Canary

Roll the change out to a small subset of targets first, verify, then progressively expand — limits blast radius if something's wrong, at the cost of a slower rollout.

Why we need this / what value this brings

Limits how many targets are affected if the new version has a problem PIV didn't catch (or catches late) — 5% of a fleet failing is a very different incident than 100%.

When to use this

Any rollout where the blast radius of a bad deploy is large enough to be worth the slower, staged rollout.

How to use or implement this

Deploy to a small subset first, run full verification against just that subset, and only proceed to the next batch once verification passes — halt the whole rollout automatically on the first batch's failure.

Research questions

• Would upgrading one device (or a small batch) first and running PIV against just that subset have caught the failure before it touched the full fleet?

---

Empty folder — drop notes, links, and findings here as you research.