Set release boundaries for the versioned prediction HTTP service

Before release, define what the artifact refuses to do. The operational risks here are schema drift, model load failure, slow requests, leaking input data to logs, and a release whose error rate exceeds the rollback trigger. Validate ranges, minimize retained data, pin the reviewed configuration, and assign an owner who can disable the feature. Safety is implemented at the boundary and release process; it is not a warning paragraph placed after an unsafe function.

The artifact's user-facing goal is specific: put a tested threshold model behind a stable JSON boundary with health, prediction, metrics, and rollback behavior. Its accepted input is JSON containing a finite numeric features array of length two. Those statements are intentionally narrower than “build an AI system.” Narrow scope lets us inspect every input and expected result, and it prevents a toy result from being presented as a production claim. Run this gate as part of a release command. A failed assertion means stop, investigate, and do not publish.

Save this as lesson.py and run python3 lesson.py. It uses only the language standard library, so the example is reproducible offline.

candidate=[1,0,1,1]; stable=[1,0,0,1]
disagree=sum(a!=b for a,b in zip(candidate,stable))/len(stable)
print({'canary_disagreement':disagree,'rollback':disagree>.1})

Expected output: disagreement 0.25 and rollback True. Exact floating-point formatting may vary slightly, but the asserted behavior must not. Read the output as evidence about this stage, not merely proof that the interpreter started.

Reproduce a bad request with curl, then inspect validation outcome, status code, model version, and duration. Do not send malformed data into predict and do not turn validation failures into HTTP 500. Compare candidate and stable predictions on the same canary payloads. A health endpoint proves the process is responsive; it does not prove prediction quality or model loading unless those checks are explicit.

At the safety and operations stage, save the smallest failing fixture beside the expected result. Change one cause at a time and rerun the exact command printed above; that makes the repair reviewable and keeps this chapter's progressive artifact reproducible.

Run contract, malformed-input, health, and smoke tests against the packaged service. Record p95 latency, validation-error rate, server-error rate, model version, and canary disagreement. Trigger a rehearsal rollback when disagreement exceeds the documented threshold. Verify the previous artifact actually starts; a rollback name in a checklist is not recovery evidence.

For this safety and operations page, preserve the fixture and result as evidence for the next page. Label observations separately from conclusions: a passing assertion establishes the behavior it names, while broader usefulness requires the chapter's full evaluation set and stated operating limits.