Module canary 

Auto-canary analysis (DW-091): metrics-driven promotion/rollback of canary split weights.

A CanaryController holds per-group state (one group per service split or AI model alias that configures canary_analysis). The controller maintains its OWN per-version sliding windows for error rate and latency (no new Prometheus histograms) using atomic counters and a bounded VecDeque of latency samples — the same lightweight pattern as the resilience domain’s AdaptiveController (DW-089) and the balancer’s PeakEwmaTracker.

Lifecycle

Compiled once per config generation from the canary_analysis blocks on service splits and AI model aliases; shared via Arc from the dataplane generation. record_outcome runs on the response path (after the upstream exchange resolves) and evaluate runs on the background CanaryRunner loop. Weight changes are TRANSIENT: the runner calls DataPlane::apply_service_split_weights / apply_ai_canary_weights, which clone the current generation’s split/runtime, rebuild with new weights, and ArcSwap-store. A config reload rebuilds the generation from the published config, reverting any transient weight changes (the controller’s sliding windows reset with the generation, like the adaptive controller).

Step semantics

Configurable step in weight units. Promote: increase canary weight by step (up to total_weight). Rollback: decrease by step (down to 0). Severe regression (>2x the rollback threshold): immediate rollback to 0. The total weight stays constant: when the canary weight changes, the baseline absorbs the difference, preserving the hash distribution for existing sessions (the DW-040 invariant).

Guards

• Cooldown: after one adjustment, the next is suppressed until cooldown_seconds elapses.
• min_requests: the controller does not act until at least min_requests total observations (baseline + canary) have been recorded.
• Disabled: a canary_analysis block with enabled: false compiles no group (the fast path: record_outcome and evaluate are no-ops).

Structs

CanaryAction

One evaluation result: the controller recommends adjusting group’s canary weight to new_canary_weight for the given reason.

CanaryController

The per-generation canary analysis controller (DW-091). Compiled once per config generation from the canary_analysis blocks on service splits and AI model aliases; shared via Arc from the dataplane generation. record_outcome runs on the response path and evaluate runs on the background CanaryRunner loop.

CanaryRunner

The background canary evaluation loop (DW-091). Spawned by dwara-bin after the dataplane is initialized; periodically calls CanaryController::evaluate, applies the returned actions through the dataplane’s transient weight-swap methods, and emits CanaryPromoted / CanaryRolledBack events. Dropping the runner (or shutdown) aborts the loop.

Enums

CanaryKind

Whether a canary group is a service-level split or an AI model canary (DW-091). Determines which apply_*_weights method the runner calls.