Skip to content
GREEN FUTURETECH.
Explore

Research libraryThe Industrial Data Spine

Chapter 11 of 14 · Part III · Draft web edition

Validation and staged release keep models subordinate to operations

Release authority follows demonstrated local fitness, safe fallback and accountable acceptance, not a strong aggregate validation score.

Sections
8
Exhibits
5
Minutes
26
Sources
37
EX 47 · Missed defect share: Current baseline 26, Candidate in shadow 11. Difference -15 (illustrative index (0 to 100, lower is better))

The cloth is woven from this chapter's 5 exhibits: each weft is one exhibit's own data, normalised; each warp group is a section. The probe reads the exhibit's own value where it crosses. Procedural visualisation, not a measurement.

The chapter as a draft: 8 sections, 4 exhibit wefts, one shuttle.

Lead exhibit · 47Before and afterillustrativeCandidate improvement must survive comparison with current practice
020406080Defect review timeFalse intervention rateMissed defect shareOrder forecast errorException triage delay

Read-outDefect review time: Current baseline 68, Candidate in shadow 34. Difference -34 (illustrative index (0 to 100, lower is better))

Method and source

Illustrative shadow-validation comparison across five operational indicators. Values are constructed to demonstrate paired pre-release evaluation under S38 KPI definitions, S43 lifecycle evaluation and S1102 baseline sanity checks, not measured results from a GFT facility.

Unit: illustrative index (0 to 100, lower is better). Status: illustrative. Sources: S38, S43, S1102. Illustrative figures are teaching examples, not measured factory results.

The chapter's warpBar: share of the reading · square: an exhibit

Section 11.0 · Opening · 1 min · no exhibit of its own · one movement Go to section ↓

The chapter cloth9 warp groups · one pick per paragraph

This paragraph previews 11.4 · Local slices reveal aggregate success that hides failure

A machine-learning candidate that scores well on an offline test partition has not yet earned the right to alter factory work. Release is an operational change decision, not the automatic final step of a training script.[S11][S15] Promoting a model into production changes how inspectors examine cloth, how planners size buffers, or how supervisors allocate maintenance across shifts.[S43] Governing that change by a single aggregate accuracy figure exposes daily execution to unmeasured subgroup failures, false-alarm fatigue, silent pipeline defects and workflow dependency.[S19][S1101] Green Future Tech Limited (GFT), Hong Kong SAR, designed its three-part Cameroon textile programme (prepared 31 January 2024, with source-refresh notes retained in 2026) around the sector baseline in which about 95 percent of Cameroonian cotton fibre is exported raw and about 5 percent is processed locally, against a 50 percent local-processing target by 2030 (these inherited baseline entries were not refreshed in 2026 and their original publication dates are unrecorded).[R06][R07] Moving from raw-fibre export to competitive local spinning, weaving, dyeing and garment assembly requires decision tools that line managers trust under shop-floor constraints.[R06][S04] Validation and staged release keep every bought or locally trained model subordinate to operations through four controls: human-set thresholds tied to floor consequences, disaggregated validation across local slices, staged authority expansion from shadow mode to assisted operation, and rehearsed rollback to a known baseline.[S11][S16][S22]

Earlier chapters in this part established that a candidate enters development only after an operational decision, baseline and comparator are frozen, and that training becomes auditable only when code, dataset snapshots, feature definitions and execution lineage are recorded in a versioned registry.[S09][S15][S38] Those controls prove how a candidate was built, not that it is safe or useful on the floor.[S13][S1102] This chapter specifies the validation and release discipline that separates technical calculation from operational acceptance, prices the cost of wrong interventions, sequences deployment through conditional stages, and treats rollback and manual fallback as tested release artefacts.[S14][S15][S43]

11.12 min · 2 sub-steps · 1 exhibit

People set the acceptance metrics and thresholds

An automated pipeline can compute precision, recall, mean absolute error or calibration curves, but it cannot decide what an error costs on a weaving shed floor or in a cutting room.[S11][S38] The National Institute of Standards and Technology (NIST) Artificial Intelligence Risk Management Framework (AI RMF 1.0) states the rule directly: human judgement must be employed when choosing the specific metrics related to AI trustworthiness characteristics and the precise threshold values for those metrics.[S11] Delegating threshold selection to software defaults or to the developer who trained the model confuses mathematical convenience with operational risk appetite.[S11][S14] In a factory spine, the domain operating owner and designated risk owner set acceptance metrics and cut-off values jointly before validation begins, locking those thresholds into the evaluation protocol so they cannot be adjusted retroactively.[S02][S11][S15]

¶ 01 · 5 sources

…Risk Management Framework (AI RMF 1.0) states the rule directlyS11

Related · Exhibit 04 · chapter 01

S11S38S14S02S15

11.2 Consequence-weighted thresholds separate technical metrics from operational acceptance

11.2

Every industrial prediction error carries an asymmetric physical or commercial cost.[S11][S43] In fabric-defect detection, a false negative lets a stained or broken-pick roll pass into dyeing or cutting, multiplying wasted labour, dye liquor and cloth.[R29][S43] A false positive stops the frame or flags a clean roll for manual re-inspection, consuming operator minutes without destroying material.[R29][S38] In short-horizon demand forecasting, over-prediction ties up working capital in slow-moving greige cloth, whereas under-prediction triggers short shipments or overtime changeovers.[S38][S43] Because these consequences hit production, quality and commercial budgets, the accountable line manager defines the trade-off between missed events and false alarms.[S02][S11]

¶ 02 · 5 sources

S11S43R29S38S02

Setting human thresholds translates statistical scores into unit quantities managed under ISO 22400-2 indicator definitions.[S11][S38] An Area Under the Receiver Operating Characteristic curve (AUC) of 0.94 is not an operational threshold because a supervisor cannot staff around an abstract area score.[S38][S1102] An actionable threshold states required recall at a maximum false-alarm rate per thousand linear metres of cloth, or maximum mean absolute percentage error alongside a cap on single-order under-predictions during peak shipping weeks, recorded in the model registry with its operating assumptions.[R29][S11][S15][S38]

¶ 03 · 5 sources

Setting human thresholds translates statistical scores into unit quantities managed under ISO 22400-2 indicator definitionsS11, S38

S11S38S1102R29S15

11.3 Four threshold families protect the line from one-dimensional optimisation

11.3

A model that clears a single accuracy hurdle can still degrade operations if its input feed is incomplete, its latency stalls a work cell, or its gains on high-volume styles are paid for by severe errors on specialty lots.[S04][S19][S1101] GFT structures pre-release acceptance around four mandatory threshold families: technical discrimination and calibration, operational net benefit, serving data fitness, and bounded subgroup behaviour.[S04][S11][S1101] Each candidate must pass all four families simultaneously.[S11][S14]

¶ 04 · 5 sources

S04S19S1101S11S14

Exhibit 46 sets out the derived structure of these four threshold families, mapping each family to its primary metric class, required disaggregation dimensions, mandatory failure action and accountable owner.[S04][S11][S19][S1101]

Exhibit 46RegisterderivedFour threshold families and slice rules prevent aggregate masking
Threshold family
Technical performance
Primary metric class
Recall, precision, calibration error
Required slice dimensions
Defect class, fabric weight, weave structure
Mandatory failure action
Block export; refine features or threshold
Accountable role
Model builder and model owner

Read-outThreshold family: Technical performance. Primary metric class: Recall, precision, calibration error. Required slice dimensions: Defect class, fabric weight, weave structure. Mandatory failure action: Block export; refine features or threshold. Accountable role: Model builder and model owner

Open the full register (4 rows)
Technical performanceRecall, precision, calibration errorDefect class, fabric weight, weave structureBlock export; refine features or thresholdModel builder and model owner
Operational benefitNet review minutes, first-pass yield, scrap deltaLine, shift, operator experience tierHold in shadow or reject candidateDomain operating owner
Serving data fitnessCompleteness, timeliness, valid range shareCapture device, lighting state, offline bufferQuarantine feed; repair capture before re-testData steward and data custodian
Subgroup floorWorst-slice error cap, minimum sample supportLow-volume style, night shift, degraded modeRestrict operational scope or stop releaseRisk owner and domain owner
Method and source

Derived threshold framework combining human metric and threshold authority from S11, ML data-quality management from S04, upstream cascade awareness from S19, and disaggregated condition reporting from S1101.

Unit: governance specification. Status: derived. Sources: S04, S11, S19, S1101.

As Exhibit 46 illustrates, each threshold family triggers a specific remedy when a candidate falls short.[S04][S11] A failure on serving data fitness sends the team back to capture hardware, lighting calibration or schema enforcement rather than hyperparameter tuning, preventing upstream data cascades.[S04][S19] However, Exhibit 46 is a governance contract rather than a universal numeric table: it cannot establish the exact numerical cut-offs for a specific loom or inspection table, which must come from local baseline records.[S11][S38]

¶ 01 · 4 sourcesExhibit 46

S04S11S19S38

11.43 min · 2 sub-steps · read with a related exhibit

Local slices reveal aggregate success that hides failure

Aggregate evaluation scores weight every test record equally, so they are dominated by the factory's most frequent styles, best-lit day shifts and cleanest sensor feeds.[S04][S1101] Mitchell and colleagues show through their model-card framework that benchmarked evaluation must be disaggregated across conditions, groups and intersectional combinations relevant to the application domain so unsuitable contexts are exposed before release.[S1101] On a production line, disaggregation prevents releasing a model that performs well on standard plain-weave greige cotton but fails on dyed twill, heavy canvas, humid afternoon shifts or frames running after a yarn-lot changeover.[S04][S19][S1101]

11.5 Disaggregated evaluation tests the operating factors that shift on the floor

11.5

Under ISO/IEC 5259-3, managing data quality for analytics and machine learning requires verifying that validation datasets represent actual operating conditions.[S04] When evaluating a candidate, a factory team partitions held-out validation and shadow datasets along six operational axes wherever applicable:[S04][S38][S1101]

¶ 02 · 3 sources

Under ISO/IEC 5259-3S04

S04S38S1101

  1. Production line and machine unit, accounting for camera mounting angles, vibration profiles and mechanical wear across individual looms or sewing lines.[S04][S1101]
  2. Product style, construction and colourway, capturing how yarn count, weave density and dye shade alter visual contrast and lead-time elasticity.[R29][S1101]
  3. Shift and ambient environment, reflecting daylight leakage, voltage swings, dust and crew rotation between day and night shifts.[S04][S19]
  4. Defect or event category, separating rare high-cost failures (oil stains, warp floats, safety trips) from minor blemishes so accuracy on common classes cannot mask blindness to severe defects.[R29][S11][S1101]
  5. Operating mode, distinguishing steady-state runs from start-up after changeover, rework and post-maintenance restarts.[S38][S43]
  6. Missing-data and degraded-feed states, testing behaviour when context fields arrive late from an offline buffer or carry estimated or missing quality markers.[S04][S19]
  7. Method

    Disaggregated slice validation and minimum support check

    To evaluate local operating slices without mistaking sampling noise for proven fitness, the validation protocol executes four sequential checks on the frozen held-out snapshot and shadow log:[S04][S11][S15][S1101]

    1. Define the mandatory slice grid. Before scoring, the domain owner, data steward and builder list required unitary and two-way intersectional slices (such as style_group x line_id and defect_severity x shift_code), linked to governed identifiers in the KPI dictionary.[S02][S38][S1101]
    2. Enforce a minimum sample-support floor. Record the exact denominator $n_{\text{slice}}$ in each cell and apply an explicit support floor (such as an illustrative floor of $n_{\text{slice}} \ge 30$ independent events) below which a point score is marked insufficient support for autonomous release.[S04][S11]
    3. Report uncertainty intervals alongside point scores. Display a two-sided confidence or credible interval around each slice metric so the operating owner evaluates the worst-case plausible error bound.[S11][S1101]
    4. Apply scoped release or targeted collection when support is low. When a slice breaches its threshold at the conservative bound or lacks sample support, either extend shadow collection or issue a scoped release that excludes the under-supported slice and routes those cases to manual baseline handling.[S04][S11][S1102]

Intersectional slices are equally important.[S1101] A vision candidate may pass recall thresholds across all shifts combined and across dark-dyed fabrics combined, yet fail when a dark-dyed style runs on Line B during the night shift under artificial lighting.[R29][S1101] Pre-release slice tables that cross-tabulate style family by line and shift catch that failure before a customer rejects a lot.[S19][S1101]

¶ 01 · 3 sources

S1101R29S19

11.6 Sample support and uncertainty bounds prevent over-interpreting small slices

11.6

Disaggregating a validation set reduces the sample size in each cell.[S04][S1101] If a specialty style appears only eight times in a snapshot, a single misclassified roll shifts the apparent error rate by 12.5 percentage points (an illustrative ratio of 1 divided by 8), risking either false confidence or premature rejection.[S04][S11]

¶ 02 · 3 sources

S04S1101S11

Checking sample support also exposes upstream data cascades: when a shift slice shows near-zero logged defects, the steward verifies whether cloth quality improved or operators stopped recording tags during busy changeovers.[S02][S19]

¶ 03 · 2 sources

S02S19

11.74 min · 2 sub-steps · 1 exhibit

Operational comparison includes the cost of being wrong

Step 1 of 3Intro

Related exhibit 40 · chapter 09FlowderivedEvery candidate exits through deploy, redesign, postpone or stop
1. Decision and frozen baseline2. Data, rights and capacity check3. Simple rule comparatortest4. Risk tier and lifecycle costExit A: Admit toshadow candidateExit B: Redesignboundary or tierExit C: Postpone for spinehistoryExit D: Stop anduse simple rule

Read-out1. Decision and frozen baseline. Starting point. Leads to 2. Data, rights and capacity check (Action and KPI frozen), Exit D: Stop and use simple rule (No action), Exit C: Postpone for spine history (Baseline missing).

Method and source

Derived stage-gate path from operational decision and frozen baseline through data and rights readiness, simple comparator test and risk-adjusted lifecycle value check to four explicit exit outcomes, based on the lifecycle phases in S43 and the SME postponement and stop criteria in S44.

Unit: . Status: derived. Sources: S43, S44.

Read this exhibit in its chapter ↗

11.7 · Introduction

A candidate model is never evaluated against an implicit alternative of zero capability.

Exhibit 40, chapter 09: 1. Decision and frozen baseline

11.8 · The candidate must beat both current practice and a transparent comparator

Every validation report places three options side by side on the same historical and shadow windows:

Exhibit 40, chapter 09: 1. Decision and frozen baseline

11.9 · Review burden, false interventions and latency enter the net acceptance balance

A statistical gain that slows the line or exhausts operators is an operational regression.

Exhibit 40, chapter 09: 2. Data, rights and capacity check

11.7 · the bodyThe film above follows these sub-steps.

A candidate model is never evaluated against an implicit alternative of zero capability.[S43][S1102] Even a manual factory has a working decision process with an observable yield, speed and error cost.[S36][S38] Google's machine-learning engineering rules advise keeping the first model simple to establish baseline metrics and behaviour, and running sanity checks on held-out data right before exporting any model to serving.[S1102] In the CRISP-DM manufacturing lifecycle, the evaluation phase verifies that the model meets business objectives before deployment.[S43]

11.8 The candidate must beat both current practice and a transparent comparator

11.8

Every validation report places three options side by side on the same historical and shadow windows:[S38][S43][S1102]

¶ 02 · 3 sources

S38S43S1102

  • Current operating practice (the baseline): Actual human decisions, inspection catches or planning allocations recorded during the frozen window, scored under the governed ISO 22400-2 KPI formula.[S38]
  • A simple, transparent comparator: A deterministic rule, moving average, seasonal naive forecast or single-threshold optical filter maintainable in a worksheet or programmable logic controller (PLC) block.[S43][S1102]
  • The candidate model: The versioned artefact registered under Chapter 10 reproducibility controls, evaluated with its proposed threshold and serving pipeline.[S15][S16]
List · 5 sources

S38S43S1102S15S16

Industry literature in GFT's register notes that manual fabric defect inspection is 60 to 70 percent accurate and misses 20 to 30 percent of defects, whereas computer-vision benchmarks exceed 90 percent accuracy across more than 40 defect types at speeds up to 60 metres a minute (inherited Grade-C entry, not refreshed in 2026 and original dates unrecorded).[R29] Those figures justify a pilot, but local lint, cotton-seed trash, vibration and weave variations can push a vendor model's precision below a trained two-person inspection perch.[R29][S04][S19] Only local comparison settles the question.[S43][S1102]

¶ 03 · 5 sources

…manual fabric defect inspection is 60 to 70 percent accurate and misses 20 to…R29

R29S04S19S43S1102

11.9 Review burden, false interventions and latency enter the net acceptance balance

11.9

A statistical gain that slows the line or exhausts operators is an operational regression.[S22][S38][S43] If a vision system catches four additional true defects per shift but triggers forty false stops requiring three minutes each, it consumes 120 minutes of inspection capacity per shift (an illustrative product of 40 stops and 3 minutes) and drives operators to ignore alerts.[S18][S19][S38]

¶ 04 · 5 sources

S22S38S43S18S19

Operational validation therefore measures five quantities alongside statistical error:[S22][S38][S43]

¶ 05 · 3 sources

S22S38S43

  1. Inference and alert latency (mean and 95th percentile) within physical equipment cycle times and operational technology (OT) reliability limits.[S22][S38]
  2. False-intervention rate and review minutes per shift consumed when human verification overturns an alert.[S38][S43]
  3. Missed-event downstream cost in rework, scrap or stockout penalties compared with baseline practice.[S38][S43]
  4. Exception-triage delay, testing whether bounding boxes or attributions speed up operator verification.[S11][S38]
  5. Infrastructure and maintenance overhead required from a small team to sustain calibration and pipelines.[S18][S42]
List · 6 sources

S22S38S43S11S18S42

Exhibit 47 illustrates how a candidate model is compared against current baseline practice across five normalised operational burden and error indicators during shadow validation.[S38][S43][S1102]

¶ 06 · 3 sourcesExhibit 47

S38S43S1102

In Exhibit 47, lower index values represent less wasted time, fewer false stops or lower error over the same shift population.[S38][S43] If a candidate cut missed defect share from 26 to 11 on the illustrative index while raising false intervention rate from 42 to 75, the chart would expose an unacceptable trade-off hidden by a composite F1-score.[S11][S43] Because Exhibit 47 is an illustrative demonstration, it cannot establish actual factory gains; live decisions require measured units from a frozen shadow run.[S38][S43]

¶ 07 · 3 sources

…cut missed defect share from 26 to 11 on the illustrative index while raising…S11, S43 · illustrative

Exhibit 47

S38S43S11

Key figures from chapter 01 · Exhibit 01Key figuressourcedLocal-processing ambition raises the cost of untrusted evidence
  • 95%Raw cotton fibre exportedApproximate inherited sector baseline (R06; original date unrecorded)
  • 5%Cotton fibre processed locallyApproximate inherited sector baseline (R06; original date unrecorded)
  • 50%National processing targetSND30 local-processing target by 2030 (R07; policy target, not realised output)

Read-outRaw cotton fibre exported: 95%. Approximate inherited sector baseline (R06; original date unrecorded)

Method and source

Inherited GFT programme evidence base prepared 31 January 2024. R06 and R07 were not refreshed in 2026 and their original publication dates are unrecorded. Figures describe sector-level baseline and policy ambition, not a current GFT factory measurement or causal productivity claim.

Unit: percent of cotton fibre. Status: sourced. Sources: R06, R07.

Read this exhibit in its chapter ↗

11.102 min · 2 sub-steps · 1 exhibit

Shadow and assisted modes earn autonomy gradually

Switching a live process directly from manual execution to closed-loop model control introduces unnecessary operational and safety risk.[S16][S22] Offline snapshots cannot replicate live camera fouling, network micro-outages, clock drift or end-of-month dispatch pressure.[S19][S22][S42] Microsoft's MLOps maturity model advises building capability gradually rather than attempting full automation upfront, while NIST SP 800-82 Revision 3 prioritises OT performance, reliability and safety.[S16][S22] Combining these rules creates a staged release ladder.[S16][S22]

¶ 01 · 4 sources

while NIST SP 800-82 Revision 3 prioritises OT performanceS16, S22

Related · Exhibit 55 · chapter 12

S16S22S19S42

11.11 Silent shadow operation proves pipeline integrity and live distribution fitness

11.11

Every new deployment or major version upgrade begins in silent shadow mode: the model ingests live events or frames, computes features and predictions, and logs timestamped outputs and latency, while its outputs remain hidden from operators and cannot trigger machine or workflow actions.[S15][S16][S22]

¶ 02 · 3 sources

S15S16S22

Shadow operation tests four live questions:[S04][S15][S22][S1102]

¶ 03 · 4 sources

S04S15S22S1102

  1. Training-serving parity: Verifying that live messages and edge tables compute the exact same feature values and unit conversions as historical training extracts.[S04][S15][S1102]
  2. Runtime resource safety: Confirming that peak inference load on edge hardware respects processor, memory and thermal margins under NIST SP 800-82 reliability rules.[S22]
  3. Live slice accuracy against delayed ground truth: Joining shadow predictions to completed inspection sheets or order records via shared lot identifiers across all active slices.[S04][S09][S15]
  4. Virtual alert volume: Counting hourly alerts that would have fired so the operating owner sees true operator review burden before anyone is interrupted.[S11][S38]

11.12 Operator-assist mode tests human-machine interaction before any bounded automation

11.12

Once the shadow log passes all four threshold families over a predefined window (such as an illustrative window of two to four weekly cycles across all shifts and main style families), the operating owner may promote the candidate to operator-assist mode, where the model displays recommendations or bounding boxes while the operator retains authority to confirm, modify or reject each action.[S11][S16][S30]

¶ 04 · 3 sources

S11S16S30

Advancing from shadow to operator-assist mode is an explicit gate decision, and advancing further to bounded automation (acting automatically only within narrow pre-approved limits) is optional.[S16][S22][S42] Decisions involving complex rework trade-offs, customer concessions or safety-adjacent settings remain permanently in operator-assist mode.[S11][S22][S30]

¶ 05 · 5 sources

S16S22S42S11S30

Exhibit 48 shows an illustrative 16-week staged release sequence from candidate freeze through shadow validation, rollback rehearsal, operator-assist operation and conditional bounded automation.[S15][S16][S22]

¶ 06 · 3 sources

Exhibit 48 shows an illustrative 16-week staged release sequence from candidate freeze through shadow validationS15, S16, S22 · illustrative

Exhibit 48

S15S16S22

Exhibit 48ScheduleillustrativeStaged release makes each expansion of authority conditional
051015Offline slice and comparator auditSilent shadow deployment on live feedRollback and manual fallback rehearsalGate 1 review and user release briefingOperator-assist mode on pilot lineOverride, burden and KPI audit (Gate 2)Conditional bounded mode or assist lock

Read-outOffline slice and comparator audit: from 0 to 2 (illustrative weeks from candidate freeze)

Method and source

Illustrative 16-week staged release schedule derived from S15 pipeline lineage and rollback controls, S16 incremental MLOps maturity, and S22 OT reliability constraints. Durations are planning illustrations, not fixed commitments.

Unit: illustrative weeks from candidate freeze. Status: illustrative. Sources: S15, S16, S22. Illustrative figures are teaching examples, not measured factory results.

As Exhibit 48 shows, the rollback rehearsal occurs in Week 5 to Week 6 before Gate 1 approves operator-assist activation in Week 7, and Gate 2 in Week 11 to Week 13 audits human overrides and KPI movement before any expansion.[S11][S15][S27][S38] Because Exhibit 48 is an illustrative schedule, it cannot fix calendar durations across use cases; monthly planning models require longer shadow windows than high-speed inspection cameras.[S16][S38][S43]

¶ 01 · 6 sources

…to Week 6 before Gate 1 approves operator-assist activation in Week 7S11, S15, S27, S38

Exhibit 48

S11S15S27S38S16S43

11.132 min · 2 sub-steps · 1 exhibit

Rollback and manual fallback are release artefacts

Step 1 of 61. Detect breach or fault

Exhibit 49 · derivedRollback restores a known operating state and preserves evidence

1. Detectbreach or fault2. Suspendactive modeloutput3. Revert tov(k-1) ormanual baseline4. Notify floorand log shiftboundary5. Quarantineand reconcileaffected lots6. Diagnosecause andrevalidate
1. Detect breach or fault2. Suspend active model output3. Revert to v(k-1) or manual baseline4. Notify floor and log shift boundary5. Quarantine and reconcile affectedlots6. Diagnose cause and revalidate

1. Detect breach or fault

1. Detect breach or fault. Starting point. Leads to 2. Suspend active model output (Threshold or steward trigger). · derived

A model release is safe only if the factory can undo it faster than a bad prediction series can damage production.

2. Suspend active model output

2. Suspend active model output. From 1. Detect breach or fault (Threshold or steward trigger). Leads to 3. Revert to v(k-1) or manual baseline (Registry pointer or SOP switch). · derived

3. Revert to v(k-1) or manual baseline

3. Revert to v(k-1) or manual baseline. From 2. Suspend active model output (Registry pointer or SOP switch). Leads to 4. Notify floor and log shift boundary (Confirm stable line state). · derived

4. Notify floor and log shift boundary

4. Notify floor and log shift boundary. From 3. Revert to v(k-1) or manual baseline (Confirm stable line state). Leads to 5. Quarantine and reconcile affected lots (Tag interval in event log). · derived

5. Quarantine and reconcile affected lots

5. Quarantine and reconcile affected lots. From 4. Notify floor and log shift boundary (Tag interval in event log). Leads to 6. Diagnose cause and revalidate (Preserve failed snapshot). · derived

6. Diagnose cause and revalidate

6. Diagnose cause and revalidate. From 5. Quarantine and reconcile affected lots (Preserve failed snapshot). End point. · derived

The method behind it: Warning.

Method and source · Exhibit 49

Derived rollback and fallback sequence combining S15 artefact and pipeline lineage, S22 OT safety and reliability preservation, and S27 practised incident-response procedures.

Unit: operational control sequence. Status: derived. Sources: S15, S22, S27.

11.13 · the bodyExhibit 49 above; its figures are illustrative where marked.

A model release is safe only if the factory can undo it faster than a bad prediction series can damage production.[S15][S22] When deployment overwrites scripts in place and removes paper check-sheets, a bumped camera lens or corrupted feature leaves the floor unable to restore operations without hours of downtime.[S18][S19][S22] GFT treats technical rollback (reverting to prior approved version $v_{k-1}$) and operational manual fallback (reverting to the non-model baseline workflow) as mandatory release artefacts built and exercised before approval.[S15][S22][S27]

11.14 Immutable lineage pointers allow immediate reversion to a known state

11.14

Under Google Cloud's MLOps pipeline architecture, recording execution metadata and artefacts enables lineage, reproducibility and rollback.[S15] Rather than loading an unversioned file path, the serving layer resolves a registry pointer binding four immutable artefacts:[S09][S15]

¶ 02 · 2 sources

S15S09

  • The model artefact digest and version identifier, keeping prior approved version $v_{k-1}$ staged locally.[S15]
  • The feature-transformation code version, reverting normalisation constants alongside the model.[S15]
  • The input data contract and schema version, matching the structure and units validated for $v_{k-1}$.[S04][S15]
  • The threshold configuration, restoring the human-approved cut-offs of version $v_{k-1}$.[S11][S15]
List · 3 sources

S15S04S11

The previous approved bundle remains staged on the local node and in offline encrypted backup under CISA recovery guidance for at least one review cycle, making rollback a rapid pointer switch.[S15][S26]

¶ 03 · 2 sources

S15S26

11.15 Rehearsed fallback drills prove that operators can resume baseline work on command

11.15

When an upstream sensor fails or a first-time model is suspended, the line must drop back cleanly to manual or deterministic baseline operation.[S22][S27] Following NIST SP 800-61 Revision 3 guidance on periodic incident exercises, a pre-release fallback drill verifies that workflows survive suspension without lost records.[S22][S27]

¶ 04 · 2 sources

Following NIST SP 800-61 Revision 3 guidance on periodic incident exercisesS22, S27

S22S27

Exhibit 49 traces the derived six-stage control path from anomaly detection through suspension, reversion, floor communication, lot reconciliation and investigation.[S15][S22][S27]

¶ 05 · 3 sourcesExhibit 49

S15S22S27

In Exhibit 49, suspending the model (Steps 2 and 3) must never leave an OT controller or terminal in an undefined state, and Step 4 logs the exact timestamp and lot boundary so KPI calculations separate model-assisted intervals from fallback intervals.[S09][S22][S38] Step 5 reconciles lots processed just before suspension.[S04][S27] Because Exhibit 49 is a process specification, it cannot guarantee recovery times unless timed physically on the line before approval.[S22][S27]

¶ 06 · 5 sources

suspending the model (Steps 2 and 3) must never leave an OT controller or…S09, S22, S38

Exhibit 49

S09S22S38S04S27

11.161 min · 2 sub-steps · 1 exhibit

Approval separates building from acceptance

When the analyst or vendor who trained a model also decides whether it is ready for production, optimism bias enters the gate.[S11][S14] Both ISO/IEC 23894 and the NIST Cybersecurity Framework 2.0 place risk acceptance with accountable operational leadership rather than technical builders alone.[S14][S23]

¶ 01 · 3 sources

…and the NIST Cybersecurity Framework 2.0 place risk acceptance with accountable operational leadership rather…S14, S23

Related · Exhibit 05 · chapter 02

S11S14S23

11.17 Three distinct sign-offs align technical evidence, line accountability and OT safety

11.17

The GFT data spine divides release authority into three functional sign-offs:[S02][S14][S22][S23]

¶ 02 · 4 sources

S02S14S22S23

  1. Builder and data-steward verification: Certifies reproducible artefacts, complete registry lineage, passed shadow skew checks, and unmanipulated slice and uncertainty tables.[S02][S04][S15]
  2. Operating-owner acceptance: The domain owner accountable for affected KPIs reviews slice results, comparator charts and shift review burden, certifying operational fitness.[S02][S11][S38]
  3. Risk, OT and security approval: Verifies least-privilege identities, NIST SP 800-82 OT safety boundaries, worker-data protections, and timed fallback drill completion.[S22][S25][S27][S30]

11.18 Small teams prevent self-approval through role separation and proportionate escalation

11.18

A small Cameroonian spinning, weaving or garment plant needs no separate model-risk department to prevent self-approval: the analyst or vendor prepares the evidence package, while the quality or production manager (operating owner) and plant or maintenance manager (OT and risk approver) hold veto and sign-off rights.[S02][S11][S14][S16][S42]

¶ 03 · 5 sources

S02S11S14S16S42

Exhibit 50 maps four factory use-case classes across operational consequence and required approval independence.[S11][S14][S22][S23][S30]

Exhibit 50Decision mapderivedHigher consequence demands more independent release authority
Over-governed low riskMandatory multi-role gateProportionate steward checkUncontrolled release riskOperational consequence (0 to 10) →Approval independence (0 to 10) →Advisory order planni…Quality vision assistWorker-affecting anal…Control-connected OT

Read-outAdvisory order planning: Operational consequence (0 to 10) 2.8, Approval independence (0 to 10) 3.5. Quadrant: Proportionate steward check

Method and source

Derived consequence-to-authority matrix based on S11 human threshold authority, S14 integrated AI risk management, S22 OT safety constraints, S23 ERM governance, and S30 worker-data protection. Coordinates represent ordinal governance tiers rather than empirical probabilities.

Unit: derived governance score (0 to 10 scale). Status: derived. Sources: S11, S14, S22, S23, S30.

As Exhibit 50 shows, no deployment is permitted in the lower-right quadrant (Uncontrolled release risk).[S11][S14] Advisory planning (x = 2.8, y = 3.5) requires steward verification and operating-owner sign-off, whereas worker-affecting analytics (x = 7.8, y = 8.6) and control-connected OT (x = 9.2, y = 9.5) sit in the upper-right quadrant (Mandatory multi-role gate) with strict builder-approver separation and safety interlocks.[S11][S22][S30] These ordinal coordinates illustrate governance tiers and cannot replace a machine-specific hazard assessment.[S14][S22]

¶ 01 · 4 sources

y = 8.6) and control-connected OT (x = 9.2S11, S22, S30

Exhibit 50

S11S14S22S30

11.191 min · 2 sub-steps · read with a related exhibit

Worker-affecting outputs retain meaningful human review

Factory data spines touch human work whenever logs describe identifiable operators.[S29][S30] Alongside GDPR Recital 39 data minimisation and the statutory prior-authorisation requirement in Section 19(1) of Cameroon's Law No. 2024/017 of 23 December 2024 (requiring local legal counsel for interpretation), Principle 5.5 of the International Labour Office (ILO) code of practice states that decisions concerning a worker should not be based solely on automated processing of that worker's personal data.[S29][S30][S31] GFT enforces this non-binding ILO principle as a mandatory release gate.[S11][S30]

¶ 01 · 4 sources

Alongside GDPR Recital 39 data minimisation and the statutory prior-authorisation requirement in Section 19(1)…S29, S30, S31

Related · Exhibit 09 · chapter 02

S29S30S31S11

11.20 Nominal override buttons fail without time, context and authority to disagree

11.20

An "Approve / Override" button is not meaningful review if a supervisor must clear fifty scores in three minutes without seeing machine-fault context or faces pressure not to override.[S11][S19][S30] Validation of any worker-affecting candidate must verify four conditions before release:[S11][S29][S30]

¶ 02 · 4 sources

S11S19S30S29

  1. Aggregation by default: Model at machine, line, style or shift grain rather than individual worker grain wherever possible.[S29]
  2. Visible context and uncertainty: Show measured inputs, missing-data states and confounders such as yarn-lot breaks or machine faults.[S04][S11][S38]
  3. Time and authority to reject: Allocate shift review time and authorise supervisors to reject recommendations without penalty.[S02][S11][S30]
  4. Right of contestation and correction: Provide a clear route through the steward or human-resources lead to correct erroneous logs via superseding provenance events.[S09][S30]

11.21 Decision logs audit whether automated recommendations become de facto commands

11.21

The operator-assist interface logs each recommendation, reviewer action, reason code and review duration under least-privilege access controls.[S15][S25][S29] Gate 2 and monthly reviews audit overrides: near-100 percent overrides signal poor utility, while 0 percent overrides with two-second review times warn of mechanical rubber-stamping.[S11][S30][S36]

¶ 03 · 6 sources

Gate 2 and monthly reviews audit overridesS11, S30, S36

S15S25S29S11S30S36

11.222 min · 2 sub-steps · read with a related exhibit

The release package tells the floor what changed

Related · chapter 076 paragraphs step it

Related exhibit 31 · chapter 07Decision mapillustrativeAccess rights differ sharply by role and data product
Scoped oversight and auditStrict dual-control governanceTask-specific line captureAutomated technical custodyOperational and pipeline write authority →Record visibility and personal-data scope →Line operatorShift supervisorQuality stewardMaintenance engineerData analystEquipment vendorDeployment service

Read-outLine operator: Operational and pipeline write authority 2, Record visibility and personal-data scope 1. Quadrant: Task-specific line capture

Method and source

Illustrative permission mapping across seven factory roles on two governance dimensions: x measures operational and model write authority (0 = read/append local only, 10 = full pipeline or infrastructure write), y measures scope of sensitive and identifiable record visibility (0 = anonymised or single-asset only, 10 = plant-wide or personal-data review). Positions are illustrative design targets based on S25, S29 and S0701, not empirical measurements.

Unit: illustrative score (0 to 10). Status: illustrative. Sources: S25, S29, S0701. Illustrative figures are teaching examples, not measured factory results.

Read this exhibit in its chapter ↗
11.22 · Introduction · paragraph 1 of 6

A model release recorded only in a code repository leaves operators uninformed.[S12][S13] Translating ISO/IEC 42001:2023 management-system requirements and ISO/IEC 5338:2023 lifecycle processes into shop-floor practice requires publishing a concise release package alongside every promoted version.[S12][S13][S1101]

11.23 A compact release manifest documents scope, limits, alerts and fallback routes

Combining ISO/IEC 42001, ISO/IEC 5338 and Mitchell and colleagues' model cards, the release package pairs a registry manifest with a one-page workstation sheet containing eight elements:[S11][S12][S13][S15][S1101]

  • Release identity and lineage links: Model version ID, dataset snapshot IDs, feature-pipeline version, KPI dictionary version and activation timestamp.[S15][S38]
  • Intended operational decision and scope: Decision supported, approved lines and styles, and authority mode (shadow, operator-assist or bounded automation).[S12][S16][S1101]
  • Out-of-scope conditions and limitations: Styles, fabric weights, lighting states or modes that failed slice support or threshold gates.[S04][S11][S1101]
  • Validated performance summary: Baseline, comparator and candidate results across the four threshold families and local slices, with sample support and uncertainty bounds.[S11][S38][S1101]
  • User instructions and review expectations: How operators inspect context, confirm actions and log overrides.[S12][S30][S35]
  • Alert route and escalation owner: Recipients of automated quality or drift alerts and the steward contact for abnormal behaviour.[S02][S17][S27]
  • Rollback and manual fallback instruction: Switch to suspend the model, pointer to prior version $v_{k-1}$, and workstation manual SOP reference.[S15][S22][S27]
  • Named approvers and review date: Signatures of the builder/steward, operating owner and risk/OT approver, plus the scheduled review date.[S12][S13][S14]

11.24 Shift-aligned activation and user briefing preserve KPI interpretability

In OECD case-study evidence on SME digitalisation, converting traditional processes into digital routines requires structured learning rather than yielding an instant payoff, and ILO-UNESCO guidance emphasises tangible pilots with built-in feedback and user preparation.[S35][S40] Model activation is aligned to a clean shift, batch or planning boundary and recorded as a provenance event, preceded by a workstation briefing from the steward and adoption champion covering shadow examples, override logging and the manual fallback sheet.[S09][S27][S35][S37][S38]

With the release package active, the candidate operates under controlled authority on the floor. Yet validation at release is only a snapshot: cotton fibre properties vary across harvests, dye lots shift, cameras accumulate lint, and ordering patterns change.[R01][S18][S21] Keeping the deployed model subordinate to operations over time requires continuous production monitoring, drift diagnosis and rehearsed incident response, examined next.[S17][S21][S27]

Check the record

The chapter keeps its sources within reach.

Every knot is a source this chapter cites; select one to read its record, or filter the register by grade. Publication dates and inherited-source limits stay explicit. Read the paper's full evidence summary.

37 sources · 415 citation marks on this pageMost cited: S11, 48 times

Grade AGrade BGrade CKnot size: citations on this page

All 37 records shown

R01 · Grade C · inherited record

Business in Cameroon

Inherited evidence R01

Cameroon seed-cotton production 2022-2024: 330,000 t (2022), 314,455 t (2023), about 340,000 t (2024).

Publication date unrecorded. Inherited source-text record. The original publication has not been independently reopened for this web edition.

Chapter source notes

S11 National Institute of Standards and Technology. 2023-01-26.

S15 Google Cloud. 2024-08-28.

S43 Frontiers in Artificial Intelligence. 2021-06-14.

S19 Association for Computing Machinery, CHI 2021. 2021.

S1101 arXiv, Conference on Fairness, Accountability, and Transparency. 2019-01-14.

R06 Cameroon Trade Hub. Publication date unrecorded; inherited source-text check.

R07 Ecofin Agency. Publication date unrecorded; inherited source-text check.

S04 ISO/IEC. 2024.

S16 Microsoft Learn, Azure Architecture Center. 2026-06-03.

S22 National Institute of Standards and Technology. 2023.

S09 World Wide Web Consortium. 2013-04-30.

S38 International Organization for Standardization. 2014.

S13 ISO/IEC. 2023.

S1102 Google Developers. 2025-08-25.

S14 ISO/IEC. 2023.

S02 International Organization for Standardization. 2022.

R29 MDPI; industry inspection literature. Publication date unrecorded; inherited source-text check.

S36 World Bank. 2023.

S18 Advances in Neural Information Processing Systems. 2015.

S42 SCITEPRESS, IN4PL 2022. 2022.

R14 WageIndicator. Publication date unrecorded; inherited source-text check.

R32 Wise; XE. Publication date unrecorded; inherited source-text check.

S30 International Labour Office. 1997.

S27 National Institute of Standards and Technology. 2025.

S26 CISA, MS-ISAC, NSA and FBI. 2023.

S35 OECD. 2022-11-21.

S23 National Institute of Standards and Technology. 2024-02-26.

S25 National Institute of Standards and Technology. 2020-12-10.

S29 European Parliament and Council of the European Union. 2016-04-27.

S31 Presidency of the Republic of Cameroon. 2024-12-23.

S12 ISO/IEC. 2023.

S17 Microsoft Learn, Azure Machine Learning. 2026-01-27.

S40 International Labour Organization and UNESCO. 2020.

S37 World Bank. 2025-05-20.

S44 The Journal of Technology Transfer, Springer Nature. 2024-07-27.

R01 Business in Cameroon. Publication date unrecorded; inherited source-text check.

S21 arXiv, author manuscript of an IEEE Transactions on Knowledge and Data Engineering article. 2020-04-13.

Keep the thread · chapter 11 of 14

Chapter 12 picks up the thread.

Move the shuttle along the rack to preview any chapter: its sections, exhibits and reading time. Draft web edition. This research is not investment, legal or tax advice; illustrative models are not measured factory results.

The paper's rack · 14 boltsBolt length: reading time

12Part III: Control models as production change

Monitoring must trigger diagnosis, not automatic retraining

A useful monitor detects change, establishes whether it matters and routes a named person through a rehearsed response.

  • 12.1Service health and data quality come before accuracy
  • 12.4Input drift and concept drift require different interpretation
  • 12.7Delayed labels demand honest interim evidence
  • 12.10Alerts need thresholds, owners and runbooks
Reading time
35 min
Exhibits
5
Sections
8
Continue to chapter 12
← Previous: chapter 10, Reproducible training turns experiments into auditable candidatesContinue the threadChapter 12 · Monitoring must trigger diagnosis, not automatic retraining

Find a thread.

Type to search.