LEARN. PRACTICE. GROW.Pin the candidate bundle
An integration change can combine schema, profile, external list, mapping, configuration, and code. Identify each artifact and its link to applicable tests. Fictional bundle S1,M1,L1 passed; replacing M1 with M2 produces another bundle even if filenames remain unchanged. Describing the change as fixing a name does not prove absence of impact. The PM requests difference analysis, affected consumers, and applicable tests before deciding. A hash helps establish byte identity; it does not establish that those bytes are correct. Technical evidence and authorized approval remain distinct conditions.
Cover directions and partners
Build a matrix containing community, direction, contract, version, and outcome. In the example, A-in,A-out,B-in,B-out are four distinct obligations. Three positive outcomes do not cover the fourth direction. Repeating A-in does not fill B-out either. A failed result is execution evidence but not approval of that condition. The small model compares passed routes for the exact bundle against the required set; it estimates no statistical confidence. In an international team, this matrix explains why tests with one partner do not automatically authorize another. Also define who validates each community contract and confirms its adoption window.
Compare without multiplying effects
A shadow comparison can run the new adapter over synthetic inputs or authorized copies while retaining data controls. The comparison copy should not gain authority to emit a second instruction. Define the output boundary and demonstrate its suppression in the rehearsal environment. Compare fields, references, rejections, and expected outcomes, rather than runtime alone. If a pilot has valid headers but rising functional rejection, investigate before expansion when that outcome forms part of agreed criteria. More volume does not itself repair the contract. The exercise proposes this design but executes neither a banking system nor a real pilot.
Reserve recovery time
The fictional plan has ninety minutes. Rollback needs fifteen and subsequent reconciliation ten, without overlap. The latest decision point preserving that reserve is minute 65. Deciding at minute 60 leaves five minutes of margin; at minute 70 there is already a five-minute shortfall. These calculations depend on supplied durations and are not production forecasts. A real plan needs observed timings, uncertainty, impact, and authority to revise the window. Restoring a binary does not erase emitted messages or external effects. Include data compatibility, identification of in-flight items, and functional confirmation before declaring complete recovery.
Rehearse the out-of-hours decision
The guide below takes forty-five minutes and uses PM, APS, and functional-owner roles. Start with the matrix, introduce M2 after approval, and request a documented decision. Add functional rejection at minute 60 and again at minute 70. The group should explain impact, alternatives, decision owner, and next update in English. No response should invent an approval still missing. If authors will be unavailable during the window, the shift needs to demonstrate configuration selection, diagnosis, and escalation. Individual practice is useful but does not constitute independent acceptance by an operations team.
Close without hiding outstanding work
At closure, separate service availability, functional processing, and reconciliation. A green health check does not resolve unknown responses. The summary should identify outstanding items, owners, deadlines, impact, and completion criteria; accepting exposure requires appropriate authority. Preserve the actually activated combination and available evidence, including failures. Approval of the local exercise is not approval to execute a banking change. As the learning deliverable, produce the matrix, timeline, English decision note, and list of evidence still needed. Ask another participant to reconstruct the decision; record that review only if it actually occurred.
DR original workshop / Oficina original DR: 45 minutes
Fictional release exercise. No authorization to send real messages or execute a banking change.
Exercício fictício de release. Sem autorização para enviar mensagens reais ou executar mudanças bancárias.
0-10 min: Build the matrix / Construir a matriz
Required routes: A-in, A-out, B-in, B-out.
Candidate: schema S1, mapping M1, external list L1.
Evidence: A-in pass; A-out pass; B-in pass; B-out missing.
State the gap before deciding. / Identificar a lacuna antes de decidir.
10-20 min: Change the candidate / Alterar o candidato
Supplier replaces M1 with M2 after rehearsal.
List affected rules, consumers, regression cases and approval dependencies.
Listar regras, consumidores, casos de regressão e aprovações afetados.
A filename is not a content hash; a hash is not proof of correctness.
Um nome não é hash do conteúdo; um hash não prova correção.
20-35 min: Timeline / Cronologia
Window: 90 minutes. Rollback: 15. Reconciliation after rollback: 10.
Decision minute 60: 5 minutes remain after reserved work.
Decision minute 65: arithmetic boundary, no remaining reserve.
Decision minute 70: 5-minute shortfall before any further waiting.
Prepare an English decision note:
Observed evidence:...
Known gap and impact:...
Options and recovery implications:...
Authorized decision owner:...
Next update and required evidence:...
35-45 min: Handover / Passagem ao turno
Another participant identifies B's configuration and escalation owner.
Outro participante identifica configuração de B e responsável de escalada.
Keep pending outcomes visible. Record a peer review only if it happened.
Manter pendentes visíveis. Registar revisão por outro participante apenas se ocorreu.
Deliver matrix, bundle identity, timeline, decision and unresolved evidence.
Entregar matriz, identidade do pacote, cronologia, decisão e evidência pendente.
Case: at minute 70, twenty minutes remain while recovery needs twenty-five. The PM should state the deviation and obtain an authorized decision on the revised plan.
Common pitfalls
Same filename treated as same version; one-direction tests treated as bilateral coverage; code rollback treated as effect reversal; calendar entry treated as approval.
Related topics: Messages, headers, and states · Versions, extensions, and interoperability · Testing, diagnosis, and operations
Accept the actually tested and authorized bundle, with per-flow coverage, feasible recovery, and owners able to operate during the window.
Reference: Release Engineering · BigSavant ISO20022 fundamentals professional assessment2026.10