Change releases

Hold rate must not move more than two points in either direction during canary.

Any precision drop beyond one point ends the canary automatically.

Precision regression on partial-payment cases that the previous version handled. Rolled back inside the canary window before any unit reached a customer.

Failed change rate above 3 percent ends the canary and reverts the band the same day.

Over-refusal above 4 percent triggers review, because refusing everything also passes this test.

Over-refusal is measured weekly by sampling, not continuously. A spike inside a week would not be caught until the sample runs.

Retirement requires every exception class the agent owns to have a named receiving owner first.

Blocked for 38 days with no owner assigned to unblock it. Nobody is accountable for the blockage itself.

A sampling change must be justified against detection power, not against review cost.

Human queue growth above 12 percent ends the canary, because routing everything to a human is not an improvement.

The confidence signal the threshold reads has never been calibrated against outcomes, so the threshold is tuned on a number of unknown quality.

Agreement below 85 percent ends the canary. Revocation stays human until agreement holds for a full cycle.

Recall drop beyond one point ends the canary.

An average across nine consumers hid a failure concentrated in one. The canary metric was the wrong shape, not the wrong threshold.

The lesson was recorded and the guardrail is still expressed as an average. Shared components need a per-consumer floor, and that change has not been made.

Nothing may route on the band until calibration is measured against outcomes for a full quarter.

This change went to canary without an evaluation run, on the argument that a display-only change cannot cause harm. That argument was accepted and is recorded here rather than hidden.

Any tranche below 90 percent halts the remaining tranches.

Ninety-four percent is not a pass. Six percent of injection cases still succeed against agents that are live, and the remaining work has no scheduled date.

Escalation volume above the cap reverts the threshold automatically.

No evaluation was run. The change was treated as a dial rather than a decision, and a threshold that triples escalations is a decision.

Cannot leave draft until the human capacity implication is modeled against live volumes.

False-positive holds above 1 percent revert the window.

Any write attempt against the change calendar is a hard failure and stops the agent.

The gate refuses the promotion. It does not offer a discretionary override.

A change that cannot be canaried needs a rehearsed rollback before it ships. That rehearsal has not been scheduled.

Two agents have been running without the injection hardening for 84 days because their runtime cannot stage a canary. The exposure is known and unremediated.

The pre-check may not become blocking until its own false-positive rate is measured.

None needed. The change removes an uncontrolled path rather than adding one.

This only covers the 178 agents under lifecycle management. The other 1,183 still float.

Cost per unit was the only guardrail, which is how this change passed the first three days.

The change optimized the metric it was measured on. Clause recall was not in the canary guardrail, and the omission is the finding.

A 97 percent accurate correction is a 3 percent wrong journal entry. Accuracy is not the gate; reversibility is.

The emergency path exists and was used correctly. It was also requested and approved by the same person.

Requested and approved by the same person under the emergency path, with no evaluation run and no canary. The retrospective was never held.