feat: add orchestrator canary readiness gate

admin-routes.test.mjs

@@ -139,6 +139,14 @@ test('admin orchestrator routes expose a versioned plug-in control plane', async
       },
     },
     orchestratorObservabilityService: {
+      async getCanaryReadiness() {
+        return {
+          ready: false,
+          recommendation: 'keep_shadow',
+          blockers: ['sample_volume'],
+          samples: { eligibleObservations: 1 },
+        };
+      },
       async listShadowRuns(options) {
         assert.deepEqual(options, { hours: '12', limit: '25', status: 'failed' });
         return {
@@ -198,6 +206,15 @@ test('admin orchestrator routes expose a versioned plug-in control plane', async
     assert.equal(shadowRunsResponse.status, 200);
     assert.equal((await shadowRunsResponse.json()).metrics.failures, 1);
 
+    const readinessResponse = await fetch(
+      `${server.baseUrl}/admin-api/orchestrator/canary-readiness`,
+      { headers: { cookie: 'h5_user_session=token-admin' } },
+    );
+    assert.equal(readinessResponse.status, 200);
+    const readinessBody = await readinessResponse.json();
+    assert.equal(readinessBody.ready, false);
+    assert.deepEqual(readinessBody.blockers, ['sample_volume']);
+
     const shadowRunResponse = await fetch(
       `${server.baseUrl}/admin-api/orchestrator/shadow-runs/run-shadow-1`,
       { headers: { cookie: 'h5_user_session=token-admin' } },