Project: retire a receipt model without breaking batch or audit

Last updated: 6 Oct 20265 min read

project

Move consumers off an old receipt model, resolve an affected data lineage case and retain only justified evidence.

Define the retirement target

The receipt endpoint now serves model r8, while r7 remains in a nightly batch definition and a rollback alias. A source receipt in r7’s training snapshot has an active deletion request. Inventory deployed aliases, scheduled jobs, stored outputs, training snapshots and evaluation reports by digest. Consumer inventory must find both visible and latent uses before any package is removed.

Stage a safe replacement

Move the nightly job to an approved replacement and test the same input partition. Choose a new rollback target that loads under the current feature contract; do not remove r7 until a recovery drill passes. For the deletion case, trace the source through online features, batch output and the training snapshot. Apply the relevant data policy to each derivative and record whether a new model must be trained. Derivative lineage identifies affected artifacts but leaves policy decisions explicit.

Verify absence and preservation

Scan job definitions and observed requests for r7, run a grace period with no uses and confirm old operational outputs have been withdrawn or superseded. Keep a minimal manifest and decision ledger when a valid audit obligation remains, while removing unnecessary raw payload copies. Test a backfill that reads an old snapshot; the withdrawn receipt must not reappear. A comparison-only historical replay may still need controlled access to r7 until its retention window ends.

Issue the retirement decision

Report each consumer’s replacement, last observed use, rollback drill result, lineage actions and retention hold. The outcome may be “stop serving but retain artifact” rather than deletion. If the hidden nightly job still points to r7, the gate must hold. Only a separately authorized cleanup step should delete the package after the evidence and rollback windows close.

Implementation

def retirement_review(active_consumers, rollback_ready,
                      lineage_resolved, evidence_hold):
    if active_consumers:
        return {"state": "hold", "reason": "consumer-remains"}
    if not rollback_ready:
        return {"state": "hold", "reason": "rollback-not-ready"}
    if not lineage_resolved:
        return {"state": "hold", "reason": "lineage-open"}
    if evidence_hold:
        return {"state": "retire-serving-retain-artifact"}
    return {"state": "eligible-for-cleanup-review"}

assert retirement_review(["nightly-receipts"], True, True, False)[
    "state"] == "hold"
assert retirement_review([], True, True, True)[
    "state"] == "retire-serving-retain-artifact"

Performance and operating cost

The final state check is O(1) aside from holding the consumer list. Inventory scans, lineage traversal and observed-use windows require storage and operational time. “Eligible for cleanup review” is deliberately not a delete command; package deletion should be a separately authorized action with a tested recovery path.

Common Mistakes

Deleting r7 while the nightly batch still pins it.
Moving the rollback alias without proving the successor loads.
Assuming source deletion resolved every derived copy.
Treating an audit hold as permission to retain all raw receipts without limit.