main main
What runs in production, and nothing else.
- Cut from
- Never cut; receives only
- Merges in
- release/* and hotfix/*
- Lives
- Forever
- No direct pushes, no force pushes
- Every merge is tagged and signed
- Deployable at every commit
M37LabsDelivery protocol
Every changeis a specimen.
At M37Labs a change is sealed once, proven in the open and released by degrees.
Scroll to send it through the protocol
Build once, promote it
Every environment installs the same sealed specimen, checked by its fingerprint.
Gates decide, agents advise
AI agents read every change. Only deterministic gates can block it.
No stored keys
The pipeline borrows short-lived identity. Runtime secrets never leave the host.
Every outcome explained
Pass or fail, ECHO says which stage broke, why, and what is live now.
M37-00
Genome
How branches are born, where they may merge and how long they may live. GitFlow, with one extra rule for side branches. A branch that breaks these rules never reaches the airlock.
main
develop develop
Where finished features meet each other.
- Cut from
- main, once
- Merges in
- feature/*, plus back-merges from release and hotfix
- Lives
- Forever
- Stays green; a red develop stops all merges
- Every merge deploys to PROVING GROUND
- Rescanned nightly for new advisories
Feature feature/<TICKET>-slug
One ticket's worth of work.
- Cut from
- develop
- Merges into
- develop, by squash, through the airlock
- Lives
- Five working days at most
- Rebase on develop daily
- Unfinished work ships dark behind a flag
- Deleted on merge
Side side/<feature>/topic
A spike, an experiment or pair work that hangs off one feature.
- Cut from
- A feature branch only
- Merges into
- Its parent feature, never develop or main
- Lives
- Two days, and never longer than its parent
- Never deployed anywhere
- If the spike becomes real work, re-cut it as a feature
- Dies with its parent
Release release/x.y
A frozen candidate, getting ready to go out.
- Cut from
- develop, when scope freezes
- Merges into
- main (tag x.y.0) and back into develop
- Lives
- Days, not weeks
- Fixes, version bump and changelog only
- Runs as a release candidate on PROVING GROUND
- No new features, ever
Hotfix hotfix/x.y.z
One urgent fix to what is live.
- Cut from
- The live tag on main
- Merges into
- main (patch tag), develop and any open release
- Lives
- Hours
- Passes the same gates; urgency skips nothing
- One fix per branch
- A missing back-merge is a future regression
feature/*A preview environment, removed on merge
developPROVING GROUND, on every merge
release/*Release candidate on PROVING GROUND
main + tagIGNITION, then a rollout mode
M37-01 to 09
The protocol
Nine chambers. The specimen moves on only when the chamber it is in passes. The dotted line beside the tube is ECHO: every chamber reports its outcome to it.
M37-01your machine
Bench
Hooks that catch problems before they leave your laptop.
- Format and lint run on the files you are committing.
- Secret sniff checks every commit for keys and tokens.
- Branch name is checked against Genome before the first push.
- Pre-push runs the same CI script the server runs, so CI is never the first to know.
WatchHooks can be skipped with a flag. Bench is a convenience; the airlock is the rule.
M37-02pull request
Airlock
Four blocking gates run in parallel. If any one fails, the door stays shut.
QualityPassed
Lint, types, tests, a coverage floor, and a migration linter.
Sealed
Supply chainPassed
Known vulnerabilities with a fix, a licence allow-list, and new packages flagged.
Sealed
Secrets and codePassed
Every commit in the PR scanned, plus static analysis for injection and unsafe calls.
Sealed
TraceabilityPassed
A ticket key in the title, and a branch that targets the base its type allows.
Sealed
WatchA secret deleted in a later commit is still in the PR. Scan the whole range, not the final diff.
M37-03agent review, alongside the airlock
Swarm
A team of AI agents reads the change the way a careful senior reviewer would.
Smell Hunter
Flags long functions, duplication, dead code and complexity spikes in the diff.
Dependency Warden
Reads the lockfile diff for CVEs, typosquats, install scripts, licence drift and very new releases.
Secret Hound
Walks every commit, config file and fixture for anything that looks like a credential.
Test Critic
Finds changed lines that no test runs and proposes the missing cases.
Schema Auditor
Reads migrations for destructive, locking or irreversible operations.
Pipeline Inspector
Reviews CI changes for injected input, unpinned actions and broad permissions.
Scribe
Writes the changelog entry and, when something fails, the plain-language reason.
Agents advise. Gates decide. Agents comment and triage. They run read-only, hold no secrets, and cannot approve, merge or push.
WatchTreat PR text as untrusted input. A description can carry instructions aimed at the agents.
M37-04review and merge
Concord
People sign off. A ruleset enforces who must sign and how the merge happens.
- Code owners must review lockfiles, CI config and infrastructure.
- One approval from someone other than the author.
- Up to date with its target, and every required gate green on the latest commit.
- Squash into develop; merge commits into main, so release history stays readable.
WatchApprovals go stale. A push after approval needs a fresh review.
M37-05build, once
Crucible
One artifact is built from the merge commit. Every environment gets this exact one.
- Clean build on a fresh runner, from the merge commit only.
- Locked installs: every dependency checked against its lockfile hash, install scripts off.
- Version stamped into the artifact, so it can always say what it is.
- No environment config baked in; settings arrive at install time.
WatchIf staging and production build separately, staging proved nothing about production.
M37-06seal
Sigil
The specimen gets a fingerprint, a parts list and a signature.
Fingerprint9f3c1ab47e0d52c8a1f6b39e7d24c0a85b1e6f73d29a4c08e5b7f1d36a92c4e1
Parts listSoftware bill of materials, every package and version
ProvenanceWhich commit, which run, which builder
Path guardNo env files, keys or real data inside
WatchA fingerprint only helps if every install checks it. Verify before you unpack.
M37-07artifact store
Vault
Immutable and versioned, addressed by commit. Nothing is ever overwritten.
- Write once: a specimen, its fingerprint and parts list, stored under its commit.
- Short-lived links: hosts pull with a link that expires in minutes.
- Pull, never push: CI asks a host to fetch; it never opens a shell on one.
- Lifecycle rules keep recent releases and expire the rest.
WatchKeep at least the last few releases. Recall needs something to go back to.
M37-08staging
Proving Ground
The sealed specimen is installed on a production-shaped environment and smoke-tested hard.
- Verify the fingerprint, then take the deploy lock.
- Back up, then migrate, adding to the schema only.
- Switch and restart, letting workers finish their current jobs.
- Health check must report the new version, not just a 200.
- Smoke test: sign-in, one write, one background job round-trip.
- Any failure triggers RECALL to the previous release, and ECHO says why.
WatchRolling back code does not roll back the schema. Migrations must keep the old release working.
M37-09release
Ignition
A release manager signs the tag. The specimen that passed the proving ground is promoted unchanged.
- Release candidate has soaked on the proving ground.
- Signed tag on main, pushed by a role the ruleset allows.
- Window and on-call confirmed, with no other change in flight.
- Rollout mode chosen: Kestrel, Twin Suns or Tide.
WatchNever rebuild for production. If the fingerprint differs from staging, stop.
M37-10
Three ways to light it
Ignition hands the sealed specimen to one of three rollout modes. Each one is watched by Black Box and can be reversed by Recall with nobody at the keyboard.
Kestrel
canary release
One new instance takes a small slice of real traffic. It is compared with the old fleet over the same minutes, and then promoted or recalled.
- Compare the canary with the baseline right now, not with yesterday.
- No verdict until it has seen a minimum number of requests.
- Error rate or latency over the line recalls it automatically.
Best for services with steady traffic and real users to learn from.
0%
waiting for ignition
Twin Suns
blue/green deployment
The new version runs beside the old one at full size. It is tested privately, then the router moves all traffic in one switch.
- Green is warmed and smoke-tested before it sees a single user.
- Blue stays running, so switching back takes seconds.
- Both colours share one database, so the schema must serve both.
Best when you need an instant, all-at-once switch and can pay for double capacity.
0% on green
blue is live
Tide
progressive, rate-based rollout
The share of traffic on the new version rises in steps, 10%, 20%, 50%, then 100%, holding at each step until the numbers say go.
- Each step holds for a set time and must pass its health checks.
- Route by a hash of the user, so each person stays on one version.
- A failed check drops the tide to 0%, not back one step.
Best for large or risky changes where you want exposure to grow with evidence.
0% on new
all traffic on current
Black Box
Records error rate, latency, saturation and one business signal for the new version, side by side with the old.
Recall
Reverses a rollout automatically when Black Box sees a signal cross its line, then hands the reason to Echo.
Echo
Reports every outcome: the stage, the exact error, a redacted log tail and which version is live now.
Caveats
Fault lines
Where good pipelines still go wrong. Each of these has caught out a team that thought it was covered.
Branching
- Long-lived branches rot.Past five days, merge pain grows faster than the feature. Split it, or ship it dark behind a flag.
- Side branches never target develop.A side branch that skips its parent skips the review of the feature it belongs to.
- Hotfixes must flow back.A fix merged to main but not to develop returns as a regression in the next release.
- A release branch is a freeze.Any new feature on release/* restarts the testing clock.
Gates and agents
- Agents can be confidently wrong.They invent findings and miss real ones. Treat them as a second reviewer, never as the gate.
- Scanners only know published problems.A hijacked package has no advisory on day one. The release cooldown and the install-script block are what stop it.
- Flaky tests teach people to retry.Quarantine a flaky test with an owner and an expiry date, or delete it.
- Pin CI actions to a commit.A version tag can be moved to malicious code by whoever controls it.
- A deleted secret is still leaked.It lives on in history and forks. Rotate it first, then clean up.
Build and artifact
- Rebuilding per environment breaks the promise.Two builds from one commit can still differ.
- Config is not part of the artifact.Bake settings in and you need one build per environment again.
- Caches outlive versions.Key caches and static assets by version, or the new code reads the old shape.
Data
- Rollback reverts code, not schema.Expand, then contract: add in one release, remove in a later one.
- Backfills are not migrations.Run them as separate, resumable jobs, so a deploy never waits on a table scan.
- Queued jobs outlive deploys.A job written by the old version may be read by the new one. Keep payloads backward compatible.
Rollout
- A quiet canary proves nothing.Set a minimum request count before any verdict.
- Blue/green doubles more than servers.Caches, connections and the shared database see both colours at once.
- Percentages need sticky routing.Without user-hash routing, a person flips between versions on every click.
- Long connections don't follow the switch.Websockets and streams stay on the old version until drained.
- A 200 after rollback can lie.Health must report which version is answering.
Operations
- Two deploys at once corrupt state.Lock the host, and never cancel a deploy mid-flight.
- Cancelled is not stopped.A cancelled CI job can leave remote commands still running.
- Alert on change, not on every run.A pipeline that emails every green build gets filtered out.
- Flags are debt with interest.Every flag gets an owner and a removal date.
Glossary
Codex
Every name on this page, in one line.
- Specimenthe artifact
- The one sealed build of a change; it is never rebuilt and never edited.
- GenomeM37-00 · branching
- GitFlow plus side branches: where branches come from, where they go, how long they live.
- BenchM37-01 · local hooks
- Format, lint and secret checks on your laptop before anything is pushed.
- AirlockM37-02 · PR gates
- Four parallel gates that block a merge until every one is green.
- SwarmM37-03 · AI review
- Seven read-only agents that hunt smells, risky packages, secrets and missing tests.
- ConcordM37-04 · merge
- Human approval and a ruleset that decides who may merge, and how.
- CrucibleM37-05 · build
- Builds the specimen once, from the merge commit, with locked dependencies.
- SigilM37-06 · seal
- Fingerprint, parts list and provenance, so every install can prove what it got.
- VaultM37-07 · artifact store
- Write-once storage that hands hosts short-lived download links.
- Proving GroundM37-08 · staging
- A production-shaped install with a deploy lock, a backup, migrations and smoke tests.
- IgnitionM37-09 · release
- A signed tag that promotes the proven specimen and picks a rollout mode.
- KestrelM37-10 · canary
- A small slice of real traffic on one new instance, compared live with the old fleet.
- Twin SunsM37-10 · blue/green
- A full second environment, tested privately, then switched in one move.
- TideM37-10 · progressive
- Traffic share that rises 10%, 20%, 50%, 100%, with a hold and a health check at each step.
- Black Boxobservability
- Records the new version's vital signs next to the old version's.
- Recallautomatic rollback
- Puts the previous release back when a signal crosses its line.
- Echonotifications
- One report per run, with the stage, the error and what is live now.