GitHub Merge Queue Escalation Decision Cutoff for Repeated ACK Breaches: Authority Transfer Matrix and Leadership Gate Policy (2026)
A single ACK timeout can be noise. Repeated ACK timeout breaches in the same queue context are a governance failure mode. Teams often respond by escalating more loudly, not by deciding who owns the next irreversible decision.
This guide defines a decision cutoff playbook for GitHub merge queue incidents where ACK deadlines keep getting missed. It gives a breach counter model, transfer-of-authority matrix, and copy-paste macros you can enforce in PR timelines and incident channels.
Table of contents
1. Why repeated ACK breaches require a cutoff rule
Repeated timeout events indicate that paging is no longer the bottleneck. The bottleneck is decision authority. Without a cutoff policy, teams keep extending informal wait time, ownership remains ambiguous, and rollback windows degrade.
| Pattern | If untreated | Control needed |
|---|---|---|
| Second ACK breach in same incident class | Cycle repeats with same responder path | Automatic authority transfer trigger |
| Breach across multiple teams in one week | Cross-team blame with no owner correction | Leadership decision gate with mandatory assignee |
| Breach during active policy exception | Exception window outlives risk assumptions | Hard expiry + cutoff-based enforce/restore decision |
2. Breach counters and trigger windows
Cutoffs require objective counters. Use lightweight rolling windows that teams can understand under stress.
| Trigger set | Suggested threshold | Result |
|---|---|---|
| A only | >= 2 breaches in 7 days | Escalation manager review required |
| A + C | >= 2 and active exception | Immediate cutoff candidate |
| B only | >= 6 weighted points in 30 days | Mandatory leadership gate for new incidents |
| A + B + C | Any simultaneous match | Automatic authority transfer and bounded decision window |
3. Escalation decision cutoff matrix
The matrix below defines who can decide what after the cutoff event fires. Keep scope bounded to avoid overreach.
| Post-cutoff decision | Allowed owner | Decision window | Evidence required |
|---|---|---|---|
| Enforce baseline restore now | Incident commander | 10 minutes | Current check state + protection delta list |
| Grant bounded extension | Governance lead + one approver | 10 minutes | Expiry timestamp + risk reason + rollback path |
| Escalate to executive-on-call | Governance lead only | 5 minutes | Counter snapshot + unresolved risk summary |
| Freeze queue intake | Incident commander | Immediate | Queue state proof + recovery ETA checkpoint |
Do not let the transferred owner rewrite policy during an incident. Cutoff authority is for incident stabilization, not permanent governance changes.
4. Authority transfer policy by severity
Authority transfer must be deterministic by severity. Avoid ad-hoc escalation trees.
| Severity | Cutoff trigger | Transfer target | Default decision if no response |
|---|---|---|---|
| SEV-1 rollback blocked | First repeated breach | Incident commander immediately | Enforce baseline restore |
| SEV-2 queue unstable | Second breach in 7 days | Governance lead | Queue intake freeze + restore plan |
| SEV-3 policy drift risk | Weighted score threshold | Service owner delegate | Deny extension and schedule closure review |
5. 30-minute execution workflow after cutoff
Once cutoff is triggered, run a fixed sequence. Time-box every phase and keep timeline comments short.
- Minute 0-2: declare cutoff event with counter snapshot and UTC timestamp.
- Minute 2-5: transfer authority to predefined role and record acceptance.
- Minute 5-10: choose one decision path: restore baseline, bounded extension, or intake freeze.
- Minute 10-15: post decision rationale with scope, expiry, and owner.
- Minute 15-25: execute decision path and publish first proof artifact.
- Minute 25-30: confirm current risk status and schedule closure-quality review.
6. Copy-paste templates
Use these templates in PR timeline comments or incident channels to keep wording and accountability consistent.
Template A: cutoff trigger notice
[ESCALATION DECISION CUTOFF TRIGGERED]
Incident: <id>
Severity: <SEV-1/2/3>
Trigger counters:
- 7-day breach count: <N>
- 30-day weighted score: <N>
- Active exception: <yes/no>
Triggered at (UTC): <yyyy-mm-dd hh:mm>
Authority transfer target: @<role-handle>
Decision deadline (UTC): <yyyy-mm-dd hh:mm>
Template B: authority transfer accepted
[AUTHORITY TRANSFER ACCEPTED]
Acting decision owner: @<handle>
Accepted at (UTC): <yyyy-mm-dd hh:mm>
Scope of authority:
- Allowed: <restore baseline / bounded extension / intake freeze>
- Not allowed: permanent policy edits
Execution checkpoint (UTC): <yyyy-mm-dd hh:mm>
Template C: bounded extension approval
[BOUNDED EXTENSION DECISION]
Decision owner: @<handle>
Approver: @<handle>
Reason: <risk summary>
Extension expiry (UTC): <yyyy-mm-dd hh:mm>
Required restoration owner: @<handle>
Restoration checkpoint (UTC): <yyyy-mm-dd hh:mm>
Evidence links: <links>
Template D: cutoff closure record
[CUTOFF EVENT CLOSURE]
Incident: <id>
Cutoff triggered at (UTC): <yyyy-mm-dd hh:mm>
Final decision path: <restore / extension / freeze>
Execution completed at (UTC): <yyyy-mm-dd hh:mm>
Current baseline state: <restored/not restored>
Follow-up review owner: @<handle>
Follow-up due (UTC): <yyyy-mm-dd hh:mm>
7. Post-cutoff KPIs and safeguards
If cutoffs are working, repeated breach loops should shrink over time. Track these metrics weekly:
| KPI | Target | What to do if missed |
|---|---|---|
| Median time from cutoff trigger to decision | <= 10 minutes | Reduce approver hops and tighten role mapping |
| Repeat breach rate after cutoff event | Downward week-over-week | Reassign primary ownership and rebalance on-call |
| Cutoff event closure completeness | 100% timestamp and evidence fields | Block closure until mandatory fields are posted |
| Extensions ending after expiry | 0 | Auto-revert to baseline at expiry boundary |
Repeated ACK breaches are not random incidents. They are a signal that authority routing is under-specified. A clear cutoff matrix turns repeated delays into deterministic, auditable decisions.
FAQ
Should we trigger cutoff on every ACK timeout?
No. Use standard ACK remediation for isolated events. Trigger cutoff when recurrence thresholds are met or when active exceptions overlap with repeated misses.
Can one person hold both incident commander and governance lead roles?
Avoid this for SEV-1 and SEV-2 incidents. Separation of decision and oversight roles lowers the chance of single-threaded failure during high-pressure rollbacks.
How do we tune thresholds for small teams?
Keep the same model but lower complexity: one 7-day counter and one severity weight score is enough. Do not remove transfer-of-authority rules.
What if the transfer target is unavailable?
Use role fallback order in policy. If no target acknowledges by fallback timeout, default to baseline restore and record it as emergency fallback execution.
How is this different from normal escalation?
Normal escalation asks for attention. Cutoff governance transfers decision rights with explicit deadlines and bounded authority.
Use this cutoff policy with your ACK remediation runbook and closure-quality dashboard to stop repeated timeout loops before they normalize into your operating model.