Rolling out firmware is the highest-risk fleet operation: a bad build can brick devices at scale. This workflow makes rollout staged and reversible — a new version is released to a tiny cohort first, and only advances if health metrics stay green.
Staged by default
Default stages are 1% → 10% → 50% → 100%. Between stages the Progress Tracker evaluates a health gate; a regression auto-pauses the campaign.
Owns the campaign and drives staging.
An operator defines the target version, the device cohort and the stage plan in the OTA Service.
Each stage offers the update to its cohort; agents download the signed package from object storage.
Devices stage, apply and reboot; the edge agent reports per-device success or failure.
If the cohort’s health is within bounds the campaign advances; otherwise it auto-pauses for operator review.