2.1 KiB
ADR-0051: Manual canary observations are rehearsal-only
Status: accepted for P00 containment, 2026-09-08.
The operational Console previously offered fixed successful and failed canary observations. The lifecycle service accepted those counters and health fields as canary results. Reaching the target count could satisfy the canary review gate without a measured request. Other promotion and approval checks remained; this finding does not imply unrestricted production promotion.
Remove both synthetic controls from the Console. Keep manual observation compatibility only for an explicitly persisted LAB rehearsal: a LAB_REHEARSAL subject in LAB, a consistent LAB approval with LAB_PROMOTION policy, and a plan targeting LAB_STABLE. Client labels and observation fields cannot grant that scope. Refuse other manual observations before changing counters, status or audit state. Attribute accepted manual observations to the authenticated operator and request correlation, and label their result as manual rehearsal evidence.
Also refuse non-rehearsal canary commits, including existing READY records with no authoritative evidence. Do not invent a trusted source flag that a client can submit to bypass the restriction. This deliberately leaves real canary qualification unavailable until P05 adds an authoritative evidence ingestion contract. Existing non-canary transitions retain their independent checks.
P05 must consume deduplicated real gateway requests for the exact candidate/deployment and time window, combine observed runtime/scheduler health without converting unknown to healthy, and use transactional concurrency control. Production qualification requires that follow-on implementation and isolated real-workload evidence. Manual LAB rehearsal proves only the lifecycle mechanics.
No schema change is needed for containment; existing result metadata can label the evidence. Rollback to the old implementation would restore the unverified-observation path and is not a safe remedy for blocked production canaries. Existing explicit abort/rollback operations remain available for reconciliation.