canary

Two problems wear one costume here: how you would have caught this before full rollout, and how you debug it after the fact. Cover both and you show senior judgment. This walks through the staged-rollout and root-cause playbook.

Deploying a model is more than flipping a switch. The signal is knowing what each rollout strategy validates, why shadow is uniquely useful for ML, and keeping rollback a single step away. Here is the comparison and when each fits.

A bad model in production needs a fast, safe rollback, but ML rollback is harder than code: the model is data and the truth signal lags. What matters is pre-defined criteria plus a previous version kept warm. Here is the answer.

Shadow deployment validates a new model on real traffic without exposing users to it. What matters is knowing outputs run in parallel then get discarded, and how it complements canary and A/B. Here is the answer.

Manual rollback means minutes of damage while someone wakes up. What matters is defining the trigger signals, thresholds, and guardrails that revert automatically, without flapping on noise. Here is how to make the loop safe.

Saying 'route 5% to the canary' is the easy part. What matters is how you split traffic deterministically, gather enough signal to decide, and ramp on evidence rather than vibes. Here is the mechanics layer.