Kaveri Labs runs a satellite telemetry platform with six engineers and, until last spring, one very tense Thursday ritual. Someone merged, someone pressed deploy, every customer met the new build in the same instant, and the whole team stared at dashboards like launch controllers watching a countdown that never quite cleared the tower. Three ugly Thursdays in a row pushed them toward ReleaseOps — the craft of treating a release as a sequence of small, reversible exposures instead of a single leap. What follows is a fictionalized account, but the practices and the arithmetic in it are the parts worth keeping.
Where ReleaseOps Enters the Story
The turning point was not a tool. It was a question from Priya, the on-call engineer for that quarter: “When we say we released, what exactly did we do?” The team wrote three answers on the whiteboard and realised they had fused them into one ceremony. They install a version on servers. They let users encounter its behaviour. And they announce it, in emails and changelogs, as one indivisible event. Bundle those together and every Thursday becomes all-or-nothing: nothing is staged, nothing is measured, and there is no graceful way back.
Their reference reading that week — a walkthrough of how spacecraft flight phases break a mission into stages — helped more than any boxes-and-arrows diagram. Liftoff, stage separation, orbital insertion: nobody calls those one event. Each phase has entry criteria, its own instruments, and its own abort options. The release-strategy layer asks software teams to slice delivery the same way, and it begins with a confession: installing software and exposing it to users are different acts.
“We were not releasing on Thursdays. We were deploying, exposing and celebrating in one breath, and calling it a process.”
Two Dials, Not One Switch
Once the acts are separated, the ceremony splits into two independent controls:
- The deployment dial answers “which version runs where.” Turn it and new code lands on chosen machines.
- The exposure dial answers “who sees which behaviour.” Turn it and more users meet the new logic.
A feature flag moves only the second dial — the code ships dark, invisible to customers, and the team decides who can see it. A canary or a blue-green flip moves both at once: a new version is installed somewhere narrow, and traffic is steered toward it. Kaveri Labs had flags for years without this vocabulary. What they lacked was the discipline to treat the two dials as separate decisions, each with its own evidence attached.
Config counts too
The whiteboard session produced one more uncomfortable finding. Behaviour reaches users through more doors than code: configuration, flags, content edits, policy data. Each of those is a release in its own right, whether or not a build number moved. The team stopped tracking “deploys” and started tracking behaviour changes — and the count went up immediately.
The Canary Gets a Budget
Everyone’s first canary attempt is ceremonial: one percent of traffic for five minutes, nothing catches fire, everybody declares victory. The arithmetic says otherwise. To notice the error rate doubling from 0.2% to 0.4% — with a 4-in-5 chance of catching it and a 1-in-20 false-alarm allowance — a service handling fifty requests per second needs roughly four thousand requests through the canary. At one percent of traffic that is a little over two hours. Widen the slice to ten percent and the same evidence arrives in about thirteen minutes. A short, quiet trial cannot even register a failure class unless it runs an order of magnitude above normal.
One subtlety changed how the alerts were written: the threshold belongs at the critical value — around 0.12 percentage points in that worked example — not at the effect itself. Set the alarm at 0.2% and a genuine doubling slips past about half the time. Place it lower, backed by the sample budget above, and the detector finally earns its keep. Priya wrote the numbers on a card and taped it to the monitoring screen.
Rings, and the Right to Say Stop
Exposure widened in rings rather than a global flip. Their one-box — the smallest deployable unit they could spin up — received the build first. Then an internal cell, which in their architecture meant one shard of production acting as a private rehearsal hall. Only after a defined bake time on each ring did the version reach the full constellation. Readers who like the orbital framing will find a cousin idea in this low Earth orbit guide for beginners: test the trajectory before you commit the crew.
Alongside the rings came a rule that sounded formal and worked informally: whoever holds the pager holds the abort right. Not the person who wrote the feature, not the loudest voice in standup — the engineer closest to the dashboards at 2 a.m. can pull exposure back to zero without seeking permission. The team rehearsed it once on a perfectly healthy build, so the muscle would exist before they needed it on a broken one.
What ReleaseOps Measures That Dashboards Miss
By the fourth Thursday, two numbers had appeared that had never existed on their boards. The first was exposure per bad release, counted in user-minutes: when something was wrong, how many people felt it, and for how long? The second was an early-detection ratio: of the defects that later mattered, how many did the canary catch before wide exposure? Neither figure can exist in an all-at-once world, because there is nothing to compare the outcome against.
There was also a quieter shift in how choices got made. Because every rollout was staged, each stage became a checkpoint with evidence — throughput, error rates, support tickets — and a real decision to proceed, hold, or reverse. That is the promise of ReleaseOps in one sentence: releases that behave like decisions instead of leaps. The full entry in The Ops Atlas is where the team first read the two-dials framing in this much detail, and it repays an hour.
For readers who want the station-keeping analogy pushed further, this simple take on geostationary orbit makes the same point from orbital mechanics: a satellite holds its slot through many small corrections, never one heroic burn. Kaveri Labs still ships on Thursdays. The difference is that Thursday now ends with everyone knowing exactly what was turned up, what it cost, and how to turn it back down — which is why nobody dreads it anymore.