Validates a configuration intent, canaries it on a subset of switches, gates on health, then rolls out to the fleet — with a declared rollback for every push. VisML 2026-08-04T09:00:00Z Apache-2.0 networking automation canary NETCONF gateway fronting the switch fleet.

Static validation before anything is touched. Pure, so it is retryable and its verdict is cacheable against the intent digest.

Runs canary devices concurrently, but bounded — eight at a time, so a bad config cannot hit the whole canary set at once. Idempotent because NETCONF edit-config with the same intent converges to the same state — which is what makes retry safe here and not safe in the robotics example.

The declared rollback. Restores the config captured on the way in, so the undo path is part of the design rather than a runbook. Let the canaries run long enough for a problem to surface.

Releases once two of its incoming edges are satisfied rather than all of them — a rollout should not be held hostage by one switch that is already unreachable for unrelated reasons.