Phase 6 · Learn
The signal that writes the next requirement.
The control held. Production shows what it cost — and that cost becomes the next story.
1 · Requirements → 2 · Development → 3 · QA → 4 · Release → The screen it builds → 5 · Observability → 6 · Documentation
Arrived from Release, promoted and green.
← See the gate that cleared itStory NP-AUTH-321 shipped on build 2026.8.17-rc5 with the consent fix. All four controls passed the gate. Fourteen days of production have run since.
AUTH-PASS-016 ✓AUTH-PASS-017 ✓PRIV-CHILD-001 ✓A11Y-BASE-001 ✓NP Observability & LearningSRE workspace · family-wishlist · local demo
Verified operations session
● Signed inRole: SRE on callService: family-wishlistWindow: 14 days post-release
1 · ObserveSignals against an agreed SLO.
2 · DetectBurn rate, not a CPU graph.
3 · DiagnoseCorrelate to the change.
4 · Feed backThe signal drafts a story.
Four signals, agreed with the business before release. Two of them are compliance measures and two are product measures — because a change can be perfectly lawful and still be going badly.
SLO · wish completion ≥ 92% over 28 daysError budget: 4% consumed
The error budget governs release pace. Burn it, and the next change waits.
SLO burn alert · family-wishlist · wish-completion
Budget consumed at 4.9× the sustainable rate. Symptom-based, tied to an outcome a parent would recognise — not to a server metric.
Paged: SRE on call · Notified: story owner, product manager · Runbook: RB-WISH-07The fix QA demanded is working exactly as specified. Drafts are held in session memory until the guardian consent entry exists, so nothing child-linked is ever written early. That part is not in question.
SIGNAL wish-completion-rate · family-wishlist · 14d slo_target 0.920 observed 0.864 ▼ 5.7pp since release budget_burn 68% (14 of 28 days elapsed) correlated series consent_pending_expired 0/day → 412/day session_draft_ttl 1800s (30 minutes) median_guardian_consent 2h 41m (email round trip) ✓ PRIV-CHILD-001 holding — child_linked_rows_before_consent = 0 ✗ product cost — 412 wishes/day typed, then lost before consent completed conclusion: the control is correct; the storage decision behind it is not
A guardian types a wish, goes to their email to confirm consent, and takes two hours and forty-one minutes to come back. The draft lives for thirty minutes. Nobody broke a rule. Four hundred children's wishes a day are being lost anyway.
Nothing is measured; the series are scripted to show the loop closing.
NP-AUTH-338StoryProposed · awaiting approval
Durable, unlinked draft storage before guardian consent
Epic linkNP-FAMILY-042
Raised byProduction signal · SLO burn
Sourcewish-completion-rate
ApproversProduct · Privacy · DPO
SupersedesSession-memory fix in NP-AUTH-321
Story points8
Description
As a parent, I want the wish I typed to still be there when I come back from confirming consent, so that a slow email does not cost my child their wish.
Acceptance criteria
- Given guardian consent has not completed, when a wish draft is saved, then it persists for seven days carrying no child-linked identifier.
- Given consent completes, when the draft is claimed, then it is linked to the family record and the unlinked copy is deleted in the same transaction.
- Given consent does not complete within seven days, when the retention job runs, then the draft is erased and the event is logged without child data.
Attached controls
PRIV-CHILD-001PRIV-RETAIN-014 · proposedA11Y-BASE-001
Why this exists
Raised by production, not by a planning meeting. The evidence is attached to the story: the burn chart, the correlated series, and the fourteen-day window that produced them.
Rendered locally. Proposed, not approved — named people still decide whether this is the right answer.Take it to the Requirements Lab →
Before the thread restarts, the record has to catch up.
On to Documentation →The alert named runbook RB-WISH-07, and the runbook was wrong. A new story cannot enter Requirements carrying evidence while the documents behind it still describe something that was never built.
The point of the phase: a lifecycle is only living if production can write the next requirement. The control held. The experience did not. Both are facts, and both belong in the same system.
* The production workbench is internal — reachable over the corporate VPN only. This public page is a local demonstration.