Project deep dive · Meta Infrastructure

A safer, self-service platform for code freezes

Initial build: 2025 Q1-Q3 · Holiday validation: 2025 Q4 · Ongoing ownership

Problem

Implementing a code-freeze policy required writing code and updating configuration across multiple systems. Duplicate sources of truth made scope hard to validate, and engineers could not explain why changes were blocked or allowed.

Solution

One UI-driven event model, one shared policy engine, and consistent interactions across code-landing and configuration surfaces.

My role

Primary architect and engineer, owning discovery, architecture, core frontend and backend implementation, testing, and rollout.

≈20K daily changes Code and configuration deployments evaluated by the platform.

No severe incidents from incorrect enforcement During the 2025 holiday season, without continuous manual monitoring.

≈90% fewer tickets YoY Incorrect block or allow reports versus Holiday 2024.

Initial delivery and validation

Q1 · Discovery

Build + integrate

Silent shadow

Q3 · Launch

Q4 · Holiday validation

01

High-level system architecture

One policy engine reused across every change surface

Existing systems kept their deployment logic; the platform standardized only the policy contract and user interaction.

Policy owner Defines window, scope, and enforcement

→

Event management UI React / Relay

→

Event model Ent / MySQL · one source of truth

↓ Policy configuration feeds the shared engine ↓

Change surfaces Code landing · legacy configuration systems

→

Surface adapter Common policy contract

→

Shared policy engine Hack · synchronous evaluation

→

Shared outcome presentation layer Consistent explanations and actions across surfaces

Interactive policy debugger

→

Runs the same production policy engine against a selected user, change, event, or time

→

Decision + step-by-step explanation

Policies are defined once, evaluated by one engine, and explained consistently across surfaces.

02

Technical decisions and tradeoffs

Policy authority was centralized, explainable, and proven

One authoritative policy system Central policy ownership · local workflow ownership

Eliminate contradictory policy sources while preserving each surface's deployment logic.

Required cross-team migration and stronger reliability guarantees for a critical dependency.

Explainability in the production engine Overridable context · ordered trace

Produce exact previews and explanations without a second policy implementation.

Typed context and trace instrumentation across the evaluation pipeline.

Evidence-based transfer of authority Real-traffic shadow · staged cutover

Measure equivalence across long-tail policies before affecting users.

Longer rollout with temporary dual execution, logging, and comparison.

Scope discipline: ranked features by correctness and launch risk; shipped the release-critical path first, then delivered non-blocking capabilities after Holiday validation.

03