31 lines
2.1 KiB
Markdown
31 lines
2.1 KiB
Markdown
# ADR-0051: Manual canary observations are rehearsal-only
|
|
|
|
Status: accepted for P00 containment, 2026-09-08.
|
|
|
|
The operational Console previously offered fixed successful and failed canary observations.
|
|
The lifecycle service accepted those counters and health fields as canary results. Reaching the
|
|
target count could satisfy the canary review gate without a measured request. Other promotion
|
|
and approval checks remained; this finding does not imply unrestricted production promotion.
|
|
|
|
Remove both synthetic controls from the Console. Keep manual observation compatibility only for
|
|
an explicitly persisted LAB rehearsal: a LAB_REHEARSAL subject in LAB, a consistent LAB approval
|
|
with LAB_PROMOTION policy, and a plan targeting LAB_STABLE. Client labels and observation fields
|
|
cannot grant that scope. Refuse other manual observations before changing counters, status or
|
|
audit state. Attribute accepted manual observations to the authenticated operator and request
|
|
correlation, and label their result as manual rehearsal evidence.
|
|
|
|
Also refuse non-rehearsal canary commits, including existing READY records with no authoritative
|
|
evidence. Do not invent a trusted source flag that a client can submit to bypass the restriction.
|
|
This deliberately leaves real canary qualification unavailable until P05 adds an authoritative
|
|
evidence ingestion contract. Existing non-canary transitions retain their independent checks.
|
|
|
|
P05 must consume deduplicated real gateway requests for the exact candidate/deployment and time
|
|
window, combine observed runtime/scheduler health without converting unknown to healthy, and use
|
|
transactional concurrency control. Production qualification requires that follow-on implementation
|
|
and isolated real-workload evidence. Manual LAB rehearsal proves only the lifecycle mechanics.
|
|
|
|
No schema change is needed for containment; existing result metadata can label the evidence.
|
|
Rollback to the old implementation would restore the unverified-observation path and is not a
|
|
safe remedy for blocked production canaries. Existing explicit abort/rollback operations remain
|
|
available for reconciliation.
|