Guarded releases

A guarded release watches a flag’s percentage rollout against guardrail metrics and an optional SLO, and reverts the rollout automatically when the treatment variation looks worse than the baseline. It reuses Oriel’s own telemetry: the metrics read existing spans, logs, or metric points, and the rollback is the same fallthrough edit you would make by hand.

Metrics

A metric is a project-scoped, OQL-backed measurement reused as a guardrail (and, later, as an experiment goal). It reduces telemetry to one scalar.

Field	Meaning
kind	ratio (matching events over all events), mean (a numeric field averaged), or count.
source	spans, logs, or metrics.
selector	An OQL predicate selecting the matching events, for example http.status >= 500.
value_field	The numeric attribute a mean averages.
unit_attribute	The attribute carrying the randomization unit id on outcome telemetry, joined to each unit’s exposure.
direction	up when a rising value is a regression (error rate, latency), down when a falling value is (success rate, throughput).

Create one under a project, then read its current value with explain:

POST /api/v1/workspaces/{ws}/projects/{p}/metrics
GET  /api/v1/workspaces/{ws}/projects/{p}/metrics/{id}/explain?window=1h

The selector is compiled against the OQL grammar at create time, so a malformed predicate is rejected before the metric is stored.

Configure a release

Attach guardrails to a flag’s rollout in one environment from the flag’s Release tab, or over the API:

PUT /api/v1/workspaces/{ws}/projects/{p}/environments/{e}/flags/{key}/guarded-release

Field	Meaning
baseline_variation	The control arm. Each other served variation is compared against it.
guardrails	A list of {metric_id, threshold?, op?}. The metric must be a ratio or mean.
slo_id	An optional SLO whose burn-rate alerts also trip a rollback.
analysis_window	How far back each evaluation looks, for example 1h.
min_samples	The per-arm sample floor below which no rollback fires.

A guardrail’s optional threshold and op (>, >=, <, <=, ==, !=) add an absolute limit on the treatment arm, on top of the relative comparison.

Arming and rollback

Arming snapshots the flag’s current fallthrough as the safe state, then the worker begins evaluating the release each tick:

POST .../guarded-release/arm
POST .../guarded-release/disarm

A guardrail breaches when, with at least min_samples units in each arm, either:

• the treatment arm regresses against the baseline in the metric’s direction, judged by an always-valid sequential test (an asymptotic confidence sequence). Because it is always valid, evaluating it on every worker tick does not inflate the false-positive rate, so a healthy release is not rolled back for being watched continuously; or
• the treatment arm’s value crosses the guardrail’s absolute threshold.

A linked SLO breaches when any of its burn-rate alerts is firing. On any breach the worker reverts the flag’s fallthrough to the armed snapshot, records a rollback event, and marks the release rolled_back so it is not evaluated again. The revert is an ordinary flag change and appears in the flag’s history.

The treatment-vs-control comparison joins each unit’s first exposure to its outcome telemetry, so the outcome telemetry must carry the unit id under the metric’s unit_attribute. See Feature flags for the stamping convention.

Permissions

Permission	Allows
flags:read	View metrics, guarded-release status, and rollback history.
flags:write	Create and edit metrics, configure a guarded release, and arm, disarm, or delete it.