## Summary Roll out [the feature](https://gitlab.com/gitlab-org/gitlab/-/work_items/618844) currently behind the `duo_workflow_precondition_check` feature flag. - DRI: @pgumeson - Team Slack channel: `#g_pipeline-execution` > [!note] > Process and guidance live in the docs — this issue is just the commands and a place to track the rollout. > "Rolling out" means incrementally enabling the flag on GitLab.com to validate stability — it is not the same as releasing the feature, which happens when the flag is removed. > [Feature flag controls](https://docs.gitlab.com/development/feature_flags/controls/) · [Feature flag lifecycle](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) ## What could go wrong? When enabled for a project, `duo_workflow_precondition_check` checks runner and compute-minute readiness at flow creation and can reject the request if either check fails. **Blast radius:** server-executed, CI-backed Duo Agent Platform flows in projects where the flag is enabled. Duo chat and client-executed flows (IDE, CLI, create-without-start) are unaffected. **Risk:** a false positive in the runner-availability check could drop a legitimate flow at creation, returning an HTTP 422 to the user. The check fails open: if the check itself errors, enforcement is skipped and the flow proceeds as before, so a probe error can never wrongly block a flow. **Rollback:** no data loss, and fully and instantly reversible by running `/chatops gitlab run feature set duo_workflow_precondition_check false`. **Watching:** the two Kibana links in this issue's Events section, plus `json.feature_flag_states:"duo_workflow_precondition_check:1" and json.status:422` on https://log.gprd.gitlab.net (flag on plus a 422 means a precondition drop; watch its rate against the rollout percentage). Baseline: a few hundred flow creation checks per day, all currently evaluating the flag as off. ## Rollout progress - [x] Baseline captured: flag `:0` for all requests on production, `:1` empty, state logging confirmed working (2026-09-16) - [x] Non-production: enabled across `--dev --pre --staging --staging-ref`; staging (gstg) Sentry clean for `duo_workflow` / `ProjectReadiness` / `CreateWorkflowService` (2026-09-16) - [x] Production: 5% of actors (2026-09-16): no adverse signals over 15 min soak (no 422s, no new gprd Sentry exceptions); too little traffic to observe `:1` at 5% - [x] Production: 25% of actors (2026-09-16): confirmed `:1` landing for in-bucket projects (incl. real external traffic), 0 precondition 422s, no gprd Sentry exceptions (flows proceeding cleanly) - [x] Production: 50% of actors (2026-09-16): 50%-era `:1` events confirmed, still 0 precondition 422s, gprd Sentry clean - [x] Before global rollout checks complete (2026-09-16): docs shipped, no breaking change, change management not required (low-risk/reversible), external API consumers handled (client-executed flows exempt) - [x] Production: 100% (2026-09-16, Enabled Globally: true): 1 legitimate precondition 422 (external private project running a `fix_pipeline` flow with no eligible `gitlab--duo` runner, i.e. the intended behavior); no false positives, gprd Sentry clean - [ ] Soak, then flag cleanup (remove flag + YAML, `release check`, `feature delete`) ## Events <!-- Replace feature flag name in the link--> - [Exceptions with duo_workflow_precondition_check:1](https://log.gprd.gitlab.net/app/discover#/?_g=(time:(from:now-1d,to:now))&_a=(index:'7092c4e2-4eb5-46f2-8305-a7da2edad090',query:(language:kuery,query:'json.exception.feature_flag_states.keyword:%22duo_workflow_precondition_check:1%22'),columns:!(json.exception.class,json.exception.message,json.extra.workflow_id,json.meta.caller_id),sort:!(!(json.time,desc)))) - [Events with duo_workflow_precondition_check:1](https://log.gprd.gitlab.net/app/discover#/?_g=(time:(from:now-1d,to:now))&_a=(index:'7092c4e2-4eb5-46f2-8305-a7da2edad090',query:(language:kuery,query:'json.feature_flag_states:%22duo_workflow_precondition_check:1%22'),columns:!(json.meta.caller_id,json.feature_flag_states),sort:!(!(json.time,desc)))) - [Error rate and other graphs by modifying the examples in the Visualization Library](https://log.gprd.gitlab.net/app/visualize#/?_g=h@358d019&s=FF%20Observability) Feature Flag events are only logged by default for feature flags marked for the current or future milestones. To enable while the feature flag is active, see https://docs.gitlab.com/development/feature_flags/#logging ## Rollout Run all production `/chatops` in [`#production`](https://gitlab.slack.com/archives/C101F3796) and cross-post the results to `#g_pipeline-execution`. Background: [incremental rollout process](https://docs.gitlab.com/development/feature_flags/controls/#process), [feature actors](https://docs.gitlab.com/development/feature_flags/#feature-actors). **Non-production** ``` /chatops gitlab run feature set duo_workflow_precondition_check 50 --actors --dev --pre --staging --staging-ref /chatops gitlab run feature set duo_workflow_precondition_check true --dev --pre --staging --staging-ref ``` **Production** — percentage rollout (wait ≥15 min between steps, watch dashboards): ``` /chatops gitlab run feature set duo_workflow_precondition_check <percentage> --actors ``` Or target specific actors instead: ``` /chatops gitlab run feature set --project=gitlab-org/gitlab,gitlab-org/gitlab-foss duo_workflow_precondition_check true /chatops gitlab run feature set --group=gitlab-org,gitlab-com duo_workflow_precondition_check true /chatops gitlab run feature set --user=<gitlab-username-of-dri> duo_workflow_precondition_check true ``` ## Before global rollout Confirm the relevant gotchas before going to 100% — see [enabling a feature for GitLab.com](https://docs.gitlab.com/development/feature_flags/controls/#enabling-a-feature-for-gitlabcom): - [Docs + version history](https://docs.gitlab.com/development/documentation/feature_flags/) updated - [Breaking changes](https://docs.gitlab.com/development/documentation/release_notes/#deprecations-removals-and-breaking-changes) announced, if any - [Change management issue](https://handbook.gitlab.com/handbook/engineering/infrastructure-platforms/change-management/#feature-flags-and-the-change-management-process) opened, if required - [External API consumers](https://docs.gitlab.com/development/feature_flags/#do-not-use-feature-flags-in-external-api-consumers) handled with a fail-open mechanism, if applicable ## Cleanup Remove the flag once [deemed stable](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) — see [cleaning up](https://docs.gitlab.com/development/feature_flags/controls/#cleaning-up). Track it here, or open a follow-up [Feature Flag Cleanup issue](https://gitlab.com/gitlab-org/gitlab/-/work_items/new?description_template=Feature%20Flag%20Cleanup). Remove the flag and its YAML definition from the codebase, then: ``` /chatops gitlab run release check <merge-request-url> <milestone> /chatops gitlab run feature delete duo_workflow_precondition_check --dev --pre --staging --staging-ref --production ``` ## Rollback ``` /chatops gitlab run feature set duo_workflow_precondition_check false # production /chatops gitlab run feature set duo_workflow_precondition_check false --dev --pre --staging --staging-ref # non-production /chatops gitlab run feature delete duo_workflow_precondition_check --dev --pre --staging --staging-ref --production # remove entirely ``` <!-- Uncomment the appropriate type label /label ~"type::feature" ~"feature::addition" /label ~"type::maintenance" /label ~"type::bug" -->