Staged-Rollout Loop
Changes deploy in expanding stages (canary, cohort, full) with health verification and a rollback decision between each stage. The agent's job is running the checks and honoring the gates.
When to use
Agent-driven deployment where a bad release must be caught at 1% exposure, not 100%.
Steps
| Step | What happens | Verification |
|---|---|---|
| Stage deploy | Release to the current stage's scope only. | Scope confirmed via the deploy system, not assumed. |
| Health verify | Check the stage's health signals against pre-agreed thresholds for the soak period. | Thresholds written before the rollout; signals read from real telemetry. |
| Advance or roll back | Healthy advances to the next stage; unhealthy rolls back and escalates with evidence. | The decision is recorded with the signal values that drove it. |
Specification
| Verification method | Pre-agreed health thresholds on real telemetry per stage. |
|---|---|
| Recovery behavior | rollback-and-escalate |
| Observability | Stage log with signals and decisions. |
| Inputs | Release artifact, Stage plan, Health thresholds |
| Outputs | Safe full rollout, or contained failure |
| Risk level / maturity | high / established |
Failure modes
- Thresholds defined after seeing the data
- Soak periods shorter than failure onset
- Rollback path untested until needed
Assessment
Deployment engineering's proven loop, restated for agents because agents now run deploys. The rule that thresholds precede data is what makes the health check verification instead of rationalization.