Lua limit scripts are versioned and released separately from the Go binary. A change to the limit algorithm is a behaviour change even when no Go code moved, and treating it as a config file is how a quota bug reaches production unreviewed.
Script changes go through a shadow dual-run: both versions execute against live traffic, only the current one is authoritative, and the verdicts are compared. A discrepancy blocks promotion.
Canary analysis gates on the SLO directly — decision p99 and reject-rate delta — not on pod health. A pod can be perfectly healthy while rejecting twice as much traffic as it should.
Gates
Race detector and fuzz tests on the decision path; a 10k rps soak in staging before any canary.
Golden-file tests for the limit scripts: a fixed sequence of requests must produce an identical verdict sequence across versions.
Argo Rollouts at 5% for 15 minutes with automatic rollback if decision p99 exceeds 10 ms or the reject rate moves more than 10% against baseline.
Assumptions
Images are signed with cosign and an SBOM is produced per build; admission control rejects unsigned images in production.
OpenTofu is used rather than Terraform for licence reasons; the module structure is otherwise conventional.
Staging carries a synthetic tenant set derived from production shape, not production data.
