Progressive Rollout Runbooks for Agent-Driven Releases: Prod 10 → 50 → 100 with Claude Code

When the release pipeline contains a coding agent, the hardest question is not "will it ship?" — it is "how much damage can a misbehaving agent do in ten minutes?" On August 7, 2026, Octopus released a step-by-step tutorial that answered with a deceptively simple curve: Prod 10 → Prod 50 → Prod 100, wrapped in runbooks, with an autonomous Claude Code agent step that categorizes commits and automated validation gates between each stage. The whole point is blast-radius containment: a bad agent commit is caught while it still affects 10% of production traffic, not after it has replayed across the fleet.

This article turns that tutorial into a production-grade implementation. You will build the runbook set, the commit-categorization agent step, the validation gates, the staged-promotion rules, and the rollback path — with runnable YAML, a Claude Code agent, and a Python gate script. The philosophy, borrowed directly from Octopus's guide, fits in one sentence: progressive rollout converts an agent-release risk from a binary event into a measurable, gated curve.

Why Agent-Driven Releases Demand Progressive Rollout

A human-driven release has review, and a human mentally diffuses risk across the change. An agent-driven release replaces most of that with automation, which changes the risk profile:

1. Autonomy equals speed, not judgment. The Claude agent categorizes and even patches commits; every step it takes un-reviewed is risk it takes un-reviewed.
2. Signal is asymmetric. Broken deploys are loud (errors, pager), but silently degraded behavior — a rewrite that passes tests yet slows a hot path — is quiet. You need traffic-based telemetry, not just unit tests, to catch it.
3. Rollback after full rollout is surgery. If 100% of tenants run the bad build, rollback means a fleet-wide event. At 10%, rollback is a reload.
4. Agent behavior is non-deterministic. Two agents with the same prompt can produce a good commit and a catastrophic commit. You cannot "test" that away; you can only contain it.

The Octopus pattern treats the deployment like a fire that must not be allowed to grow. Each promotion stage is gated by real production metrics, not by a calendar. If the gate fails, the rollout stops, the runbook's rollback path executes, and an incident record is created — all before the blast radius exceeds the current stage.

The Architecture

graph TD
    subgraph CI[CI / CI/CD]
        VCS[Push to release branch] --> CL[Claude Code Agent Step / Commit Categorizer]
        CL -->|category: feature/security/refactor/release-blocker| BUILD[Build + SBOM + sign]
        BUILD --> ART[Push build to octopus / Octopus Deploy 2026]
    end
    subgraph RO[Progressive Rollout Runbook]
        ART --> P10[PROD 10% / tilting ring / LIFO ring]
        P10 -->|gate watch: 15 min| G1{Validation Gate 1 / error rate, p99, drift}
        G1 -->|fail| RB1[Rollback 10% + incident]
        G1 -->|pass| P50[PROD 50%]
        P50 -->|gate watch: 30 min| G2{Validation Gate 2 / + perf budget check}
        G2 -->|fail| RB2[Rollback 50%]
        G2 -->|pass| P100[PROD 100%]
        P100 -->|gate watch: 60 min| G3{Full-confidence gate}
        G3 -->|fail| RB3[Rollback 100%]
    end
    G1 -.metrics alerts.-> OBS[Observability / OTEL]
    G2 -.commit audit trail.-> AUD[(Audit Ledger)]
    RB1 -.runbook.-> RUN[release.rollback v1]

Two details matter in Octopus's design: the rings are LIFO-order (Prod 10 promotes to Prod 50 by promoting the newest 10% of tenants first, so the riskiest traffic is always the sharpest), and every gate reads production telemetry, not CI results. The Claude agent's commit categorization feeds the rollout decision: a commit tagged security forces the gate to add security-scan signals; a refactor tag tightens the perf budget.

The Runbook Set

Octopus runbooks are scripted, versioned, and environment-scoped. Here the 2026 YAML uses the runbook manifest introduced in the tutorial — runbook.yaml plus lifecycle steps. Create these inside a runbooks/ directory that is promoted with the project.

# runbooks/progressive-rollout/runbook.yaml
id: 2026.3481.progressive-rollout
name: Progressive Rollout - Prod 10 -> 50 -> 100
steps:
  - name: validate-build
    type: script
    script: steps/validate-build.sh
  - name: deploy-ring
    type: shell
    target_environment: Production
    script: steps/deploy-ring.sh

review: required

# -------------------------------
# runbooks/progressive-rollout/runbook.json
# alternative JSON form for API-driven triggers
{
  "id": "2026.3481.progressive-rollout",
  "steps": [
    {"name": "validate-build", "runner": "script"},
    {"name": "deploy-ring", "runner": "shell"}
  ],
  "gate": {"metric": "gate.thresholds.yaml", "watch_minutes": 15}
}

The design decision here: a runbook is not a script, it is a trigger-and-gate wrapper. Every runbook has an entry condition, a guarded action, and a rollback twin (release.rollback v1). When the validation gate fails, Octopus automatically clicks into the rollback runbook — no human initiates it.

The Claude Code Agent Step: Commit Categorizer

This is the genuinely agentic part of the tutorial. A Claude Code agent runs inside a CI return step, reads the diff of the release branch against main, and emits a structured category. The category becomes a first-class input to the gates: security triggers SAST re-checks and a longer watch window; release-blocker halts the rollout outright with a human review.

# .octopus/agents/commit-categorizer.yaml
name: claude-code-commit-categorizer
model: claude-sonnet-4.5   # or claude-opus-4.5 for larger diffs
agent: true
steps:
  - invoke: claude-code-elite
    args:
      - -p
      - |
        You are the release triage agent for the progressive-rollout runbook.
        Given the diff between origin/main and the release branch, return JSON:
        {"category": "feature"|"security"|"refactor"|"release-blocker",
         "confidence": 0..1,
         "summary": "<30 words>",
         "touched_services": ["..."]}
        A security change is any diff touching authn/authz, secrets, crypto,
        or network policy. A release-blocker is any change that alters
        migration order, public API signatures, or the artifact manifest.
      - read: $OCTOPUS_RELEASE_DIFF
      - output: /tmp/commit-category.json

The agent output is schema-validated before it touches anything: a malformed category fails the step rather than being guessed at. That is the same discipline as the commit-categorization contract in any serious agent pipeline — structured output or nothing. Our roundup of agent pipelines and their gates is in the AI Workflows section.

The categories then drive per-category gate tuning:

Validation Gates: gate.py

The gate reads production telemetry for the ring that is live and decides. The key trick copied from Octopus's tutorial is the rolling baseline: each stage compares against the observation window collected in the previous stage, not against a static threshold. A 5% error-rate budget is meaningless if the baseline has been 5% all week; the delta is what matters.

# gate.py
import json, time
from typing import Any

THRESHOLDS = {
    "error_rate_delta_pct": 2.0,
    "p99_delta_pct": 10.0,
    "perf_budget_delta_pct": 8.0,
    "auth_fail_spike_pct": 20.0,
}


def load(baseline_file: str, ring: str) -> dict[str, float]:
    with open(baseline_file) as f:
        return json.load(f)["rings"][ring]


def evaluate(baseline: dict[str, float], live: dict[str, float], category: str) -> tuple[bool, list[str]]:
    failures = []
    for metric, threshold in THRESHOLDS.items():
        if metric == "auth_fail_spike_pct" and category != "security":
            continue
        delta = abs(live.get(metric, 0.0) - baseline.get(metric, 0.0))
        if delta > threshold:
            failures.append(f"{metric} delta {delta:.2f}% > {threshold}%")
    return (len(failures) == 0, failures)


def watch(ring: str, minutes: int, category: str) -> dict[str, Any]:
    baseline = load("baseline.json", ring)
    deadline = time.time() + minutes * 60
    while time.time() < deadline:
        live = poll_ring_metrics(ring)  # OTEL -> Datadog/Grafana in practice
        ok, fails = evaluate(baseline, live, category)
        if not ok:
            return {"passed": False, "failures": fails, "ring": ring}
        time.sleep(30)
    return {"passed": True, "ring": ring}

poll_ring_metrics is your observability adapter; the gate only cares that live exposes the same keys as baseline. To wire these scripts into a release, our AI Workflows library has the CI plumbing playbook.

The Release Orchestrator: release.yaml

The tutorial's example project wires the three stages so that promotion is conditional. Octopus native triggers watch for the gate result and promote only on green.

# release.yaml
stages:
  - name: prod-10
    ring: lifo:newest-10%
    steps: [{ ref: runbooks/progressive-rollout, args: { ring: "10%" } }]
    gates: [{ ref: gate.py, args: { watch: 15, category: "$commit.category" } }]
    on_fail: [{ ref: runbooks/release-rollback, args: { ring: "10%" } }]
    telemetry: { window: 10m }
  - name: prod-50
    ring: lifo:newest-50%
    steps: [{ ref: runbooks/progressive-rollout, args: { ring: "50%" } }]
    gates: [{ ref: gate.py, args: { watch: 30, category: "$commit.category" } }]
    on_fail: [{ ref: runbooks/release-rollback, args: { ring: "50%" } }]
    telemetry: { window: 20m }
  - name: prod-100
    ring: all
    steps: [{ ref: runbooks/progressive-rollout, args: { ring: "100%" } }]
    gates: [{ ref: gate.py, args: { watch: 60, category: "$commit.category", full: true } }]
    on_fail: [{ ref: runbooks/release-rollback, args: { ring: "100%" } }]
    telemetry: { window: 30m }

Every promotion also writes a commit-audit trail — diff hash, category, gate inputs and outputs, promotion timestamps — into the release record, because the whole point of gating agents is being able to prove to an auditor exactly which agent decision caused which production state. If you are building that audit side separately, our pipeline-governance patterns in AI Workflows are directly reusable.

Retry and Error-Handling Rules

Progressive rollout removes the need for heroic retries, but the runbooks still define the error ladder:

The cardinal rule borrowed from Octopus's guide: never promote on a red or unknown gate — and never promote on a green gate that used stale telemetry. Both are the same mistake with different costumes.

Observability and The Quiet-Perf Trap

The error-rate gate catches crashes. It will not catch the refactor that makes a hot endpoint 12% slower. That is why the refactor category tightens the perf budget and why the p99/histogram deltas live in every gate. For agent-driven releases, also log agent activity itself: which commits the Claude agent categorized, the confidence it reported, and the diffs it touched. When a future gate fails, the first question should be answerable from telemetry: "which commit category, from which agent run, promoted this change to 10%?"

Metric levels worth tracking per stage, per ring — in your CI and in latest AI news, where model-vendor release notes frequently explain a sudden gate delta:

• Promotions per day and stage dwell time.
• Gate pass rate by commit category.
• Rollback frequency per ring.
• Mean time to detect a failed gate (MTTD) and mean time to roll back (MTTR).

Frequently Asked Questions

Why 10 → 50 → 100 instead of canary or blue/green? Canary (a small fixed slice) never gets to all production deterministically; blue/green doubles your infrastructure. Octopus's LIFO rings promote an ever-growing slice of real tenants, which gives you the traffic-based signal of a canary with a deterministic path to 100% and rolling-blade infrastructure economics.

What happens if the gate fails at Prod 50? The on_fail runbook rolls Prod 50 back to the Prod 10 ring and writes an incident record. Prod 10 — which was independently validated — stays live. The release is paused, not aborted, until the agent's change is fixed or the baseline evidence changes.

Does the Claude Code agent write code, or only categorize commits? The tutorial uses it to categorize commits and, optionally, to patch flagged categories within the runbook's sandbox. The pipeline treats every agent action as a candidate change that must pass the same gates as a human change — the agent never bypasses a validation gate.

Can a rogue agent burn all three stages before telemetry loads? No — that is the design. Each stage requires a watch window (15/30/60 minutes) with fresh gate telemetry before promotion. The minimum time to reach Prod 100 with zero incidents is the sum of the watch windows, and that delay is the blast-radius containment.

Do I need Octopus Deploy to run this pattern? No. The runbook and gate structure ports to any CI/CD with scripted steps and environment-scoped variables (GitHub Actions, GitLab, Tekton). The pattern — ringed promotion, telemetry gates, rollback runbooks, agent categorization — is the deliverable; the platform is an implementation detail.

Wrap-up

Octopus's Aug 7, 2026 tutorial landed in a world where releases are increasingly written by agents, and it answered the one question that matters: how do you limit the damage before you trust the agent? By promoting 10 → 50 → 100 through LIFO rings, gating each step on production telemetry rather than CI green, categorizing every commit with a Claude Code agent, and defining rollback as a first-class runbook, the blast radius of any single bad agent decision is bounded to the smallest ring you can still roll back by hand. In agent-driven software delivery, confidence is not a checkpoint — it is a curve.

Browse the full progressive-delivery playbooks in our AI Workflows archive, hook these gates up to your observability stack through MCP-powered tooling, and keep the vendor-release notes chaser with latest AI news.