk
  • Rollback readiness
  • Customer-review requirement
  • Local-authority status

Proof generated

  • Gate result receipt
  • Pass / hold / blocked state
  • Evidence references
  • Reason codes

Where it appears in the app

  • RolloutWorks
  • EvidenceWorks
  • SignedPacks
  • Commissioning

AI Sense support

  • Explains why a station passed, held, or blocked
  • Flags a missing gate input
  • Ranks which station needs a human look first

Safety boundary

  • Gate results cannot override a safety block or force readiness.

Step 03

Hold point

A hold point pauses expansion for a station until its blockers are resolved by a human.

Inputs

  • Lighting drift
  • Known-bad miss
  • Coverage completeness
  • Escape candidate state
  • Customer-review requirement
  • Rollback readiness
  • Signed-pack compatibility
  • Recovery-lock state

Proof generated

  • Hold-point receipt
  • Blocker list
  • Owner role
  • Required evidence
  • Review deadline

Where it appears in the app

  • RolloutWorks
  • FleetWorks
  • AI Sense
  • CustomerTrust

AI Sense support

  • Groups hold reasons
  • Recommends the human checks to clear a hold
  • Explains each hold severity

Safety boundary

  • A hold point cannot clear recovery, approve production, or hide a risk.

Step 04

Risk register

Rollout risk stays visible until resolved or formally reviewed — no risk is accepted automatically.

Inputs

  • Known-bad miss events
  • Coverage blockers
  • Escape candidates
  • False-reject clusters
  • PLC route mismatches
  • Commissioning gaps
  • Signed-pack blockers
  • Rollback gaps
  • Customer-review gaps
  • Audit-chain issues

Proof generated

  • Risk entry receipt
  • Severity
  • Evidence references
  • Owner role
  • Status

Where it appears in the app

  • RolloutWorks
  • FleetWorks
  • Governance
  • CustomerTrust

AI Sense support

  • Detects repeated rollout risks
  • Flags unsupported risk acceptance
  • Explains each risk severity

Safety boundary

  • The risk register cannot accept risk automatically or erase a blocker.

Step 05

Rollback readiness

No controlled-use rollout without rollback readiness — a verified path back to the previous safe state.

Inputs

  • Previous pack reference
  • Rollback owner
  • Rollback trigger
  • Rollback evidence requirement
  • Customer communication plan
  • Deadline
  • Receipt chain

Proof generated

  • Rollback readiness receipt
  • Previous-version hash
  • Rollback path verification
  • Omissions list

Where it appears in the app

  • RolloutWorks
  • SignedPacks
  • Improvements
  • Trust

AI Sense support

  • Flags a missing rollback owner
  • Flags a stale rollback reference
  • Flags missing rollback evidence

Safety boundary

  • Rollback readiness does not execute a rollback or change station behavior.

Step 06

Hypercare plan

After rollout approval, a hypercare window watches risk signals and recommends human escalation.

Inputs

  • Drift
  • Escapes
  • False rejects
  • Coverage gaps
  • Recovery events
  • Support tickets
  • Review backlog
  • Station health

Proof generated

  • Hypercare plan
  • Watch window
  • Thresholds
  • Escalation rules
  • Support handoff references

Where it appears in the app

  • RolloutWorks
  • Ops metrics
  • SignalOps
  • AI Sense

AI Sense support

  • Detects early degradation
  • Recommends human escalation
  • Explains the watch thresholds

Safety boundary

  • Hypercare can recommend a hold or rollback review, but cannot command a hold or rollback.

Step 07

Decision log

Every rollout decision is append-only and reviewable — history is recorded, never erased.

Inputs

  • Wave events
  • Gate results
  • Hold points
  • Risk entries
  • Rollback-readiness records
  • Hypercare plans
  • Executive summaries
  • Actor role

Proof generated

  • Decision receipt
  • Actor role
  • Safe actor reference
  • Receipt hash
  • Previous hash
  • Timestamp

Where it appears in the app

  • RolloutWorks
  • Trust
  • Governance
  • CustomerTrust

AI Sense support

  • Flags a missing decision
  • Flags a broken chain
  • Flags a stale packet or unsupported claim

Safety boundary

  • The decision log records history. It cannot erase a prior decision.

Step 08

Executive summary

Executives see rollout health and next actions — not station control, and never a production approval.

Inputs

  • Wave status
  • Station recommendations
  • Open hold points
  • Top risks
  • Rollback readiness
  • Hypercare status
  • Known limitations

Proof generated

  • Executive summary
  • Omissions list
  • AI Sense summary
  • Summary hash

Where it appears in the app

  • RolloutWorks
  • CustomerTrust
  • SignalOps
  • Trust

AI Sense support

  • Creates customer-safe explanations
  • Removes unsupported claims
  • Highlights the next human checks

Safety boundary

  • The executive summary cannot approve production or change station authority.

AI Sense explains rollout risk, never approves

AI Sense

One reading layer across every RolloutWorks step

Observes evidence, finds missing proof, explains uncertainty, ranks human checks, and prepares handoffs — it never commands hardware.

Reads

  • Evidence bundles
  • Review events
  • QA decisions
  • Vision Twin drift
  • Commissioning blockers
  • Governance decisions
  • Station registry
  • Ops metrics

Produces

  • Findings
  • Evidence-gap warnings
  • Work-package hints
  • Commissioning questions
  • Support summaries

Never

  • No PLC writes
  • No force PASS
  • No recovery clear
  • No robot commands
  • No camera/light commands
  • No production approval
  • No evidence mutation
  • No QA decision mutation

AI Sense observes evidence and guides humans — it records nothing and changes nothing. It does not command a station, write a PLC, clear recovery, reset safety, force a pass, approve production, sign off, or mutate any review, QA decision, commissioning, governance, evidence, or runtime state. Every recommendation is a suggestion for a human to carry out; the PLC and safety circuit remain authoritative.

Customer-safe executive summary

Rollout health by reference, never station control

The redacted executive summary carries wave status, per-station recommendations, open hold points, ranked risks, rollback readiness, the hypercare status, and an explicit omissions list — so an executive can review rollout health without any station ever handing over raw internals or being commanded.

wave_status
wave lifecycle by reference — never a production approval
station_recommendations
per-station recommendation + blocker/warning trail
open_hold_points
holds that must be cleared by an owning role
top_risks
ranked risk-register entries (type + severity)
rollback_readiness
verified path back to the previous safe state
hypercare_status
watch window + signals watched after rollout
known_limitations
what the rollout view cannot know or control
omissions
explicit list of what was withheld
summary_hash
integrity fingerprint of the redacted summary

The summary never contains raw images or evidence frames, raw PLC coils or registers, private keys or signing secrets, authority tokens, camera, lighting, or robot command payloads, operator personal identity or local file paths.

Signed-in teams run this operationally in the HoldField app, under RolloutWorks — where rollout posture, the wave planner, the station gate matrix, hold points, the risk register, rollback readiness, the hypercare plan, an append-only decision log, and the redacted executive summary are recorded as administrative proof, and where every station stays the local authority: nothing here promotes, applies, activates, or commands a station. Open the workspace →