From failure to a proven fix
- A failure counts only after it recurs in at least three independent, independently verified runs.
- A candidate change replays the same real tasks as the current version, including adversarial ones, and is proposed only if nothing regresses.
- An approved change goes to a small share of runs first, and the canary stops on its own if results get worse.