Govern your fleet rollouts in plain English.
You already canary your rollouts. Patchling makes the call for you — promote, pause, or roll back — on the rule you wrote, every time, with a full audit trail.
When the call is made, Patchling triggers your rollout system.
The decision executes through the over-the-air platform your fleet already runs — no rip-and-replace, no new deployment pipeline.
Speaks MQTT, ROS 2, and the Uptane secure-update standard.
The failure modes you can’t watch for by hand.
Each one is a real way a rollout goes wrong — paired with the open template Patchling runs to catch it. Read exactly what it does, then make it yours.
A firmware update quietly shifts the charging curve. Across the canary fleet, pack temperatures start creeping toward the danger zone.
- Roll back immediately if battery temperature climbs into the critical range
- Require human review if it runs 1.5× above baseline twice in a row
A perception update ships to the canary. Pose accuracy degrades subtly — enough to matter, not enough to trip a hard alarm.
- Flag for human review if localization error triples for three consecutive windows
- Roll back if it rises 2× above baseline for two readings in a row
A navigation update rolls to the canary robots. They start hesitating — emergency stops climb and fault codes pile up on the sidewalk.
- Roll back if emergency stops jump 50% above normal for two readings in a row
- Pause the rollout if fault codes double after two consecutive windows
An update reaches the canary and nothing alarms — but the fleet quietly starts completing fewer missions than it did the day before.
- Pause if mission success drops 10% below baseline
- Roll back if it falls 15% below baseline for three readings in a row
The decision runs itself on every rollout — the moment canary data crosses the rule you wrote, Patchling acts. No one watches the dashboard.
Route any breach to a person instead of acting on it. Automation where you want speed, a human backstop where you want eyes.
Every promote, pause, and rollback ties back to the exact policy and the telemetry window that triggered it. Nothing happens off the record.