Module rollout 

Percentage rollout: deciding which slice of matched traffic actually enforces (ADR 0009 D1).

The whole mechanism is one pure function, and the reason it is a function of a stable key rather than a random draw is the point of the module. Drawing per request would:

• flip a multi-turn conversation between enforced and observed mid-thread, so a user sees the model change for no reason they can perceive; and, worse,
• make the served population unstable. The distribution-free bound Firstpass publishes is computed over the population that was served — if membership is re-drawn every request, that population is not a stable sample of anything and the bound describes a cohort that never existed.

So assignment is hash(salt || key_kind || key_value): deterministic for a fixed salt, identical across restarts and across replicas sharing config, needing no coordination, and leaking nothing — the same salted-hash discipline crate::features::repo_fingerprint uses.

Structs

Rollout

Rollout settings for a route. Absent means “all matched traffic”, i.e. today’s behaviour.

RolloutDecision

The decision recorded on the trace, so an auditor can re-derive which arm a request was in.

Shadow

Shadow scoring settings for a route (ADR 0009 D2).

Enums

RolloutKey

Which stable identity a rollout holds constant.

Constants

BUCKETS

Buckets per rollout space. 10 000 gives two decimal places of percent, which is finer than any operator needs and keeps the modulo bias negligible against a 32-bit draw.

Functions

bucket_of

The bucket key_value falls in, within 0..BUCKETS.

decide

Decide the arm for one request.

in_rollout

Whether a bucket is inside a percent rollout.

request_identity

A stable identity for one request, for use as bucketing input when there is no session to key on. Hashes the request bytes, so the same request always lands in the same arm.