Canary and operate rate limiting

From a fresh clone/directory, run the commands that prove StormCo at 200 RPM gets 429 after burst; Globex at 40 RPM unaffected. A second person plays platform SRE stopping noisy neighbor tenant StormCo and follows your script without coaching. The demo includes limitations: what layered token-bucket limiter for multi-tenant RAG API still will not do.

Bundle: contract snippet, passing tests, metric snapshot for 429_ratio_by_tenant and provider_429_ratio ≤ 0.01, security negative probe, rollback note, owner name. Reference RL-FAILOPEN-61 as the drill you rehearsed. If any item is missing, the ship gate fails even if the happy path dazzles.

For Rate limiting lab, name the human who gets paged, the review date for thresholds, and the condition that triggers reevaluation. Endpoint POST /v1/rag/answer remains the production surface you operate for layered token-bucket limiter for multi-tenant RAG API — not a slide. Keep RL-FAILOPEN-61 in the handoff template so the next owner inherits the drill.

After the peer demo, schedule the next threshold review date. File a short changelog that mentions RL-FAILOPEN-61 and the control that addresses it. Archive the evidence pack where your team already stores launch records. Resist rewriting everything “for real production” in one weekend — operate this slice until the metrics bore you, then widen. Final self-check: if telemetry vanished, would you still know to hold? If yes, you learned the operating posture this lane teaches.

Trim the demo script until every command is necessary. Record a peer signature line: name, date UTC, pass/fail. File known limitations as bullets, not apologies. Link the evidence pack from the README. Schedule the next game day on a calendar, even if it is solo. Archive the branch tag or release digest you actually shipped. In this chapter the product is layered token-bucket limiter for multi-tenant RAG API, the human stakeholder is platform SRE stopping noisy neighbor tenant StormCo, and the incident id you design against is RL-FAILOPEN-61. Re-state the oracle in your notes — StormCo at 200 RPM gets 429 after burst; Globex at 40 RPM unaffected — and keep the invariant visible: tenant RPM soft=60 hard=100; global 5k RPM; 429 includes Retry-After. Track 429_ratio_by_tenant and provider_429_ratio ≤ 0.01 as the scoreboard. Surface under change control: POST /v1/rag/answer. If you only have forty minutes, finish the fixture for Redis down → fail-open floods provider → shared 429s before polishing UI. Promotion language stays ternary: promote, hold, or roll back based on evidence, not hope.