Evolve event schemas across forty teams without central paralysis

• Determine whether events are facts, commands, or replicated database rows and who owns their meaning. Define compatibility for schema, semantics, ordering, retention, and privacy classification.

• Inventory producers, known and observed consumers, event volume, retention, and schema-change frequency. High-volume compatibility failures require replay and storage plans, not only build-time checks.

• Producers own stable semantics, consumers can upgrade independently, incompatible changes are detectable before release, and ownership remains decentralized with auditable exceptions.

• Use a schema and contract registry with ownership metadata, compatibility checks, generated fixtures, lineage from runtime consumption, and CI gates. Domain councils define rules; automation approves routine additive changes.

• Versioned envelopes carry type, schema, producer, event ID, occurred time, classification, and causation. Producers dual-publish only for bounded major migrations; consumers report supported versions and actual usage.

• An event fact is immutable; corrections are new facts with explicit supersession. Adding a nullable field is structurally compatible but may still be semantically breaking if consumers infer absence.

• Quarantine invalid events without blocking unrelated partitions, retain replayable originals, and provide consumer lag and parse-failure alerts. Rollback preserves the older contract until all affected retention windows pass.

• Classification rules block sensitive fields from unauthorized topics and require retention and regional policy. Registry write access and emergency overrides are scoped and audited.

• Track unknown consumers, schema versions in use, parse failures, semantic quality checks, replay demand, and ownerless contracts. Notify affected owners before a proposed break.

• Dual publication and long retention are expensive; time-box them with owners and cleanup gates. Compatibility tooling costs less than recurring incident and coordination overhead.

• A central board catches nuance but does not scale; pure team autonomy externalizes breakage. Automate enforceable rules and reserve human review for semantic changes and exceptions.

• Register ownership and observe consumers first, then enable warning-only checks, generated tests, and finally CI enforcement. Migrate high-risk topics individually and publish contract health by domain.

• Staff candidates solve both protocol and organization. They distinguish structural from semantic compatibility and design a paved road where safe changes are faster than exceptions.

Interviewer evaluation rubric