Aborts a canary automatically when named error, latency, or saturation metrics breach soak-window thresholds, keeps sticky canary identity, and forbids silent promotion to full traffic.
Package status: reference context ready for human review. The contract and test scenarios are complete, but no claim is made that an adopting implementation has passed them.
Decision
Promote a new stateless service version only after a canary soak completes without breaching named abort metrics. Abort is automatic: error rate, latency, and saturation compared with the baseline cohort. Canary identity is sticky for a subject so mixed versions do not hide a defect. Full traffic never occurs because a timer elapsed without an explicit promote decision.
Scope
- Canary slice size, sticky routing, soak windows, abort metrics, automatic abort, hold-for-promote, and operator override for stateless backend services.
- Comparison against a baseline running the previous gated version.
- Recording of abort reasons for the following rollback or roll-forward.
Outside this block
- Schema-compat checks that decide whether rollback of stateful data is allowed.
- Feature-flag targeting used as a substitute for binary canaries.
Contract
- Each canary names error-rate, latency-percentile, and saturation abort thresholds relative to the baseline over the soak window.
- When any named metric breaches, routing to the canary stops automatically within the abort-action bound and traffic returns to the baseline version.
- A given subject stays on one version for the canary identity TTL so retries do not oscillate.
- Soak completion without breach still requires an explicit promote; silent 100 percent shift is forbidden.
- Abort cannot be disabled by lowering sample size below the configured minimum observations.
- Operator override to continue a breaching canary requires a recorded reason and a second actor.
Implementation guidance
- Select a small, representative slice of stateless traffic; exclude one-off admin probes from the comparison population.
- Compute canary and baseline metrics from the same SLI definitions used for service objectives.
Failure handling
- Missing metrics during soak are an abort, not a pass: a dark canary cannot promote.
- If sticky identity storage fails, new subjects stay on baseline rather than being randomly assigned.
- Partial mesh update that leaves some edges on the canary after abort is a severity-one delivery incident.
- Baseline degradation during soak pauses promotion; it does not count as canary success.
Verification and operations
- Measure time-to-abort, aborted canaries by metric, promote-without-soak attempts, and sticky-identity collisions.
- Alert when traffic share exceeds the declared slice before promote.
- Prove with tests that a synthetic error-rate breach trips abort before the soak window ends.
The executable-looking examples in this package are fixtures and acceptance contracts. Run
python tools/validate.py from the collection root to check package structure and metadata; then
implement and execute the scenarios in the target repository.
Adoption assumptions
- Names and numeric values in
example.yamlare an adoption profile, not universal defaults. - The adopting team must map actors, data classes, error vocabulary, and ownership to its system.