feat(cli,core): ramp the default-on router through the canary

Rebased onto main (was 308 behind) and gated the new default-on behaviour on
the de-parallel-router canary, at 5%.

Default-ON without a ramp is a ~17x exposure jump: from ~6% of eligible
renders today to all of them, landing on profiles the opt-in trial never
covered (<=4 CPUs and Docker, ~12% of eligible renders between them).
0.7.60-0.7.64 is why that matters — every unclamped render reverted for five
consecutive releases and nobody noticed.

The gate reuses the breaker's own disarm: non-enrolled installs get an
explicit HF_DE_PARALLEL_ROUTER=false, because with default-ON polarity
deleting the var means ON. Setting the registry percentage to 0 is therefore
a full fleet-wide revert with no release.

Today's ~11% of installs routing is emergent — the product of eligibility
rules and a capped trial — so it drifts with fleet composition and cannot be
turned off without shipping. The point of the canary is that the number
becomes chosen and revertible, not that it is smaller.

Also replaces the registry test that pinned the percentage to 0. Its intent
was 'ramp only alongside the circuit breaker', but pinning 0 blocks the ramp
forever and never checks the wiring it names. It now asserts the wiring
directly, and fails if either the canary gate or the breaker consult is
removed.

Hold at 5% until PRINFRA-372 resolves: --workers auto crashes every worker on
macOS arm64 while --workers 1 is clean, and the router forces 3 workers.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Vance Ingalls
2026-08-07 15:10:47 -07:00
co-authored by Claude Opus 5
parent af535080a2
commit 4a2514232b
4 changed files with 112 additions and 3 deletions
+13 -1
View File
@@ -83,7 +83,19 @@ export const CANARIES: readonly CanaryDefinition[] = [
// ── Real rollouts ────────────────────────────────────────────────────────
{
name: "de-parallel-router",
percentage: 0,
// Ramp 5 -> 25 -> 100. This gates the DEFAULT-ON behaviour (uncapped, no
// telemetry precondition), not the old capped trial — so 0 means the
// router is off for everyone and is a full revert without a release.
//
// Calibration validated the bucketer first: 9.62%/49.76% against 10%/50%
// targets at n=13,547, overrides and CI both attributable, sustained
// cohort flips at 0.10% — an order of magnitude under this feature's own
// ~2.79% revert rate.
//
// At each step split revert rate by cpu_count and is_docker. Hold at 5
// until PRINFRA-372 is resolved: `--workers auto` crashes every worker on
// macOS arm64 while `--workers 1` is clean, and the router forces 3.
percentage: 5,
description:
"Route auto multi-worker renders to verified parallel drawElement streaming (HF_DE_PARALLEL_ROUTER). Ramp only alongside the per-install circuit breaker.",
owner: "vance",