# L2 Audit — One-Way Cutover (d01 = X, d25 = Y)

[HARD] components: 4, 7, 9, 10

## Design X (d01)

| # | Component | Verdict | Note |
|---|-----------|---------|------|
| 1 | Dependency discovery (active surfacing) | COVERED | Instruments outbound interfaces, logs consumers over full cycle; explicitly distrusts inventory. |
| 2 | Dependency map + criticality classification | COVERED | Maps/accounts for every consumer and blocks on unresolved; criticality ranking only implicit (weakest part). |
| 3 | Owner assignment for critical deps | MISSING | No named accountable owner per dependency; only "don't let staff disperse." |
| 4 | Discovery-completeness / residual-unknown [HARD] | COVERED | "Do not trust any inventory as complete"; designs for misses; blocks switch on unaccounted consumers. |
| 5 | Parallel-run / shadow operation | COVERED | True shadow run with continuous output diffing, old in control. |
| 6 | Readiness criteria + verification | COVERED | Explicit per-stage go/no-go criteria + signed verification checklist. |
| 7 | Point-of-no-return marker + decouple shutdown [HARD] | COVERED | Decommission/reclaim explicitly separated and held later; old kept warm/recoverable. |
| 8 | Bounded / staged exposure | COVERED | Graded stages, smallest least-critical slice first, then widen. |
| 9 | Post-cutover monitoring for missed dep [HARD] | COVERED | Asserts expected activity ("report by 06:00"), alarms on absence not just error. |
| 10 | Fallback path with explicit triggers [HARD] | COVERED | Explicit rollback triggers + rehearsed/tested rollback (false-optionality trap addressed). |
| 11 | Reversibility / rollback-residue assessment | MISSING | No account of what revert would NOT restore (new-system data, state drift). |
| 12 | Decision authority + finality gate | COVERED | Hard interlock + named owner's explicit authorization before reclaim. |
| 13 | Finality record | COVERED | Signed authorization + checklist + dependency-closure status captured at the gate. |

**X total: 11/13 covered. HARD: 4/4 covered.**

## Design Y (d25)

| # | Component | Verdict | Note |
|---|-----------|---------|------|
| 1 | Dependency discovery (active surfacing) | COVERED | Network/log monitoring, "what would stop working" interviews, FMEA, contracts/SLAs. |
| 2 | Dependency map + criticality classification | COVERED | Dependency matrix; records tool/function/criticality(min-hr-day)/owner. |
| 3 | Owner assignment for critical deps | COVERED | Records responsible person/team; owner sign-off at each gate. |
| 4 | Discovery-completeness / residual-unknown [HARD] | COVERED | "Matrix will be incomplete"; unknowns = high-criticality; gates protect against surprises. |
| 5 | Parallel-run / shadow operation | COVERED | Parallel running with continuous comparison; "silent divergence is the enemy." |
| 6 | Readiness criteria + verification | COVERED | Phase-gate reviews, reconciliation, explicit thresholds before advancing. |
| 7 | Point-of-no-return marker + decouple shutdown [HARD] | COVERED | 100% then warm-standby 30d, cold-standby 6mo, then reclaim; decoupled from go-live. |
| 8 | Bounded / staged exposure | COVERED | Canary 5/25/75/100 phased traffic cutover. |
| 9 | Post-cutover monitoring for missed dep [HARD] | COVERED | Per-dependency health status + owner-reported incidents; less absence/detection-budget focus than X. |
| 10 | Fallback path with explicit triggers [HARD] | COVERED | Explicit abort thresholds, automatic at threshold, revert to live 100% old system. |
| 11 | Reversibility / rollback-residue assessment | MISSING | No account of what revert would NOT undo (parallel-run data drift, switched consumers). |
| 12 | Decision authority + finality gate | COVERED | Cross-functional gate sign-off before reversibility ends (Operating Rule 1). |
| 13 | Finality record | MISSING | Only retrospective lessons-learned; no authority/evidence/closure/fallback basis captured at cutover. |

**Y total: 11/13 covered. HARD: 4/4 covered.**
