Products

Crucible Safety And Operations

Crucible isolates comparison work from the application response path. Operators still own endpoint readiness and the final selection.

Safe Operating Sequence

Confirm the serving endpoint and contenders are direct, same-kind resources in one organization.
Confirm shared READ and WRITE permission for every endpoint.
Seed and externally validate production-ready data on each contender.
Start at a representative sample ratio and run long enough to cover meaningful traffic shapes.
Review completeness, queue delay, total and dispatch latency, target errors, write gaps, and protocol-specific evidence.
Pause while investigating incidents; production serving continues, and observed writes during the pause become explicit gaps.
Reconcile any gaps outside Crucible and retain an auditable evidence reference.
Run completion preflight, acknowledge warnings, and select an endpoint only after the evidence is acceptable.

Serving-Path Guarantees

The serving endpoint is the only source of the client response.
Contender failures, timeouts, and analytics failures do not fail the serving request.
Comparison uses one bounded nonblocking queue handoff.
Per-target capacity is acquired all-or-none before concurrent dispatch.
Full queues and saturation produce drops or skips instead of blocking production.
Request IDs never become metric labels.

Data And Privacy Boundaries

Crucible does not copy data as a migration service. It dispatches eligible requests and retains only safe evidence. It does not store raw SQL, bind values, prompts, generated text, credentials, returned field values, or raw responses.

Canonical response material exists only long enough to calculate a keyed digest. Redis outcome-only and LLM performance-only runs do not claim content equivalence.

Write Boundary

Eligible writes are sent asynchronously and are explicitly best effort. Write attempts can be lost to sampling, pause state, queue pressure, timeout, endpoint errors, or process failure. Gap records improve visibility; they do not convert Crucible into replication.

Completion always warns about this boundary and blocks known-gap promotion without data_readiness_evidence_ref.

Conflict Boundaries

Only one active Crucible run may use an interlay.
Active Exodus migrations and Crucible runs cannot overlap.
Active Crucible contenders cannot also be legacy Mirror Mode targets.
Arena edits are blocked while a run is active.
Completion uses optimistic interlay revision checking and the shared mutation lock.

When To Use Exodus Instead

Use Exodus when the target needs historical data movement, live-write capture, cutover gates, synchronization guarantees, or rollback. Use Crucible completion only when endpoint selection is the remaining operation.