Rolling a new agent workflow out to 10,000 analysts at once is operational suicide. Ramp by risk instead: shadow (recommend-only) → small auto-execute → full. The slider only advances while human overrides and errors stay under ceiling and the flash-crash breaker hasn't tripped — and it snaps back to shadow the moment it does.
Honest scope. A deterministic ramp decision — given the current phase + the live override/error/volume signals + breaker state, it returns advance / hold / rollback against your ceilings; it does not collect the metrics or flip the flag (your runtime does, on this verdict). It's the production gate after the eval build gate. FAIL-CLOSED — a tripped or unknown breaker state and an unrecognized phase roll back to shadow; a non-finite metric holds (never ramps on un-measurable data); advancing needs both ceilings met AND minimum volume. Source: flowdesk-rollout-kernel.js.