Chaos Engineering Platform  ·  View 12 of 21  ·  Runtime

Critical Flow — One Experiment, Start to Verdict

Twenty-one messages across eight participants, with the evaluator never speaking to the agent.

Editable source SVG draw.io All views
Service owner Platform API Guardrail engine Lease issuer Run controller Injection agent Evaluator Run store 1. start run (v14) 2. resolve + check 4. permitted, radius held 5. create run 6. collect baseline 120 s 7. baseline established 8. request lease 9. signed lease, 15 s 11. applied params 13. renew × N 14. steady state holds 15. duration reached 16. no renewal 18. reverted, verified 19. settling check passed 20. verdict + evidence 21. HYPOTHESIS_HELD Critical Flow — One Experiment, Start to Verdict The evaluator never talks to the agent. It withholds a renewal, and the fault expires on its own. v 1.0 · owner Reliability Architecture · date 2026-09

The decision this view proves

  • The evaluator's only lever is the renewal. It tells the lease issuer that steady state holds; when it stops saying so, the fault expires on its own within the TTL.
  • The baseline is established before the lease is requested, so a run that cannot establish a baseline never injects anything.
  • Reversion is verified by re-reading target state, and the settling check confirms the signals came back before the run is called complete.

Assumptions

  • 120 s baseline window, 5 min default run duration, 30 min maximum, absolute wall-clock kill at 45 min.
  • Abort detection to fault fully reverted: p99 ≤ 10 s, hard ceiling 30 s.

Risks

  • The happy path here is also the abort path with one message changed, which is deliberate — but it means a bug in renewal handling is a bug in abort. View 17's release gate exists for exactly this.
◀  Data Model All views Abort and Degradation Paths  ▶
Solution Architecture v1.0 · Google Cloud · Reliability Architecture · 2026-09 · 21 views · 16 architecture decision records12-run-lifecycle-sequence