Design Code Freeze Mechanism - System Design | WinJob

Problem Statement: Automated Code Freeze Control Plane

Google, Netflix, and Meta run change moratoriums before peak events. A code freeze platform automates what CAB meetings once did manually: block merges and production deploys during scheduled windows, with scoped exceptions and full auditability.

Problem framing

Scheduled freeze windows block merges to protected branches and production deploy steps during holidays, sales events, or incident response
Central policy service evaluates every merge/deploy request against active windows, scopes, and override tokens
Emergency break-glass with dual approval, time-boxed override tokens, and full audit trail
Developer-visible status so teams know why a merge failed before paging platform on-call

Design choices

Fail-closed enforcement at SCM branch protection + CI deploy gate (defense in depth)
Separate merge freeze from deploy freeze—staging may continue while prod is locked
Recurring calendar rules (Black Friday, year-end) with timezone-aware boundaries

Deep dive

Google, Netflix, and Meta run org-wide change moratoriums before peak traffic. Netflix coordinates freeze via Spinnaker pipeline gates; Google uses internal change-management calendars integrated with Critique/CQ; Meta ties deploy locks to release trains and incident severity.

javaOne Dark Pro

1 public final class FreezeEvaluator {
2   public Decision evaluate(EvaluateRequest req, List<ActiveWindow> windows, Optional<OverrideGrant> override) {
3     if (override.isPresent() && override.get().isValid(req.repo(), req.action())) {
4       return Decision.allow("OVERRIDE_ACTIVE");
5     }
6     for (ActiveWindow window : windows) {
7       if (window.isHard() && window.matches(req)) {
8         return Decision.deny("FREEZE_ACTIVE", window.reason());
9       }
10     }
11     return Decision.allow("NO_ACTIVE_FREEZE");
12   }
13 }

pythonOne Dark Pro

1 from dataclasses import dataclass
2 from typing import Literal
3  
4 @dataclass
5 class EvaluateRequest:
6     repo: str
7     branch: str
8     action: Literal["merge", "deploy"]
9  
10 def evaluate(req: EvaluateRequest, windows: list, override: dict | None) -> tuple[bool, str]:
11     if override and override.get("valid"):
12         return True, "OVERRIDE_ACTIVE"
13     for window in windows:
14         if window.get("severity") == "hard" and window["matches"](req):
15             return False, f"FREEZE_ACTIVE:{window['name']}"
16     return True, "NO_ACTIVE_FREEZE"

typescriptOne Dark Pro

1 interface EvaluateRequest {
2   repo: string;
3   branch: string;
4   action: "merge" | "deploy";
5 }
6  
7 export function evaluateFreeze(
8   req: EvaluateRequest,
9   windows: { severity: string; matches: (r: EvaluateRequest) => boolean; name: string }[],
10   override: { valid: boolean } | null,
11 ): { allowed: boolean; reason: string } {
12   if (override?.valid) return { allowed: true, reason: "OVERRIDE_ACTIVE" };
13   for (const w of windows) {
14     if (w.severity === "hard" && w.matches(req)) {
15       return { allowed: false, reason: `FREEZE_ACTIVE:${w.name}` };
16     }
17   }
18   return { allowed: true, reason: "NO_ACTIVE_FREEZE" };
19 }

Interviewer positioning

Open with why freeze exists: stability during revenue-critical windows beats continuous deploy velocity for 72 hours.

How to open this one

The framing that signals depth on an automated code-freeze control plane is enforcing a freeze as policy in the pipeline, not a Slack announcement: during a freeze window, merges and promotions to protected branches or environments are blocked except through an audited break-glass path. Lead with scoped, time-bound freezes and the exception workflow, and the failure story that proves it: a freeze is announced but not enforced, and a risky change ships during a peak event because nothing actually stopped it. That shows you understand a freeze has to be a gate with an auditable override, not a request.

Key Highlights

•Central calendar drives SCM and CI enforcement
•Evaluate API returns actionable reason codes
•Append-only audit for compliance disputes

1	public final class FreezeEvaluator {
2	public Decision evaluate(EvaluateRequest req, List<ActiveWindow> windows, Optional<OverrideGrant> override) {
3	if (override.isPresent() && override.get().isValid(req.repo(), req.action())) {
4	return Decision.allow("OVERRIDE_ACTIVE");
5	}
6	for (ActiveWindow window : windows) {
7	if (window.isHard() && window.matches(req)) {
8	return Decision.deny("FREEZE_ACTIVE", window.reason());
9	}
10	}
11	return Decision.allow("NO_ACTIVE_FREEZE");
12	}
13	}

1	from dataclasses import dataclass
2	from typing import Literal
3
4	@dataclass
5	class EvaluateRequest:
6	repo: str
7	branch: str
8	action: Literal["merge", "deploy"]
9
10	def evaluate(req: EvaluateRequest, windows: list, override: dict \| None) -> tuple[bool, str]:
11	if override and override.get("valid"):
12	return True, "OVERRIDE_ACTIVE"
13	for window in windows:
14	if window.get("severity") == "hard" and window["matches"](req):
15	return False, f"FREEZE_ACTIVE:{window['name']}"
16	return True, "NO_ACTIVE_FREEZE"

1	interface EvaluateRequest {
2	repo: string;
3	branch: string;
4	action: "merge" \| "deploy";
5	}
6
7	export function evaluateFreeze(
8	req: EvaluateRequest,
9	windows: { severity: string; matches: (r: EvaluateRequest) => boolean; name: string }[],
10	override: { valid: boolean } \| null,
11	): { allowed: boolean; reason: string } {
12	if (override?.valid) return { allowed: true, reason: "OVERRIDE_ACTIVE" };
13	for (const w of windows) {
14	if (w.severity === "hard" && w.matches(req)) {
15	return { allowed: false, reason: `FREEZE_ACTIVE:${w.name}` };
16	}
17	}
18	return { allowed: true, reason: "NO_ACTIVE_FREEZE" };
19	}