Anatomy of an Aegis risk note.

It's the single critical document every release through Aegis generates for the on-call engineer to review. It covers the change's risk class, blast radius, rollback target, the evals that ran, and the one thing to watch during the release. The note is built so the on-call can read it top to bottom and know exactly how hard to scrutinize the release and what to do if it goes wrong.

Low means reversible with no data migration. Medium means reversible but with a coordination cost. High means there's a one-way door somewhere in the change, and the note says exactly where. The class comes first because it sets how hard you read the rest. Aegis assigns a draft class from the diff; a human can raise it but never silently lower it.

Blast radius answers who feels it if the change is wrong—one service, region, and read path is a very different night from every customer at once. The rollback target is a specific named prior build the on-call can pin in under ninety seconds, not a vague 'revert.' As the post puts it, a rollback target you have to go find at 2am is not a target, it's a wish.

Aegis assigns a draft class from the diff as a safety baseline. Allowing a silent downgrade would let a risky change be quietly reclassified as safe, defeating the note's purpose. Humans can raise the class when they know something the diff doesn't, but lowering it can't happen silently—preserving the integrity of how hard the on-call reads the rest of the note.

It lists each eval suite and its verdict—regression, safety probes, latency budget. This is the part AI generates and the part people trust least until they've watched it catch something. Nothing in it is a summary judgment; it's the receipts. The on-call sees the actual suites and outcomes rather than a single pass/fail blessing.

A single sentence the on-call should hold in their head for the next thirty minutes—one metric, one window, one wired alert, not a dashboard. Every note ends with it. The discipline is strict: if the team can't name the one thing to watch, the release isn't ready to ship.

It must be a specific, named prior release that the on-call can pin in under ninety seconds—not the instruction to 'revert.' The point is speed and certainty under pressure: a rollback target you have to go hunt for at 2am isn't a target, it's a wish. Naming the exact build ahead of time is what makes recovery fast when a release goes wrong.