feat: add orchestrator canary readiness gate

services/orchestrator/README.md

@@ -60,6 +60,18 @@ Phase 2.5 adds a Memind-owned Shadow observability projection:
 The projection reads `h5_agent_run_events` from the Memind control plane.
 LangGraph still has no access to Memind business tables.
 
+Phase 2.6 adds a read-only Canary readiness gate. It evaluates a fixed seven-day
+window and never changes the runtime mode. The first gate requires:
+
+- at least 20 non-smoke observations across at least five real sessions;
+- at least 95% Shadow success, latency coverage, and Native terminal coverage;
+- Shadow P95 latency no greater than two seconds;
+- a healthy observe-only service backed by a durable checkpoint;
+- a fresh, uncapped metric window while the control plane remains in Shadow.
+
+Passing the gate means only `manual_canary_review`; it does not authorize or
+activate Canary routing.
+
 The default memindadm mode remains `off`. Canary and Active routing are not
 wired to the LangGraph executor in Phase 2. Native Agent Run remains the sole
 executor, including in Shadow mode.
@@ -101,6 +113,7 @@ memindadm exposes the projection through:
 ```text
 GET /admin-api/orchestrator/shadow-runs
 GET /admin-api/orchestrator/shadow-runs/:runId
+GET /admin-api/orchestrator/canary-readiness
 ```
 
 ## Colima deployment