# ZD-06 — Measured rollout probe

Status: LOCAL_DONE (tooling) / LIVE_ACCEPTANCE_OWED
Validation: PASS (local fixtures only)

B-BR-CD-ZD-07: Every scheduled request, including a slow synthetic upload,
must succeed without retries. Saturation, redirects, non-2xx, transport errors,
missing/broken Kubernetes observation or any unavailable replica fail the
campaign. A successful HTTP window without an observed completed image rollout
is not a zero-downtime proof. Log route labels and error types, never signed
URLs, headers, bodies, raw kubectl output or private connection details.

BUC-CD-ZD-06: In an individually approved staging campaign, the operator runs
the public probe with a private short-lived synthetic-upload descriptor and a
namespace-scoped kubectl watch while a signed release rolls out. Keep exact
request and availability events plus summary/p99. Three distinct signed
rollouts must pass; failed campaigns stay recorded and must be fixed/rerun.

Live campaigns are OWED. No ZD-05 edge change is justified without a measured
edge failure. Surge default stays OFF. Local fixture runs never count as live
rollouts, and HTTP-only mode can never return acceptance PASS.

Tested parent 7ceed35d plus task: seven real local HTTP/subprocess campaigns
PASS. They cover completed image change, 503, unavailable replica despite
healthy HTTP, no image change, HTTP-only incompleteness, saturation and private
file permissions; signed URL canary never appears in output. Python compile,
secret scan and diff-check pass. No runtime dependency added.

Usage after individual campaign approval (private descriptor must be 0600):

```sh
python3 infra/scripts/rollout-probe.py --duration 600 --rate 20 \
  --slow-upload-file "$PRIVATE_DESCRIPTOR" --slow-start 120 \
  --output /tmp/zd06-campaign-01.jsonl
```

The descriptor contains `url`, optional `headers`, `bytes` (default 262144),
`bytes_per_second` (default 65536). It must be a short-lived authorization for
one synthetic quarantine object on the same staging origin; retain cleanup
ownership outside this probe. Schedule its start to overlap pod retirement,
then verify that overlap against deployment/journal timestamps. Output is
mode 0600, exclusive-create, no retries or redirects; saturation and scheduler
lag fail. Kubernetes watch is fixed to the staging API and retains only
availability/generation plus a hash of image identities. The summary requires
an observed completed image change, zero unavailable samples and successful
slow upload. Exit 2 means incomplete evidence, never acceptance. HTTP-only is
an explicit diagnostic mode and cannot pass. The owner still must associate
each of three live passing reports with its distinct signed release receipt.