Canary Cutover Runbook
How traffic moves from legacy hh-pegasus → monorepo hh-ionic (Cloudflare Pages /
ionic.hungryhub.com). Incremental and reversible. Never flip 100% at once.
Owner: Irfan (Platform, execution) · Tompi (business go/no-go) · Saiqul (metrics).
Prerequisite: Gates 0–3 all ✅ (01-phases-and-gates.md).
Mechanism
Weighted routing at Cloudflare — Pages project / DNS weighting / Worker split. Coordinate
the exact mechanism with hungryhub-terraform/hh-cloudflare before W8. Legacy stays
deployed and instantly re-routable for the entire rollout.
Rollout stages
| Stage | Traffic | Hold | Routing | Watch |
|---|---|---|---|---|
| Dogfood | team + beta only | 3–5 days | header/cookie | manual QA + error rate |
| Canary | 5% real users | 24–48h | weighted | error rate, conversion, p95 latency vs legacy |
| Ramp 1 | 25% | 48h | weighted | + revenue/conversion delta |
| Ramp 2 | 50% | 48h | weighted | same |
| Full | 100% | 1 week soak | weighted | same, before decommission |
Advance a stage only if all watch metrics are within agreed margin of legacy baseline.
Metrics to watch (per stage)
Captured by error monitoring + analytics wired in Phase 3:
- JS error rate (Sentry or equiv) — monorepo vs legacy baseline
- Booking conversion rate — funnel completion, monorepo cohort vs legacy cohort
- p95 / p99 latency — page load + key API calls
- Payment success rate
- Core Web Vitals (LCP, CLS, INP) from real-user monitoring
Rollback triggers (any one → revert to previous % immediately)
- JS error rate exceeds legacy baseline + agreed margin
- Booking-conversion drop beyond statistical noise
- p95 latency regression vs legacy
- Payment failure spike
- Any P1/P2 incident attributable to the monorepo app
Rollback procedure
- Set Cloudflare weight back to previous stage (or 0% → all traffic to legacy).
- Confirm legacy serving 100% and healthy.
- Open incident; capture error signatures + repro.
- Fix on a branch, add regression test (TDD), re-verify on staging.
- Resume rollout from the last good stage, not from where it failed.
Rehearse this procedure in staging during Phase 3 (task 3.4) before any real cutover.
Decommission (Gate 4 final)
Only after 100% + 1-week clean soak with no rollback trigger fired:
- Tompi confirms business sign-off.
- Irfan removes
hh-pegasusinfra (CF Pages project, DNS, build pipelines) viahungryhub-terraform. - Archive legacy repo / mark read-only.
- Document the completed cutover in
knowledge-base/src/DevOps/.