Service
Reading
Verdict
Next
Service
Not asked
Reading
Verdict
No answer yet
What broke?
Next
Staging is off until the server returns a rollback target.Mercury has not called its API yet, so it is claiming nothing.
Act on it
Governed rollback and handoff
-
01 Stage
Nothing staged. The Stage control on the board is live only when the answer carries a verified rollback target.
-
02 Confirm
Confirming is off until staging mints a single-use governance token.
-
03 Recorded only
No decision recorded yet.
Dispatcher not reported yet: the page has not read /health.
Evidence
Evidence behind the board
Without AWS credentials each metric series is generated locally from the service name, so these answers differ. A name that is not on this list is refused rather than given an invented reading.
Without a GitHub token, the commit named under a spike is the newest lone commit in Mercury's own git history, standing in for a deploy.
Incident evidence
Everything the correlator used to reach the answer on the board: the metric series and its baseline, the attribution window, the commit it landed on, and where each half of that came from. The rollback controls stay on the board, so the action is never buried; what Stage and Confirm answered lands in the first console, under the call that returned it.
Delivery velocity
DORA proxies computed from GitHub Actions runs and merged pull requests, and the open pull requests past the 36 hour review SLA. Every figure arrives from the API call named in the console header below.
Cloud spend
Month-to-date spend per service from Cost Explorer with day-over-average anomalies. Cost Explorer aggregates daily and lags up to 24 hours, so this never shows the last hour, and the response says so on screen.
How it answers: one change named, or none
-
01
Read the reading
The error rate now, against a baseline taken before the spike began.
-
02
Blame one change or none
A commit is named only when exactly one change landed in the window. Otherwise Mercury says it cannot attribute, and why. A refusal clears no deploy.
AttributedCannot attributeNothing to revertInsufficient data
-
03
Govern the rollback
Stage it, then confirm it with a single-use token. The dispatcher in use says whether anything left the building.
Who it is for: the team that owns an on-call rota and a TV in the room where incidents are worked. A team without the room can open this same page in a laptop browser, where the arrow keys and Enter do what the remote does. Who would pay: whoever owns that rota. Nobody has been asked yet, so that is a hypothesis, not a finding.
Connection
The API defaults to the origin this page was served from, so it is usually already right. The secret is MERCURY_ROLLBACK_SECRET: the server prints an ephemeral one at startup when the variable is unset.
Text fields are outside the D-pad ring, so the remote cannot get stuck in one.
The page has not called the API yet. The governance secret is sent as an Authorization: Bearer header on the two rollback calls only. Never stored.