Name the canary before you raise the share.
"We'll start at a small percent" sounds careful. Later you learn the first slice was internal accounts or one region, and you ramped a path you never actually watched. A canary only teaches you something if you named who was in it.
Before raising traffic on a new path, name who is in the first audience and who is excluded, what success and abort look like in the system, and the freeze rule if the canary turns out not to be the audience you intended. A percentage without a named set is not a canary.
A percentage is not an audience
A team says they will “start at a small percent.” Nobody writes who those people are, what they were supposed to represent, or what would make the team stop. The dashboard moves. The share goes up. Later you learn the first slice was internal accounts, a single region, or whoever happened to refresh. You ramped a path you had not actually watched.
A canary is useful when the first audience is a named set, the signals that count as success or abort are things you can point at in the system, and expansion is frozen when the audience was not the one you specified. It is not useful when the percentage is the whole plan.
This note is the TWIMCO Canary Audience Spec. One page, one path. You name who is in, who is out, what “share” even means, which signals abort, and the freeze rule if the canary lies about who it reached. You do not copy a starting percent from this page. There is no live canary tool. If you are still defining the path, use the live custom product build brief. A brief is not a ramp.
This is not a shadow-mode promotion rule for an agent, and it is not a dual-write cutover. Shadow mode asks whether a proposal matches a human before the agent may act. Dual-write asks whether two stores agree. A canary asks whether a real slice of the audience can use a new path while everyone else still sees the old one.
On Sutton|Place, a supplied claim does not become confirmed because it appears in the product. Checks stay distinct from confirmation, and a decision stays attached to an actor. “The canary looks fine” is a claim. The spec is how you check it. Do not treat the partnership as a traffic-ramp case study. Treat it as the habit of refusing to confirm what you have not actually observed.
Write the spec before the first external user hits the new path. If the path is already on for everyone, you are writing an incident note, not a canary.
Name the set, then the share
Fill the page in this order. The order is the point. Share comes after the set exists.
Path. What changes for someone inside the canary, and what stays the same outside it. If you cannot describe the outside experience in one sentence, you do not know what you are withholding.
Audience. Who is in the first set: a named list, a role, a region, a deal type, a device class—whatever matches the risk. Who is excluded on purpose, including internal users if they do not resemble the people who will carry the failure. “Random five percent” is not an audience until you write the random-of-what: accounts, sessions, requests, or devices. Those are different products.
What share means. One unit only. If you mix account share and request share, the number on the chart is not the exposure you think you have. Write the unit on the spec so a later reader does not “raise it to twenty” of the wrong thing.
Selector. How the product decides membership, and where a person can look to see why this account was in or out. A flag with no explanation is a canary you cannot audit. Include what happens mid-session if membership flips. Flipping under someone is a second change, not a continuation.
Owner. The role that may expand, hold, or abort. A channel where anyone can edit the percent is not an owner. Name a backup for the hours you actually ramp.
Hold time. How long the first set must run before expansion is even discussable. Write it as a condition you can meet—“through one business day’s batch,” “through one live event”—not as a vibe. Do not take a duration from this note.
The spec is incomplete if audience, unit of share, selector, or owner is blank. Incomplete means the percent stays at the named first set, or at zero. It does not mean you pick a tasteful small number and proceed.
How the work moves
Specify the audience before any ramp
- Name the path
What insiders see, and the one-sentence experience everyone else keeps.
- Name the set
Who is in, who is excluded, and the single unit the share refers to.
- Write the selector
How membership is decided, and where a person can see why.
- Set signals
Success and abort conditions you can point at; no borrowed threshold.
- Freeze if it lies
Hold expansion when the set was not the audience you named.
A canary that was not the audience you named cannot tell you the new path is safe.
Success, abort, and a canary that lies
Signals belong on the same page as the audience. A signal that is not observable in the system is a mood.
Success signals. Two or three conditions that must be true of the named set before anyone may expand. Prefer states you can open: the new path completed, the old path did not double-write, support did not receive a class of ticket you listed, a check you already trust still passes. “Error rate looks normal” is not a signal until you name the error and the place it is counted. This page does not supply a threshold. You write the comparison you are willing to defend, or you write “no numeric bar; a named person must read these cases.”
Abort signals. Conditions that stop expansion and return the named set to the old path, or hold them where they are if return is unsafe. Include a qualitative abort: a single failure mode you said you would not tolerate, even if the averages look calm. Averages hide the case the canary was supposed to find.
Freeze if the canary lies. Expansion freezes, even when the signals look good, if any of these are true: the people in the set were not the audience you named; the selector included a population you marked excluded; you cannot tell who was in; the unit of share was changed mid-ramp; internal traffic drowned the set. A healthy chart on the wrong people is not permission. The owner records the lie and the hold. Raising the share to “get a better sample” is how a lie becomes the launch.
What everyone else sees. Confirm the old path is still the default and that canary-only copy, prices, or jobs are not leaking out through email, caches, or a shared queue. A canary that changes a message the whole book receives is not a canary.
Walk it once outside production with a set of two or three test identities you can name. Show inclusion, exclusion, an abort that returns them, and a freeze when you deliberately mis-tag the set. If you cannot show the mis-tag freeze, the lying-canary rule is a sentence without a switch.
On Sutton|Place-shaped work, do not let a green verification banner stand in for the check. The canary spec is the check: audience first, signals second, actor on the decision to expand. If the new path is a disclosure or another explicit action, the canary must not send that action to people outside the set because a template was global.
Ramps that only sound small
Composites, not client telemetry.
Percent as courage. The team argues about 1 versus 10 and never writes the set. Both numbers are unattached to a person you could call.
Internal canary. Staff accounts sail through a path that fails for a first-time participant with incomplete data. The spec’s exclusion line was empty, so employees became the evidence.
Chart without a unit. Requests from one noisy integration dominate the percent. Account exposure is tiny. The team expands because the graph looked busy and fine.
Abort with no return. The signal fires and the new path stays on because “rolling back is riskier,” which nobody wrote down before the ramp. The abort line was a hope.
Quiet expansion. Someone raises the share in a console because a meeting ran long. The owner on the spec is not the actor in the log. The canary ended as an unreviewed edit.
When you see these, do not pick a smaller percent. Return to the set, the unit, and the freeze. The unreproducible asset is the filled TWIMCO Canary Audience Spec: your path, your named set, your unit, your success and abort signals, and the freeze you tested with a mis-tagged identity. A generic progressive-delivery checklist does not contain that test. Your notes from it do.
Keep the spec with the flag card if a flag is how you select the set. The flag card says how you kill the path. The canary spec says who may see it before everyone does. They are not substitutes. Killing a flag you have already ramped to the whole population is a different, worse day. Web applications scoping is the right conversation when the selector cannot actually explain membership. Business process automation fits when the leak is a job that ignores the set and acts for every record.
Do not invent a success rate to justify expansion. If you do not have a signal you trust, the honest spec says the ramp waits. That sentence is more useful than a precise-looking percent.
Decision guide
A small percent versus a canary
| Consideration | Sounds careful | Is a canary |
|---|---|---|
| First slice | A percent with no named set. | A set, an exclusion list, and a unit of share. |
| Healthy chart | Averages moved the right way. | Signals you wrote, read against that set only. |
| Wrong people | Expand anyway to “get a better sample.” | Freeze, record the lie, and do not raise the share. |
| Who expands | Whoever has the console. | The owner on the spec, after the hold condition is met. |
Put this into practice
- Pick one path that is tempted to “start small” and is not yet on for everyone.
- Write the audience, the exclusions, the unit of share, the selector, and the owner before you write a number.
- Add success signals, abort signals, and the freeze rule for a lying canary. Leave thresholds blank rather than borrowing one.
- Rehearse inclusion, exclusion, abort, and a deliberate mis-tag. Do not expand if the mis-tag does not hold.
- File the page with the change. If the product cannot tell you who was in the set, fix that before any share moves, and bring the gap to web applications work. Read Sutton|Place for the standard that a claim of “fine” stays unconfirmed until someone can point at the check.
Small is not a number. Small is a set you can name, watch, and refuse to outgrow on a lie.
We build alongside the people doing the work.
Bring us the problem you’re thinking about.