Batches, healthy floor, bake, alarms, health checks, golden prompts and promotion rules for every deployment.

A stage's rollout policy decides how a deployment moves a release onto it. It is set under rollout, alarms and promote on each stage in denv.yaml, and health checks are set on the release.

Serving units

A deployment switches serving units, not GPUs.

For an aggregated release, a serving unit is one replica.
For a disaggregated release, a serving unit is one set of prefill and decode pools that serve requests together. A unit is switched as a whole: its prefill and decode members never run different releases.

replicas, batch and min-healthy all count serving units.

rollout

Field	Meaning	Default
`batch`	Units switched at a time. A number (`1`) or a share (`25%`).	`1`
`min-healthy`	Share of the stage's units that must be serving at every moment. A batch waits rather than break it.	`75%`
`bake`	Time the stage is watched after the last batch before the deployment succeeds.	`30m`
`on-alarm`	`rollback` puts the previous release back. `pause` holds the deployment for a person to decide.	`rollback`

A stage too small to keep min-healthy while switching (one unit) needs denv deploy --allow-downtime, or more replicas during the deployment.

Health checks

Set on the release under health. They run on each unit after its engine starts and before it takes traffic.

Field	Meaning	Default
`startup-timeout`	Time allowed to load weights and start the engine.	`20m`
`warmup`	Synthetic requests sent before checks, to fill caches and compile graphs.	`16`
`golden`	File of prompts the unit must answer correctly.	none

A unit that fails any check never joins the router. The deployment treats it as a failure under on-alarm.

Golden prompts

A JSONL file, one case per line. Cases run at temperature: 0.

{"messages": [{"role": "user", "content": "What is 17 * 23?"}], "expect": {"contains": "391"}}
{"prompt": "The capital of France is", "expect": {"regex": "^\\s*Paris"}}
{"messages": [{"role": "user", "content": "Reply with OK."}], "adapter": "billing", "expect": {"equals": "OK"}}
{"messages": [{"role": "user", "content": "Hi"}], "expect": {"max-latency": "3s"}}

Field	Meaning
`messages` or `prompt`	Chat input or raw completion input.
`adapter`	A LoRA adapter from the release, if the case should use one.
`expect`	Exactly one of `equals`, `contains`, `regex`, `max-latency`.

Golden prompts catch a unit that is broken: wrong weights, a bad chat template, a failed adapter load. They do not compare against a reference; that is parity.

alarms

Watched during every batch and during bake, comparing the new release's units with the previous release's.

Alarm	Fires when
`ttft-p99`	99th percentile time to first token is above the value.
`itl-p99`	99th percentile inter-token latency is above the value.
`error-rate`	Share of requests failing is above the value.
`throughput-drop`	Tokens per second per GPU fall by more than the share, relative to the previous release.
`parity-fail`	That many parity runs fail during the deployment. The parity gate runs after each batch's health checks and golden prompts, before bake; a failure during bake also rolls back and blocks promotion.
`custom`	`[{ metric, above \| below, for }]` on any metric `denv metrics` reports.

An alarm triggers on-alarm. Every alarm, with its value and window, is recorded on the deployment.

promote

When a release may move from this stage to the next.

Field	Meaning	Default
`bake`	Time the release must have run in this stage without alarms.	`0`
`approval`	`required` waits for `denv approve` by someone with the `deployer` role.	not required
`windows`	Times promotion may start, such as `["Mon-Thu 09:00-16:00 America/Los_Angeles"]`.	any time
`auto`	`true` promotes without a command once the other rules pass.	`false`

A release rolled back from a stage cannot be promoted onward from earlier stages.

Rollbacks

denv rollback <env>/<stage> and automatic rollbacks deploy the previous release under the same batch and min-healthy rules, at full speed, and skip bake. They reuse the previous release's weights from local disk, so prefetch is short.

Stage pins

denv stage pin <env>/<stage> --release <m>@<v> --reason "…" refuses new deployments and promotions into the stage until denv stage unpin. Use it during an incident or a customer evaluation.

Defaults

Setting	Default
`batch`	`1`
`min-healthy`	`75%`
`bake`	`30m`
`on-alarm`	`rollback`
`startup-timeout`	`20m`
`warmup`	`16` requests
`promote.bake`	`0`
`promote.approval`	not required
Deployments per stage at once	one

Rollout policy