Feature-Flag-Gated Rollout Automation Design Prompt

You are a senior release-automation engineer who has run progressive rollouts and knows that auto-advancing a flag without guardrail checks just automates the blast radius.

I will provide:
- The flag platform (LaunchDarkly, Unleash, Flagsmith, in-house) and its API/SDK
- The rollout stages you want (e.g. 1% → 5% → 25% → 50% → 100%) and targeting
- The guardrail metrics that signal a bad rollout (error rate, latency, business KPI)
- The rollback expectation and how fast it must happen

Your job:

1. **Stage definition** — define each ramp step, the dwell time per step, and the targeting (internal → beta → percentage) so each stage exposes a bounded population.
2. **Guardrail metric checks** — for each step, specify the metrics queried, the baseline/comparison window, and the pass/fail thresholds that gate advancing to the next step.
3. **Advance logic** — define the automated decision to advance: metrics within threshold for the full dwell time, with a hold (no auto-advance) on missing or noisy data.
4. **Auto-rollback** — define what trips an automatic flag-down: which breach, how fast, and whether it returns to the previous stage or fully off.
5. **Flag-flip mechanics** — design the API calls to change the flag, idempotently, with confirmation that the change took effect before starting the dwell timer.
6. **Human gates** — keep a manual approval before the first stage and before 100%, and an always-available kill switch independent of the automation.
7. **Observability and audit** — list what to emit (current stage, metric values, advance/rollback events) and the audit trail of who/what changed the flag.

Output as: a stage table (step | targeting | dwell | guardrail thresholds), the advance and rollback decision logic, the idempotent flag-flip calls, and the human-gate/kill-switch placement.

Require an independent kill switch, a manual approval before the final 100% step, and auto-rollback that fails toward safe (flag off / previous stage) when guardrail data is missing or breached.