RELEASE ENGINEERING · TRAFFIC CONTROL ROOM
Blue/green release: inspect the cutover
Route individual requests, observe both versions and stop candidate traffic when the measured release gate fails.
Scroll the diagram horizontally to inspect every label. The panels below give the same state as text.
Your experiment
Move the cutover earlier and later. Inspect the first candidate request and the available control samples at that moment.
The preview is the computed end of this same replay. Capture a baseline, change one parameter and compare the cohort evidence. “Within limits” is not proof of safety or an automatic production promotion.
Recent request trace
Offline, seeded traffic exercise; no deployment, provider API or real flag service is used. Two requests per second are evaluated without a capacity queue. Control latency is 100–200ms; candidate latency spans 75–125% of its configured center. Outcomes use independent fixed pseudo-random streams. The gate requires enough samples in both cohorts, then rejects an excessive observed error-rate difference or candidate p95. It is not a statistical significance test. Metrics accumulate from start, without a sliding window, confidence interval or dependency failures. Shadow responses never serve users; safe handling of real side effects is not implemented. Google SRE: canarying releases.
A cutover moves all traffic at once
The replay sends one hundred twenty requests, two per model second. In blue/green mode every request before Blue/green cutover goes to the control (blue) version and every request after it goes to the candidate (green), so the planned share jumps from zero to one hundred percent. Each request draws its error and latency from fixed pseudo-random streams, so identical settings reproduce the same rows. The gate compares the observed error-rate difference and candidate p95 latency only after both cohorts reach Minimum samples per cohort.
Follow the opening incident
Defaults cut over at twenty seconds, and the candidate starts failing with thirty percent probability from ten seconds. The first candidate request arrives at twenty seconds. After eight candidate requests three have failed, an observed 37.5 percent against 0.9 percent for control, so the gate rejects and Stop candidate traffic on rejection rolls back at 23.5 seconds. Users saw four errors in total. Clear that option: the gate still says Reject candidate, but eighty-one requests reach green, thirty-one of them fail, and users see thirty-two errors.
Evidence must exist before the switch
Set the cutover to five seconds and Minimum samples per cohort to thirty. Blue serves only nine requests before the switch and then receives none, so the control cohort never reaches thirty and the gate stays Insufficient samples for the whole run. Thirty-nine user errors occur and no rollback fires. A blue/green switch removes the concurrent comparison cohort, so the comparison evidence has to be collected before the cutover, or the switch-back decision must use another signal.
Inputs and their meaning
Strategy also offers canary, progressive and shadow routing for comparison; Initial candidate share applies only to canary and progressive, while shadow copies every request. Control error probability and Candidate error probability are generating probabilities, not observed rates. Candidate fault begins sets when the candidate degrades. Allowed error difference is in percentage points. Candidate latency center spreads candidate latency between seventy-five and one hundred twenty-five percent of the center, and Candidate p95 limit rejects on nearest-rank p95. With the candidate error at two percent and latency center at 440 ms, the observed p95 of 532 ms exceeds the 500 ms limit and rolls back at 23.5 seconds with zero candidate errors.
Replay controls and limits
Play and Pause reveal the sixty-second trace, Next request steps half a model second, Restart rewinds, Speed changes pace and Time scrubs; input edits recompute and rewind. Metrics accumulate from time zero rather than over a sliding window. There is no connection draining, session pinning, database schema compatibility, warm-up, DNS or load-balancer propagation delay, and rollback is instantaneous. The probabilities are synthetic inputs, and passing this gate is not a statistical significance test.