Agent release train: hold promotion after canary errors

Current inspection state

Separate build evidence from canary traffic

A release train admits a candidate only after its preflight checks, then gathers a limited canary sample before promotion. This local policy begins with build-A serving all traffic. Test evidence belongs to build-B; Candidate artifact chooses that tested identity or changed build-C. These short names represent immutable artifact identities, not calculated digests. Fail and Missing test reports both block the train. Changing the candidate also blocks it, even with a passing report. Environment approval is a separate condition: an approval cannot repair a failed test or make evidence for different bytes current.

Compare an exact rate boundary

Restore defaults and move the timeline to 60 seconds. The sample contains one error among twenty completed canary requests: 100 times 1 divided by 20 equals 5%. The maximum allowed error rate is 5%, so equality passes and build-B becomes stable. Increase Canary errors to two. The rate is now 10%, analysis rejects it and the final state is rolled-back with build-A stable. The failed sample remains visible. Increase the maximum allowed rate to 10% to accept equality again. The model compares integer products, not a rounded display percentage, so a value just above the limit cannot pass by rounding down.

Do not turn missing observations into success

Minimum completed requests is an independent evidence gate. Keep the default twenty observations and raise the minimum to twenty-one: the train is held, even though the observed rate satisfies its threshold. Set Completed canary requests to zero. The rate is undefined, not zero; even a minimum of zero cannot authorize promotion without observations. Disabling Telemetry available also holds the train and removes the displayed sample. These cases deliberately differ from an observed bad rate. This teaching policy evaluates sample sufficiency before the error threshold. It does not infer either health or failure from an inadequate sample.

Read exposure and the event sequence

At inspection second 20, preflight has passed but the candidate has no traffic. At 30, its configured share is 10% while build-A retains 90%. The aggregate observation arrives at 40 and the decision appears at 50; promotion or removal of canary traffic happens at 60. Those seconds provide an inspectable sequence, not measured rollout duration. The entered sample size is the number of completed candidate requests, not 10% of an entered total. No request-level routing or generated latency is claimed. A rejected or inconclusive train removes canary traffic at the final event. This local choice is not a claim about the default behavior of a deployment product.

Control and retain the experiment

Play advances the sixty-second inspection and Pause freezes it. Next event pauses at the next ten-second boundary. Restart rewinds while preserving policy inputs; the timeline seeks and pauses. Speed offers quarter, half, normal and double pace without changing the computed decision. Editing any domain input restarts the scenario. Canary errors cannot exceed completed requests: reducing the sample clamps the error count, and both updated values remain visible. Restore defaults resets domain inputs while preserving your playback speed. Export JSON saves the complete computed model and current inspection position. The final prediction is labeled separately so future events are not confused with observed state. Shared baseline and notes controls let you retain a comparison and export your own observations.

Understand what acceptance cannot prove

All requests, results and artifacts are synthetic. This is a single-candidate policy experiment, not an ADK deployment API or an Argo Rollouts emulator. It has no confidence interval, session affinity, real traffic router, build execution, telemetry query, concurrent release queue or calendar cadence. A minimum sample and a small observed error rate do not prove reliability or statistical significance. Rollback assumes build-A remains available and compatible; real data migrations and external effects may be irreversible. Use the two readings to connect these explicit policy boundaries with release scheduling and session-aware canaries. Text cards and the event list expose the state without depending on color, and all inputs have keyboard labels.