[
  {
    "id": "01-system-context",
    "title": "Chaos Engineering Platform — System Context",
    "layout": "context",
    "system": {
      "label": "Chaos Engineering Platform",
      "sub": "Bounded failure, on purpose"
    },
    "groups": [
      {
        "side": "left",
        "title": "People",
        "nodes": [
          {
            "id": "owner",
            "label": "Service owner",
            "kind": "actor",
            "rel": "runs experiments",
            "dir": "in"
          },
          {
            "id": "sre",
            "label": "Reliability engineer",
            "kind": "actor",
            "rel": "runs game days",
            "dir": "in"
          },
          {
            "id": "approver",
            "label": "Tier-1 approver",
            "kind": "actor",
            "rel": "approves",
            "dir": "in"
          },
          {
            "id": "oncall",
            "label": "On-call responder",
            "kind": "actor",
            "rel": "notified",
            "dir": "out"
          }
        ]
      },
      {
        "side": "right",
        "title": "Systems it reads",
        "nodes": [
          {
            "id": "catalogue",
            "label": "Service catalogue",
            "kind": "external",
            "rel": "ownership",
            "dir": "in"
          },
          {
            "id": "graph",
            "label": "Dependency graph",
            "kind": "external",
            "rel": "graph edges",
            "dir": "in"
          },
          {
            "id": "slo",
            "label": "SLO store",
            "kind": "external",
            "rel": "SLI defs",
            "dir": "in"
          },
          {
            "id": "monitoring",
            "label": "Cloud Monitoring",
            "kind": "external",
            "rel": "signals",
            "dir": "in"
          },
          {
            "id": "idp",
            "label": "Identity provider",
            "kind": "security",
            "rel": "OIDC",
            "dir": "in"
          }
        ]
      },
      {
        "side": "bottom",
        "title": "Systems it acts on and tells",
        "nodes": [
          {
            "id": "fleet",
            "label": "Production service fleet",
            "kind": "app",
            "sub": "900 services",
            "rel": "faults injected",
            "dir": "out"
          },
          {
            "id": "incident",
            "label": "Incident platform",
            "kind": "external",
            "rel": "findings",
            "dir": "bidirectional"
          },
          {
            "id": "pipeline",
            "label": "Deployment pipeline",
            "kind": "external",
            "rel": "verdict",
            "dir": "out"
          }
        ]
      }
    ],
    "note": "Out of scope: load testing, security red-teaming, functional test automation.",
    "meta": {
      "v": "1.0",
      "owner": "Reliability Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "02-high-level-architecture",
    "title": "Chaos Engineering Platform — High-Level Architecture",
    "layout": "flow",
    "chain": true,
    "stages": [
      {
        "title": "Declare",
        "nodes": [
          {
            "id": "defrepo",
            "label": "Definition repo",
            "kind": "store",
            "sub": "versioned, reviewed"
          },
          {
            "id": "validator",
            "label": "Validator & dry run",
            "kind": "app"
          }
        ]
      },
      {
        "title": "Permit",
        "nodes": [
          {
            "id": "gov",
            "label": "Approval & notify",
            "kind": "platform"
          },
          {
            "id": "guard",
            "label": "Guardrail engine",
            "kind": "security",
            "sub": "radius, budget, windows"
          },
          {
            "id": "lease",
            "label": "Lease issuer",
            "kind": "security",
            "sub": "15 s TTL"
          }
        ]
      },
      {
        "title": "Sequence",
        "nodes": [
          {
            "id": "runner",
            "label": "Run controller",
            "kind": "app",
            "sub": "state machine"
          },
          {
            "id": "sched",
            "label": "Scheduler",
            "kind": "app"
          }
        ]
      },
      {
        "title": "Inject",
        "nodes": [
          {
            "id": "agent",
            "label": "Injection agent",
            "kind": "app",
            "sub": "DaemonSet per node"
          },
          {
            "id": "adapters",
            "label": "Fault adapters",
            "kind": "integration",
            "sub": "6 classes"
          }
        ]
      },
      {
        "title": "Observe",
        "nodes": [
          {
            "id": "collector",
            "label": "Signal collector",
            "kind": "integration",
            "sub": "10 s windows"
          },
          {
            "id": "evaluator",
            "label": "Steady-state evaluator",
            "kind": "app"
          }
        ]
      },
      {
        "title": "Judge",
        "nodes": [
          {
            "id": "verdict",
            "label": "Verdict engine",
            "kind": "app",
            "sub": "5 outcomes"
          },
          {
            "id": "evidence",
            "label": "Evidence store",
            "kind": "store",
            "sub": "BigQuery"
          }
        ]
      }
    ],
    "note": "The evaluator feeds the lease issuer, not the agent: a breach stops renewal and the fault expires.",
    "meta": {
      "v": "1.0",
      "owner": "Reliability Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "03-actors-and-journeys",
    "title": "Actors and Their Core Journeys",
    "layout": "actors",
    "groups": [
      {
        "title": "They run the experiments",
        "kind": "trust",
        "actors": [
          {
            "id": "owner",
            "label": "Service owner",
            "sub": "~180 teams",
            "goal": "Find out whether my service really survives the dependency I claim is optional — before a Friday night tells me",
            "journeys": [
              {
                "id": "j1",
                "label": "Prove a dependency timeout",
                "sub": "journey 04"
              },
              {
                "id": "j2",
                "label": "Promote to scheduled",
                "sub": "3 passing runs"
              },
              {
                "id": "j3",
                "label": "Close a finding",
                "sub": "fix, then re-run"
              }
            ]
          },
          {
            "id": "sre",
            "label": "Reliability engineer",
            "sub": "central, 9 people",
            "goal": "Know which failure classes the fleet has actually been tested against, and which are still guesses",
            "journeys": [
              {
                "id": "j4",
                "label": "Facilitate a game day",
                "sub": "journey 05"
              },
              {
                "id": "j5",
                "label": "Read coverage gaps",
                "sub": "untested set"
              },
              {
                "id": "j6",
                "label": "Suspend a fault class",
                "sub": "after a stuck revert"
              }
            ]
          }
        ]
      },
      {
        "title": "They are affected by them",
        "kind": "lane",
        "actors": [
          {
            "id": "oncall",
            "label": "On-call responder",
            "sub": "rotation per service",
            "goal": "Never be paged by an experiment I did not know was running, and always be able to stop one",
            "journeys": [
              {
                "id": "j7",
                "label": "See the annotation",
                "sub": "on their dashboard"
              },
              {
                "id": "j8",
                "label": "Press stop",
                "sub": "≤ 10 s to clear"
              }
            ]
          },
          {
            "id": "approver",
            "label": "Tier-1 approver",
            "sub": "named per service",
            "goal": "Say yes to a bounded, reversible test and no to an outage with paperwork",
            "journeys": [
              {
                "id": "j9",
                "label": "Review a radius escalation",
                "sub": "time-boxed"
              }
            ]
          }
        ]
      },
      {
        "title": "They consume the output",
        "kind": "plain",
        "actors": [
          {
            "id": "lead",
            "label": "Engineering lead",
            "sub": "per domain",
            "goal": "Show that resilience work happened and that the weaknesses found were actually fixed",
            "journeys": [
              {
                "id": "j10",
                "label": "Read the coverage report",
                "sub": "quarterly"
              }
            ]
          },
          {
            "id": "pipe",
            "label": "Deployment pipeline",
            "sub": "automated",
            "goal": "Refuse to promote a canary that a resilience suite just refuted",
            "journeys": [
              {
                "id": "j11",
                "label": "Gate on a verdict",
                "sub": "pre-promotion"
              }
            ]
          }
        ]
      }
    ],
    "note": "The customer never appears here by design: a run the customer notices has already failed its guardrails.",
    "meta": {
      "v": "1.0",
      "owner": "Reliability Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "04-journey-prove-a-dependency-timeout",
    "title": "User Journey — A Service Owner Proves a Dependency Is Really Optional",
    "layout": "journey",
    "actor": {
      "label": "Service owner",
      "sub": "playback-api, tier 1",
      "goal": "Show that playback still starts when the recommender is slow",
      "trigger": "A post-incident action item: \"confirm the recommender is non-blocking\"",
      "success": "A recorded verdict, and either confidence or a tracked finding"
    },
    "phases": [
      {
        "title": "Write",
        "sub": "in the repo"
      },
      {
        "title": "Rehearse",
        "sub": "dry run + staging"
      },
      {
        "title": "Ask",
        "sub": "approval"
      },
      {
        "title": "Inject",
        "moment": true
      },
      {
        "title": "Read",
        "sub": "verdict"
      },
      {
        "title": "Act",
        "sub": "fix or file"
      }
    ],
    "lanes": [
      {
        "title": "What they do",
        "kind": "step",
        "cells": [
          [
            {
              "label": "Copies a template"
            },
            {
              "label": "States the hypothesis"
            }
          ],
          [
            {
              "label": "Runs dry run"
            },
            {
              "label": "Runs it in staging"
            }
          ],
          [
            {
              "label": "Requests approval"
            }
          ],
          [
            {
              "label": "Watches the run"
            }
          ],
          [
            {
              "label": "Opens the verdict"
            }
          ],
          [
            {
              "label": "Files the finding"
            }
          ]
        ]
      },
      {
        "title": "Where",
        "kind": "touch",
        "cells": [
          [
            {
              "label": "Repo + CLI",
              "sub": "chaosctl"
            }
          ],
          [
            {
              "label": "CLI dry run"
            }
          ],
          [
            {
              "label": "Console",
              "sub": "approval card"
            }
          ],
          [
            {
              "label": "Live run view"
            }
          ],
          [
            {
              "label": "Evidence bundle"
            }
          ],
          [
            {
              "label": "Findings tracker"
            }
          ]
        ]
      },
      {
        "title": "How it feels",
        "kind": "emotion",
        "levels": [
          "Confident",
          "Fine",
          "Anxious"
        ],
        "points": [
          1,
          1,
          2,
          2,
          0,
          1
        ]
      },
      {
        "title": "Behind the glass",
        "kind": "system",
        "cells": [
          [
            {
              "label": "Validator"
            }
          ],
          [
            {
              "label": "Selector resolver"
            },
            {
              "label": "Radius calculator"
            }
          ],
          [
            {
              "label": "Approval workflow"
            },
            {
              "label": "Notification"
            }
          ],
          [
            {
              "label": "Lease issuer"
            },
            {
              "label": "Injection agent"
            }
          ],
          [
            {
              "label": "Verdict engine"
            }
          ],
          [
            {
              "label": "Findings tracker"
            }
          ]
        ]
      },
      {
        "title": "Where it hurts",
        "kind": "pain",
        "cells": [
          [
            {
              "label": "Hypothesis is guesswork"
            }
          ],
          [],
          [
            {
              "label": "Waiting on a human"
            }
          ],
          [
            {
              "label": "Fear of a real outage"
            }
          ],
          [],
          [
            {
              "label": "Fix competes with roadmap"
            }
          ]
        ]
      },
      {
        "title": "What would fix it",
        "kind": "gain",
        "cells": [
          [
            {
              "label": "Suggest SLIs from the SLO store"
            }
          ],
          [],
          [
            {
              "label": "Standing consent for proven definitions"
            }
          ],
          [
            {
              "label": "Visible abort countdown"
            }
          ],
          [],
          [
            {
              "label": "Finding linked to a tracked item"
            }
          ]
        ]
      },
      {
        "title": "How we know",
        "kind": "metric",
        "cells": [
          [
            {
              "label": "Rejected definitions 22%"
            }
          ],
          [
            {
              "label": "Dry run p95 5 s"
            }
          ],
          [
            {
              "label": "Approval wait 40 min"
            }
          ],
          [
            {
              "label": "Aborts 1 in 7 runs"
            }
          ],
          [
            {
              "label": "Inconclusive 6%"
            }
          ],
          [
            {
              "label": "Findings closed 61%"
            }
          ]
        ]
      }
    ],
    "note": "The trough is the injection moment: the platform's whole job is to make that fear unjustified and still real.",
    "meta": {
      "v": "1.0",
      "owner": "Reliability Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "05-journey-run-a-game-day",
    "title": "User Journey — A Reliability Engineer Runs the Quarterly Region Game Day",
    "layout": "journey",
    "actor": {
      "label": "Reliability engineer",
      "sub": "facilitator, 40 participants",
      "goal": "Measure how long it takes people, not machines, to notice and mitigate",
      "trigger": "The quarterly calendar, and last quarter's unclosed findings",
      "success": "Time-to-detect and time-to-mitigate recorded, with the reasons they were slow"
    },
    "phases": [
      {
        "title": "Plan",
        "sub": "2 weeks out"
      },
      {
        "title": "Brief",
        "sub": "T-30 min"
      },
      {
        "title": "Run",
        "moment": true
      },
      {
        "title": "Escalate",
        "sub": "unplanned"
      },
      {
        "title": "Stand down",
        "sub": "verify clean"
      },
      {
        "title": "Debrief",
        "sub": "same day"
      }
    ],
    "lanes": [
      {
        "title": "What they do",
        "kind": "step",
        "cells": [
          [
            {
              "label": "Sequences 14 experiments"
            }
          ],
          [
            {
              "label": "Briefs the room"
            }
          ],
          [
            {
              "label": "Starts the sequence"
            },
            {
              "label": "Marks observations"
            }
          ],
          [
            {
              "label": "Decides to continue"
            }
          ],
          [
            {
              "label": "Confirms all reverted"
            }
          ],
          [
            {
              "label": "Publishes the timeline"
            }
          ]
        ]
      },
      {
        "title": "Where",
        "kind": "touch",
        "cells": [
          [
            {
              "label": "Game-day plan"
            }
          ],
          [
            {
              "label": "Shared timeline"
            }
          ],
          [
            {
              "label": "Timeline + chat"
            }
          ],
          [
            {
              "label": "Kill switch panel"
            }
          ],
          [
            {
              "label": "Settling check"
            }
          ],
          [
            {
              "label": "Debrief report"
            }
          ]
        ]
      },
      {
        "title": "How it feels",
        "kind": "emotion",
        "levels": [
          "In control",
          "Fine",
          "Exposed"
        ],
        "points": [
          1,
          1,
          2,
          0,
          1,
          1
        ]
      },
      {
        "title": "Behind the glass",
        "kind": "system",
        "cells": [
          [
            {
              "label": "Sequencer"
            }
          ],
          [
            {
              "label": "Notification fan-out"
            }
          ],
          [
            {
              "label": "Run controller"
            },
            {
              "label": "Radius reservation"
            }
          ],
          [
            {
              "label": "Incident-feed gate"
            }
          ],
          [
            {
              "label": "Reversion verifier"
            }
          ],
          [
            {
              "label": "Evidence store"
            }
          ]
        ]
      },
      {
        "title": "Where it hurts",
        "kind": "pain",
        "cells": [
          [
            {
              "label": "Radii collide, order rewritten"
            }
          ],
          [],
          [
            {
              "label": "Two teams page each other"
            }
          ],
          [
            {
              "label": "A real incident opens"
            }
          ],
          [
            {
              "label": "One revert does not confirm"
            }
          ],
          []
        ]
      },
      {
        "title": "What would fix it",
        "kind": "gain",
        "cells": [
          [
            {
              "label": "Radius conflicts shown at plan time"
            }
          ],
          [],
          [
            {
              "label": "Annotation on every affected dashboard"
            }
          ],
          [
            {
              "label": "Automatic suspension on incident open"
            }
          ],
          [
            {
              "label": "Out-of-band reverter, one click"
            }
          ],
          []
        ]
      },
      {
        "title": "How we know",
        "kind": "metric",
        "cells": [
          [
            {
              "label": "Plan rework 3 rounds"
            }
          ],
          [
            {
              "label": "Attendance 82%"
            }
          ],
          [
            {
              "label": "Detect p50 4 min"
            }
          ],
          [
            {
              "label": "Suspensions 2 per day"
            }
          ],
          [
            {
              "label": "Stuck reverts 1 per 900"
            }
          ],
          [
            {
              "label": "Findings filed 9"
            }
          ]
        ]
      }
    ],
    "note": "Time to detect and time to mitigate are the outputs of this view; the technical verdicts are secondary here.",
    "meta": {
      "v": "1.0",
      "owner": "Reliability Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "06-layered-architecture",
    "title": "Layered Architecture",
    "layout": "bands",
    "bands": [
      {
        "name": "Experience",
        "nodes": [
          {
            "id": "cli",
            "label": "chaosctl",
            "kind": "app"
          },
          {
            "id": "console",
            "label": "Console",
            "kind": "app"
          },
          {
            "id": "gdtl",
            "label": "Game-day timeline",
            "kind": "app"
          },
          {
            "id": "cigate",
            "label": "CI gate",
            "kind": "integration"
          }
        ]
      },
      {
        "name": "Definition",
        "nodes": [
          {
            "id": "repo",
            "label": "Definition repo",
            "kind": "store"
          },
          {
            "id": "tmpl",
            "label": "Templates",
            "kind": "app"
          },
          {
            "id": "val",
            "label": "Validator",
            "kind": "app"
          },
          {
            "id": "dry",
            "label": "Dry-run resolver",
            "kind": "app"
          }
        ]
      },
      {
        "name": "Governance",
        "nodes": [
          {
            "id": "authz",
            "label": "Authorisation",
            "kind": "security"
          },
          {
            "id": "appr",
            "label": "Approvals",
            "kind": "platform"
          },
          {
            "id": "notify",
            "label": "Notification",
            "kind": "integration"
          },
          {
            "id": "budget",
            "label": "Chaos budgets",
            "kind": "platform"
          }
        ]
      },
      {
        "name": "Safety",
        "nodes": [
          {
            "id": "radius",
            "label": "Radius calculator",
            "kind": "security"
          },
          {
            "id": "resv",
            "label": "Radius reservation",
            "kind": "security"
          },
          {
            "id": "leaseiss",
            "label": "Lease issuer",
            "kind": "security"
          },
          {
            "id": "kill",
            "label": "Kill switch",
            "kind": "security"
          },
          {
            "id": "incgate",
            "label": "Incident gate",
            "kind": "security"
          }
        ]
      },
      {
        "name": "Orchestration",
        "nodes": [
          {
            "id": "runsm",
            "label": "Run state machine",
            "kind": "app"
          },
          {
            "id": "sched",
            "label": "Scheduler",
            "kind": "app"
          },
          {
            "id": "seq",
            "label": "Sequencer",
            "kind": "app"
          },
          {
            "id": "windows",
            "label": "Window controller",
            "kind": "app"
          }
        ]
      },
      {
        "name": "Data plane",
        "nodes": [
          {
            "id": "agent",
            "label": "Injection agent",
            "kind": "app"
          },
          {
            "id": "adapt",
            "label": "Fault adapters",
            "kind": "integration"
          },
          {
            "id": "watch",
            "label": "Lease watchdog",
            "kind": "security"
          },
          {
            "id": "oob",
            "label": "Out-of-band reverter",
            "kind": "security"
          }
        ]
      },
      {
        "name": "Verification",
        "nodes": [
          {
            "id": "coll",
            "label": "Signal collector",
            "kind": "integration"
          },
          {
            "id": "base",
            "label": "Baseline compare",
            "kind": "app"
          },
          {
            "id": "eval",
            "label": "Steady-state evaluator",
            "kind": "app"
          },
          {
            "id": "verd",
            "label": "Verdict engine",
            "kind": "app"
          }
        ]
      },
      {
        "name": "Evidence",
        "nodes": [
          {
            "id": "runs",
            "label": "Run store",
            "kind": "store"
          },
          {
            "id": "bundles",
            "label": "Evidence bundles",
            "kind": "store"
          },
          {
            "id": "find",
            "label": "Findings tracker",
            "kind": "app"
          },
          {
            "id": "cov",
            "label": "Coverage reporting",
            "kind": "app"
          },
          {
            "id": "audit",
            "label": "Audit log",
            "kind": "store"
          }
        ]
      },
      {
        "name": "Consumed",
        "nodes": [
          {
            "id": "cat",
            "label": "Service catalogue",
            "kind": "external"
          },
          {
            "id": "dep",
            "label": "Dependency graph",
            "kind": "external"
          },
          {
            "id": "slo",
            "label": "SLO store",
            "kind": "external"
          },
          {
            "id": "inc",
            "label": "Incident platform",
            "kind": "external"
          },
          {
            "id": "idp",
            "label": "Identity provider",
            "kind": "external"
          }
        ]
      }
    ],
    "edges": [
      {
        "from": "val",
        "to": "authz",
        "label": "policy check"
      },
      {
        "from": "radius",
        "to": "leaseiss",
        "label": "permission"
      },
      {
        "from": "leaseiss",
        "to": "agent",
        "label": "signed lease"
      },
      {
        "from": "agent",
        "to": "coll",
        "label": "applied state"
      },
      {
        "from": "eval",
        "to": "leaseiss",
        "label": "breach stops renewal"
      },
      {
        "from": "verd",
        "to": "runs",
        "label": "verdict"
      }
    ],
    "note": "Governance and safety are separate layers: one decides whether you may, the other decides how far.",
    "meta": {
      "v": "1.0",
      "owner": "Reliability Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "07-platform-components",
    "title": "Container View — Platform Components",
    "layout": "nested",
    "boxes": [
      {
        "title": "Control project (per region)",
        "kind": "cloud",
        "dir": "col",
        "children": [
          {
            "title": "Definition & governance",
            "kind": "boundary",
            "nodes": [
              {
                "id": "api",
                "label": "Platform API",
                "kind": "app",
                "sub": "Cloud Run"
              },
              {
                "id": "val",
                "label": "Validator",
                "kind": "app",
                "sub": "Cloud Run"
              },
              {
                "id": "appr",
                "label": "Approval workflow",
                "kind": "platform",
                "sub": "Workflows"
              },
              {
                "id": "notify",
                "label": "Notifier",
                "kind": "integration",
                "sub": "Pub/Sub fan-out"
              }
            ]
          },
          {
            "title": "Safety plane",
            "kind": "trust",
            "nodes": [
              {
                "id": "radius",
                "label": "Radius calculator",
                "kind": "security",
                "sub": "Cloud Run"
              },
              {
                "id": "resv",
                "label": "Reservation store",
                "kind": "store",
                "sub": "Spanner"
              },
              {
                "id": "lease",
                "label": "Lease issuer",
                "kind": "security",
                "sub": "signs, 15 s TTL"
              },
              {
                "id": "kill",
                "label": "Kill switch",
                "kind": "security",
                "sub": "own endpoint"
              }
            ]
          },
          {
            "title": "Orchestration",
            "kind": "boundary",
            "nodes": [
              {
                "id": "runsm",
                "label": "Run controller",
                "kind": "app",
                "sub": "GKE"
              },
              {
                "id": "sched",
                "label": "Scheduler",
                "kind": "app",
                "sub": "Cloud Scheduler"
              },
              {
                "id": "seq",
                "label": "Game-day sequencer",
                "kind": "app",
                "sub": "Workflows"
              }
            ]
          },
          {
            "title": "Verification & evidence",
            "kind": "boundary",
            "nodes": [
              {
                "id": "coll",
                "label": "Signal collector",
                "kind": "integration",
                "sub": "Monitoring API"
              },
              {
                "id": "eval",
                "label": "Evaluator",
                "kind": "app",
                "sub": "10 s windows"
              },
              {
                "id": "verd",
                "label": "Verdict engine",
                "kind": "app"
              },
              {
                "id": "bq",
                "label": "Evidence warehouse",
                "kind": "store",
                "sub": "BigQuery"
              },
              {
                "id": "runs",
                "label": "Run store",
                "kind": "store",
                "sub": "Spanner"
              }
            ]
          }
        ]
      },
      {
        "title": "Target cluster (× 6)",
        "kind": "onprem",
        "dir": "row",
        "children": [
          {
            "title": "Chaos namespace",
            "kind": "trust",
            "nodes": [
              {
                "id": "agent",
                "label": "Injection agent",
                "kind": "app",
                "sub": "DaemonSet"
              },
              {
                "id": "watch",
                "label": "Lease watchdog",
                "kind": "security"
              },
              {
                "id": "oob",
                "label": "Out-of-band reverter",
                "kind": "security",
                "sub": "separate identity"
              }
            ]
          },
          {
            "title": "Workload namespaces",
            "kind": "lane",
            "nodes": [
              {
                "id": "targets",
                "label": "Target workloads",
                "kind": "app",
                "sub": "900 services"
              },
              {
                "id": "mesh",
                "label": "Mesh sidecars",
                "kind": "integration",
                "sub": "fault filters"
              }
            ]
          }
        ]
      }
    ],
    "outside": [
      {
        "id": "cat",
        "label": "Service catalogue",
        "kind": "external"
      },
      {
        "id": "slo",
        "label": "SLO store",
        "kind": "external"
      },
      {
        "id": "inc",
        "label": "Incident platform",
        "kind": "external"
      },
      {
        "id": "mon",
        "label": "Cloud Monitoring",
        "kind": "external"
      }
    ],
    "edges": [
      {
        "from": "api",
        "to": "radius",
        "label": "resolve radius"
      },
      {
        "from": "radius",
        "to": "resv",
        "label": "reserve"
      },
      {
        "from": "lease",
        "to": "agent",
        "label": "signed lease"
      },
      {
        "from": "agent",
        "to": "mesh",
        "label": "fault filter"
      },
      {
        "from": "watch",
        "to": "agent",
        "label": "on expiry"
      },
      {
        "from": "coll",
        "to": "eval",
        "label": "signals"
      },
      {
        "from": "eval",
        "to": "lease",
        "label": "stop renewal"
      },
      {
        "from": "verd",
        "to": "bq",
        "label": "evidence"
      }
    ],
    "note": "Only the agent has any privilege inside a target namespace, and it holds no write path to the control plane's state.",
    "meta": {
      "v": "1.0",
      "owner": "Reliability Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "08-integration-surface",
    "title": "Integration Surface — What It Reads, What It Tells",
    "layout": "hub",
    "left": {
      "title": "Read-only inputs",
      "nodes": [
        {
          "id": "cat",
          "label": "Service catalogue",
          "kind": "external",
          "rel": "ownership"
        },
        {
          "id": "dep",
          "label": "Dependency graph",
          "kind": "external",
          "rel": "graph edges"
        },
        {
          "id": "slo",
          "label": "SLO store",
          "kind": "external",
          "rel": "SLI defs"
        },
        {
          "id": "mon",
          "label": "Cloud Monitoring",
          "kind": "external",
          "rel": "signals"
        },
        {
          "id": "incin",
          "label": "Incident feed",
          "kind": "external",
          "rel": "open incidents"
        }
      ]
    },
    "centre": {
      "title": "Chaos Engineering Platform",
      "nodes": [
        {
          "id": "api",
          "label": "Platform API",
          "kind": "app",
          "sub": "definitions, runs"
        },
        {
          "id": "guard",
          "label": "Guardrail engine",
          "kind": "security"
        },
        {
          "id": "lease",
          "label": "Lease issuer",
          "kind": "security"
        },
        {
          "id": "bus",
          "label": "Run event topic",
          "kind": "queue",
          "sub": "Pub/Sub"
        }
      ]
    },
    "right": {
      "title": "Outputs and acted-on systems",
      "nodes": [
        {
          "id": "agents",
          "label": "Injection agents",
          "kind": "app",
          "rel": "leases",
          "dir": "out"
        },
        {
          "id": "incout",
          "label": "Incident platform",
          "kind": "external",
          "rel": "findings",
          "dir": "out",
          "kind2": "async"
        },
        {
          "id": "pipe",
          "label": "Deployment pipeline",
          "kind": "external",
          "rel": "verdict",
          "dir": "out"
        },
        {
          "id": "dash",
          "label": "Target dashboards",
          "kind": "external",
          "rel": "annotation",
          "dir": "out"
        },
        {
          "id": "chat",
          "label": "Chat and on-call",
          "kind": "external",
          "rel": "pre-run notice",
          "dir": "out",
          "kind2": "async"
        }
      ]
    },
    "note": "Nothing on the left is written by this platform. A stale read blocks a run rather than degrading it silently. Identity is on view 21.",
    "meta": {
      "v": "1.0",
      "owner": "Reliability Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "09-run-and-evidence-data-flow",
    "title": "Data Flow — From Definition to Evidence",
    "layout": "flow",
    "chain": false,
    "stages": [
      {
        "title": "Authored",
        "nodes": [
          {
            "id": "def",
            "label": "Definition",
            "kind": "store"
          },
          {
            "id": "inv",
            "label": "Inventory snapshot",
            "kind": "store"
          }
        ]
      },
      {
        "title": "Resolved",
        "nodes": [
          {
            "id": "targets",
            "label": "Resolved targets",
            "kind": "store"
          },
          {
            "id": "radius",
            "label": "Computed radius",
            "kind": "store"
          }
        ]
      },
      {
        "title": "In flight",
        "nodes": [
          {
            "id": "lease",
            "label": "Active leases",
            "kind": "store"
          },
          {
            "id": "applied",
            "label": "Applied parameters",
            "kind": "store"
          },
          {
            "id": "raw",
            "label": "High-res signals",
            "kind": "store"
          }
        ]
      },
      {
        "title": "Judged",
        "nodes": [
          {
            "id": "base",
            "label": "Baseline window",
            "kind": "store"
          },
          {
            "id": "verdict",
            "label": "Verdict",
            "kind": "store"
          }
        ]
      },
      {
        "title": "Retained",
        "nodes": [
          {
            "id": "bundle",
            "label": "Evidence bundle",
            "kind": "store"
          },
          {
            "id": "down",
            "label": "Downsampled series",
            "kind": "store"
          },
          {
            "id": "audit",
            "label": "Audit entries",
            "kind": "store"
          }
        ]
      },
      {
        "title": "Consumed",
        "nodes": [
          {
            "id": "cov",
            "label": "Coverage report",
            "kind": "app"
          },
          {
            "id": "find",
            "label": "Findings",
            "kind": "app"
          },
          {
            "id": "cost",
            "label": "Cost attribution",
            "kind": "app"
          }
        ]
      }
    ],
    "edges": [
      {
        "from": "def",
        "to": "targets",
        "label": "selector resolve"
      },
      {
        "from": "inv",
        "to": "radius",
        "label": "graph closure"
      },
      {
        "from": "targets",
        "to": "lease",
        "label": "scoped to targets"
      },
      {
        "from": "radius",
        "to": "lease",
        "label": "within caps"
      },
      {
        "from": "lease",
        "to": "applied",
        "label": "agent reports"
      },
      {
        "from": "applied",
        "to": "raw",
        "label": "collected",
        "kind": "async"
      },
      {
        "from": "raw",
        "to": "base",
        "label": "compare"
      },
      {
        "from": "base",
        "to": "verdict",
        "label": "held or refuted"
      },
      {
        "from": "verdict",
        "to": "bundle",
        "label": "sealed"
      },
      {
        "from": "raw",
        "to": "down",
        "label": "after 90 days",
        "kind": "batch",
        "route": "gutter"
      },
      {
        "from": "verdict",
        "to": "audit",
        "label": "append",
        "route": "gutter"
      },
      {
        "from": "bundle",
        "to": "cov",
        "label": "aggregate",
        "kind": "batch"
      },
      {
        "from": "verdict",
        "to": "find",
        "label": "if refuted"
      },
      {
        "from": "down",
        "to": "cost",
        "label": "per team",
        "kind": "batch",
        "route": "gutter"
      }
    ],
    "note": "High-resolution signals exist only for evaluated signals, only in the baseline and injection windows.",
    "meta": {
      "v": "1.0",
      "owner": "Reliability Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "10-data-ownership-zones",
    "title": "Data Architecture — Ownership and Rebuildability",
    "layout": "nested",
    "boxes": [
      {
        "title": "Authored elsewhere — read only",
        "kind": "onprem",
        "dir": "row",
        "children": [
          {
            "title": "Consumed inventory",
            "kind": "plain",
            "nodes": [
              {
                "id": "cat",
                "label": "Service catalogue",
                "kind": "external",
                "sub": "24 h staleness cap"
              },
              {
                "id": "dep",
                "label": "Dependency graph",
                "kind": "external",
                "sub": "from mesh traffic"
              },
              {
                "id": "slo",
                "label": "SLO definitions",
                "kind": "external",
                "sub": "the owners' SLIs"
              }
            ]
          }
        ]
      },
      {
        "title": "Owned by the platform",
        "kind": "cloud",
        "dir": "col",
        "children": [
          {
            "title": "Hot, strongly consistent — not rebuildable",
            "kind": "trust",
            "nodes": [
              {
                "id": "leases",
                "label": "Active leases",
                "kind": "store",
                "sub": "Spanner, regional"
              },
              {
                "id": "resv",
                "label": "Radius reservations",
                "kind": "store",
                "sub": "Spanner"
              },
              {
                "id": "budget",
                "label": "Chaos budget ledger",
                "kind": "store",
                "sub": "Spanner"
              }
            ]
          },
          {
            "title": "Durable record — RPO 0, append-only",
            "kind": "boundary",
            "nodes": [
              {
                "id": "runs",
                "label": "Run records",
                "kind": "store",
                "sub": "24 months"
              },
              {
                "id": "find",
                "label": "Findings",
                "kind": "store",
                "sub": "to closure"
              },
              {
                "id": "audit",
                "label": "Audit log",
                "kind": "store",
                "sub": "7 years"
              }
            ]
          },
          {
            "title": "Derived — rebuildable from the record",
            "kind": "boundary",
            "nodes": [
              {
                "id": "cov",
                "label": "Coverage marts",
                "kind": "store",
                "sub": "BigQuery"
              },
              {
                "id": "cost",
                "label": "Cost attribution",
                "kind": "store",
                "sub": "BigQuery"
              }
            ]
          },
          {
            "title": "Sampled — loss degrades a verdict, never corrupts one",
            "kind": "lane",
            "nodes": [
              {
                "id": "raw",
                "label": "High-res signals",
                "kind": "store",
                "sub": "90 days, RPO 60 s"
              },
              {
                "id": "down",
                "label": "Downsampled series",
                "kind": "store",
                "sub": "life of the run"
              }
            ]
          }
        ]
      },
      {
        "title": "Sourced from the definition repo",
        "kind": "boundary",
        "dir": "row",
        "children": [
          {
            "title": "Version-controlled",
            "kind": "plain",
            "nodes": [
              {
                "id": "def",
                "label": "Definitions",
                "kind": "store",
                "sub": "immutable per version"
              },
              {
                "id": "tmpl",
                "label": "Templates",
                "kind": "store"
              }
            ]
          }
        ]
      }
    ],
    "edges": [
      {
        "from": "def",
        "to": "runs",
        "label": "version pinned"
      },
      {
        "from": "raw",
        "to": "down",
        "label": "after 90 days",
        "kind": "batch"
      },
      {
        "from": "runs",
        "to": "cov",
        "label": "rebuildable",
        "kind": "batch"
      },
      {
        "from": "leases",
        "to": "runs",
        "label": "terminal state"
      }
    ],
    "note": "Losing the derived zone costs a rebuild. Losing the lease zone is safe: every fault reverts.",
    "meta": {
      "v": "1.0",
      "owner": "Reliability Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "11-data-model",
    "title": "Data Model — Experiments, Runs, Leases and Findings",
    "layout": "er",
    "canvas": {
      "width": 1760,
      "cols": 4
    },
    "rowGap": 230,
    "entities": [
      {
        "id": "def",
        "name": "ExperimentDefinition",
        "kind": "store",
        "row": 0,
        "col": 0,
        "attrs": [
          "id PK",
          "slug",
          "owner_team",
          "created_by",
          "current_version"
        ]
      },
      {
        "id": "ver",
        "name": "DefinitionVersion",
        "kind": "store",
        "row": 0,
        "col": 1,
        "attrs": [
          "id PK",
          "definition_id FK",
          "version",
          "hypothesis",
          "radius_limits",
          "abort_conditions",
          "immutable"
        ]
      },
      {
        "id": "run",
        "name": "Run",
        "kind": "store",
        "row": 0,
        "col": 2,
        "attrs": [
          "id PK",
          "version_id FK",
          "mode",
          "started_at",
          "ended_at",
          "verdict",
          "aborted_reason"
        ]
      },
      {
        "id": "target",
        "name": "ResolvedTarget",
        "kind": "store",
        "row": 0,
        "col": 3,
        "attrs": [
          "id PK",
          "run_id FK",
          "cluster",
          "zone",
          "workload",
          "replica_ref"
        ]
      },
      {
        "id": "appr",
        "name": "Approval",
        "kind": "store",
        "row": 1,
        "col": 0,
        "attrs": [
          "id PK",
          "run_id FK",
          "approver",
          "tier",
          "over_cap",
          "expires_at"
        ]
      },
      {
        "id": "res",
        "name": "RadiusReservation",
        "kind": "store",
        "row": 1,
        "col": 1,
        "attrs": [
          "id PK",
          "run_id FK",
          "replica_pct",
          "zones",
          "downstream_set",
          "held_until"
        ]
      },
      {
        "id": "lease",
        "name": "Lease",
        "kind": "store",
        "row": 1,
        "col": 2,
        "attrs": [
          "id PK",
          "run_id FK",
          "target_id FK",
          "fault_class",
          "issued_at",
          "expires_at",
          "renewals"
        ]
      },
      {
        "id": "find",
        "name": "Finding",
        "kind": "store",
        "row": 1,
        "col": 3,
        "attrs": [
          "id PK",
          "run_id FK",
          "service",
          "failure_class",
          "state",
          "remediation_ref"
        ]
      },
      {
        "id": "audit",
        "name": "AuditEntry",
        "kind": "store",
        "row": 2,
        "col": 0,
        "attrs": [
          "id PK",
          "principal",
          "action",
          "subject_ref",
          "at"
        ]
      },
      {
        "id": "guard",
        "name": "GuardrailEvaluation",
        "kind": "store",
        "row": 2,
        "col": 1,
        "attrs": [
          "id PK",
          "run_id FK",
          "check",
          "measure",
          "limit",
          "outcome"
        ]
      },
      {
        "id": "appl",
        "name": "AppliedFault",
        "kind": "store",
        "row": 2,
        "col": 2,
        "attrs": [
          "id PK",
          "lease_id FK",
          "requested_params",
          "applied_params",
          "reverted_at",
          "revert_verified"
        ]
      },
      {
        "id": "sig",
        "name": "SignalSeries",
        "kind": "store",
        "row": 2,
        "col": 3,
        "attrs": [
          "id PK",
          "run_id FK",
          "sli_ref",
          "window",
          "resolution_s",
          "samples"
        ]
      }
    ],
    "relations": [
      {
        "from": "def",
        "to": "ver",
        "label": "1 : N",
        "from_side": "e",
        "to_side": "w"
      },
      {
        "from": "ver",
        "to": "run",
        "label": "1 : N",
        "from_side": "e",
        "to_side": "w"
      },
      {
        "from": "run",
        "to": "target",
        "label": "1 : N",
        "from_side": "e",
        "to_side": "w"
      },
      {
        "from": "run",
        "to": "res",
        "label": "1 : 1",
        "from_side": "s1",
        "to_side": "n"
      },
      {
        "from": "run",
        "to": "lease",
        "label": "1 : N",
        "from_side": "s",
        "to_side": "n"
      },
      {
        "from": "run",
        "to": "find",
        "label": "0 : N",
        "from_side": "s3",
        "to_side": "n"
      },
      {
        "from": "lease",
        "to": "appl",
        "label": "1 : 1",
        "from_side": "s",
        "to_side": "n"
      },
      {
        "from": "res",
        "to": "guard",
        "label": "1 : N",
        "from_side": "s",
        "to_side": "n"
      }
    ],
    "note": "Approval, SignalSeries and AuditEntry also reference Run by run_id; those edges are omitted so the spine — definition, version, run, lease, applied fault — stays readable.",
    "meta": {
      "v": "1.0",
      "owner": "Reliability Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "12-run-lifecycle-sequence",
    "title": "Critical Flow — One Experiment, Start to Verdict",
    "layout": "sequence",
    "lifelines": [
      {
        "id": "own",
        "label": "Service owner",
        "kind": "actor"
      },
      {
        "id": "api",
        "label": "Platform API",
        "kind": "app"
      },
      {
        "id": "guard",
        "label": "Guardrail engine",
        "kind": "security"
      },
      {
        "id": "lease",
        "label": "Lease issuer",
        "kind": "security"
      },
      {
        "id": "run",
        "label": "Run controller",
        "kind": "app"
      },
      {
        "id": "agent",
        "label": "Injection agent",
        "kind": "app"
      },
      {
        "id": "eval",
        "label": "Evaluator",
        "kind": "app"
      },
      {
        "id": "store",
        "label": "Run store",
        "kind": "store"
      }
    ],
    "messages": [
      {
        "from": "own",
        "to": "api",
        "label": "start run (v14)"
      },
      {
        "from": "api",
        "to": "guard",
        "label": "resolve + check"
      },
      {
        "from": "guard",
        "to": "guard",
        "label": "radius, budget, windows"
      },
      {
        "from": "guard",
        "to": "api",
        "label": "permitted, radius held"
      },
      {
        "from": "api",
        "to": "run",
        "label": "create run"
      },
      {
        "from": "run",
        "to": "eval",
        "label": "collect baseline 120 s"
      },
      {
        "from": "eval",
        "to": "run",
        "label": "baseline established"
      },
      {
        "from": "run",
        "to": "lease",
        "label": "request lease"
      },
      {
        "from": "lease",
        "to": "agent",
        "label": "signed lease, 15 s"
      },
      {
        "from": "agent",
        "to": "agent",
        "label": "inject, verify applied"
      },
      {
        "from": "agent",
        "to": "run",
        "label": "applied params"
      },
      {
        "from": "eval",
        "to": "eval",
        "label": "evaluate 10 s windows"
      },
      {
        "from": "lease",
        "to": "agent",
        "label": "renew × N"
      },
      {
        "from": "eval",
        "to": "lease",
        "label": "steady state holds"
      },
      {
        "from": "run",
        "to": "lease",
        "label": "duration reached"
      },
      {
        "from": "lease",
        "to": "agent",
        "label": "no renewal",
        "kind": "error"
      },
      {
        "from": "agent",
        "to": "agent",
        "label": "revert, re-read state"
      },
      {
        "from": "agent",
        "to": "run",
        "label": "reverted, verified"
      },
      {
        "from": "eval",
        "to": "run",
        "label": "settling check passed"
      },
      {
        "from": "run",
        "to": "store",
        "label": "verdict + evidence"
      },
      {
        "from": "store",
        "to": "own",
        "label": "HYPOTHESIS_HELD"
      }
    ],
    "note": "The evaluator never talks to the agent. It withholds a renewal, and the fault expires on its own.",
    "meta": {
      "v": "1.0",
      "owner": "Reliability Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "13-abort-and-degradation-paths",
    "title": "Abort and Degradation Paths",
    "layout": "flow",
    "chain": false,
    "stages": [
      {
        "title": "Trigger",
        "nodes": [
          {
            "id": "breach",
            "label": "SLI breach",
            "kind": "risk"
          },
          {
            "id": "blind",
            "label": "Telemetry blind",
            "kind": "risk"
          },
          {
            "id": "lost",
            "label": "Control plane or link lost",
            "kind": "risk"
          },
          {
            "id": "human",
            "label": "Operator or incident",
            "kind": "actor"
          }
        ]
      },
      {
        "title": "Decision",
        "nodes": [
          {
            "id": "norenew",
            "label": "Withhold renewal",
            "kind": "decision"
          },
          {
            "id": "killsw",
            "label": "Kill switch",
            "kind": "decision"
          }
        ]
      },
      {
        "title": "Mechanism",
        "nodes": [
          {
            "id": "expire",
            "label": "Lease expires ≤ 15 s",
            "kind": "security"
          },
          {
            "id": "watchdog",
            "label": "Watchdog reverts",
            "kind": "security"
          }
        ]
      },
      {
        "title": "Confirm",
        "nodes": [
          {
            "id": "verify",
            "label": "Re-read target state",
            "kind": "app"
          },
          {
            "id": "settle",
            "label": "Settling check",
            "kind": "app"
          }
        ]
      },
      {
        "title": "Outcome",
        "nodes": [
          {
            "id": "clean",
            "label": "Fault cleared",
            "kind": "app"
          },
          {
            "id": "stuck",
            "label": "Revert unconfirmed",
            "kind": "risk"
          },
          {
            "id": "inconc",
            "label": "INCONCLUSIVE",
            "kind": "decision"
          }
        ]
      },
      {
        "title": "Escalation",
        "nodes": [
          {
            "id": "oob",
            "label": "Out-of-band reverter",
            "kind": "security"
          },
          {
            "id": "suspend",
            "label": "Suspend fault class",
            "kind": "security"
          }
        ]
      }
    ],
    "edges": [
      {
        "from": "breach",
        "to": "norenew",
        "label": "abort rule"
      },
      {
        "from": "blind",
        "to": "norenew",
        "label": "no signal",
        "kind": "error"
      },
      {
        "from": "lost",
        "to": "expire",
        "label": "nothing renews",
        "kind": "error"
      },
      {
        "from": "human",
        "to": "killsw",
        "label": "stop"
      },
      {
        "from": "norenew",
        "to": "expire",
        "label": "TTL out"
      },
      {
        "from": "killsw",
        "to": "watchdog",
        "label": "fleet-wide"
      },
      {
        "from": "expire",
        "to": "watchdog",
        "label": "revert"
      },
      {
        "from": "watchdog",
        "to": "verify",
        "label": "re-read"
      },
      {
        "from": "verify",
        "to": "clean",
        "label": "gone"
      },
      {
        "from": "verify",
        "to": "stuck",
        "label": "present",
        "kind": "error"
      },
      {
        "from": "clean",
        "to": "settle",
        "label": "baseline",
        "route": "gutter"
      },
      {
        "from": "blind",
        "to": "inconc",
        "label": "no coverage",
        "kind": "error",
        "route": "gutter"
      },
      {
        "from": "stuck",
        "to": "oob",
        "label": "escalate",
        "kind": "error"
      },
      {
        "from": "oob",
        "to": "suspend",
        "label": "class off"
      }
    ],
    "note": "Every red path ends with the fault gone. There is no path on this page where uncertainty keeps a fault alive.",
    "meta": {
      "v": "1.0",
      "owner": "Reliability Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "14-guardrail-evaluation",
    "title": "Guardrail Evaluation — Per Check Class, Per Phase",
    "layout": "swimlane",
    "stages": [
      "Pre-flight",
      "At issue",
      "During injection",
      "At abort"
    ],
    "lanes": [
      {
        "title": "Blast radius",
        "cells": [
          [
            {
              "id": "g1",
              "label": "Resolve selector",
              "kind": "app"
            },
            {
              "id": "g2",
              "label": "Compute 3 measures",
              "kind": "security"
            }
          ],
          [
            {
              "id": "g3",
              "label": "Reserve radius",
              "kind": "security"
            }
          ],
          [
            {
              "id": "g4",
              "label": "Re-check on scale-up",
              "kind": "security"
            }
          ],
          [
            {
              "id": "g5",
              "label": "Release reservation",
              "kind": "app"
            }
          ]
        ]
      },
      {
        "title": "Dependency closure",
        "cells": [
          [
            {
              "id": "d1",
              "label": "Graph freshness ≤ 24 h",
              "kind": "security"
            },
            {
              "id": "d2",
              "label": "Downstream set",
              "kind": "app"
            }
          ],
          [
            {
              "id": "d3",
              "label": "Refuse shared SPOF",
              "kind": "risk"
            }
          ],
          [
            {
              "id": "d4",
              "label": "Watch collateral SLIs",
              "kind": "app"
            }
          ],
          [
            {
              "id": "d5",
              "label": "Record reached set",
              "kind": "store"
            }
          ]
        ]
      },
      {
        "title": "Error budget",
        "cells": [
          [
            {
              "id": "b1",
              "label": "Read SLO budget",
              "kind": "external"
            }
          ],
          [
            {
              "id": "b2",
              "label": "Debit chaos share",
              "kind": "security"
            }
          ],
          [
            {
              "id": "b3",
              "label": "Stop at exhaustion",
              "kind": "risk"
            }
          ],
          [
            {
              "id": "b4",
              "label": "Settle actual spend",
              "kind": "app"
            }
          ]
        ]
      },
      {
        "title": "Windows & incidents",
        "cells": [
          [
            {
              "id": "w1",
              "label": "Check exclusion window",
              "kind": "security"
            }
          ],
          [
            {
              "id": "w2",
              "label": "Confirm no open incident",
              "kind": "security"
            }
          ],
          [
            {
              "id": "w3",
              "label": "Subscribe to incident feed",
              "kind": "integration"
            }
          ],
          [
            {
              "id": "w4",
              "label": "Skip, do not queue",
              "kind": "decision"
            }
          ]
        ]
      },
      {
        "title": "Authorisation",
        "cells": [
          [
            {
              "id": "a1",
              "label": "Ownership check",
              "kind": "security"
            },
            {
              "id": "a2",
              "label": "Tier approval",
              "kind": "platform"
            }
          ],
          [
            {
              "id": "a3",
              "label": "Sign lease to target",
              "kind": "security"
            }
          ],
          [
            {
              "id": "a4",
              "label": "Renew only while valid",
              "kind": "security"
            }
          ],
          [
            {
              "id": "a5",
              "label": "Audit the whole chain",
              "kind": "store"
            }
          ]
        ]
      },
      {
        "title": "Reversibility",
        "cells": [
          [
            {
              "id": "r1",
              "label": "Adapter has revert",
              "kind": "security"
            },
            {
              "id": "r2",
              "label": "Proven in non-prod ≤ 30 d",
              "kind": "app"
            }
          ],
          [
            {
              "id": "r3",
              "label": "Scope to one class",
              "kind": "security"
            }
          ],
          [
            {
              "id": "r4",
              "label": "Report applied state",
              "kind": "app"
            }
          ],
          [
            {
              "id": "r5",
              "label": "Verify reversion",
              "kind": "security"
            }
          ]
        ]
      },
      {
        "title": "Telemetry coverage",
        "cells": [
          [
            {
              "id": "t1",
              "label": "SLIs exist and are fresh",
              "kind": "external"
            }
          ],
          [
            {
              "id": "t2",
              "label": "Baseline established",
              "kind": "app"
            }
          ],
          [
            {
              "id": "t3",
              "label": "Completeness threshold",
              "kind": "security"
            }
          ],
          [
            {
              "id": "t4",
              "label": "Mark INCONCLUSIVE",
              "kind": "decision"
            }
          ]
        ]
      }
    ],
    "note": "Seven independent gates. Any one refusing is a refused run; none of them can be waived by the requester.",
    "meta": {
      "v": "1.0",
      "owner": "Reliability Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "15-scheduling-and-promotion",
    "title": "Scheduling — The Promotion Ladder from Ad-hoc to Continuous",
    "layout": "flow",
    "chain": false,
    "stages": [
      {
        "title": "Non-production",
        "nodes": [
          {
            "id": "np",
            "label": "Staging run",
            "kind": "app",
            "sub": "adapter proving"
          }
        ]
      },
      {
        "title": "Attended",
        "nodes": [
          {
            "id": "att",
            "label": "Ad-hoc attended",
            "kind": "app",
            "sub": "owner watching"
          },
          {
            "id": "count",
            "label": "3 consecutive passes",
            "kind": "decision"
          }
        ]
      },
      {
        "title": "Scheduled",
        "nodes": [
          {
            "id": "sch",
            "label": "Recurring unattended",
            "kind": "app",
            "sub": "allowed windows"
          },
          {
            "id": "skip",
            "label": "Window closed → skip",
            "kind": "decision"
          }
        ]
      },
      {
        "title": "Gated",
        "nodes": [
          {
            "id": "canary",
            "label": "Canary suite",
            "kind": "integration",
            "sub": "pre-promotion"
          },
          {
            "id": "verdict",
            "label": "Pipeline verdict",
            "kind": "decision"
          }
        ]
      },
      {
        "title": "Continuous",
        "nodes": [
          {
            "id": "cv",
            "label": "Continuous verification",
            "kind": "app",
            "sub": "low intensity, always on"
          }
        ]
      },
      {
        "title": "Game day",
        "nodes": [
          {
            "id": "gd",
            "label": "Coordinated session",
            "kind": "platform",
            "sub": "facilitated, sequenced"
          },
          {
            "id": "ttd",
            "label": "Detect / mitigate times",
            "kind": "store"
          }
        ]
      }
    ],
    "edges": [
      {
        "from": "np",
        "to": "att",
        "label": "class eligible"
      },
      {
        "from": "att",
        "to": "count",
        "label": "verdicts recorded"
      },
      {
        "from": "count",
        "to": "sch",
        "label": "schedulable"
      },
      {
        "from": "sch",
        "to": "skip",
        "label": "if peak",
        "kind": "error"
      },
      {
        "from": "sch",
        "to": "canary",
        "label": "same definitions"
      },
      {
        "from": "canary",
        "to": "verdict",
        "label": "gate"
      },
      {
        "from": "verdict",
        "to": "cv",
        "label": "proven stable"
      },
      {
        "from": "cv",
        "to": "gd",
        "label": "gaps become plan"
      },
      {
        "from": "gd",
        "to": "ttd",
        "label": "human timings"
      }
    ],
    "note": "A definition only becomes unattended by earning it. Nothing reaches continuous verification on its first day.",
    "meta": {
      "v": "1.0",
      "owner": "Reliability Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "16-deployment-architecture",
    "title": "Deployment Architecture — Google Cloud, Three Regions",
    "layout": "nested",
    "boxes": [
      {
        "title": "europe-west1 — control region",
        "kind": "cloud",
        "dir": "col",
        "children": [
          {
            "title": "Control plane (GKE Autopilot, 3 zones)",
            "kind": "boundary",
            "nodes": [
              {
                "id": "api1",
                "label": "Platform API",
                "kind": "app",
                "sub": "Cloud Run"
              },
              {
                "id": "run1",
                "label": "Run controller",
                "kind": "app",
                "sub": "GKE"
              },
              {
                "id": "eval1",
                "label": "Evaluator",
                "kind": "app",
                "sub": "GKE"
              },
              {
                "id": "seq1",
                "label": "Sequencer",
                "kind": "platform",
                "sub": "Workflows"
              }
            ]
          },
          {
            "title": "Safety plane — separate deployment, fewer dependencies",
            "kind": "trust",
            "nodes": [
              {
                "id": "lease1",
                "label": "Lease issuer",
                "kind": "security",
                "sub": "Cloud Run, own SA"
              },
              {
                "id": "kill1",
                "label": "Kill switch",
                "kind": "security",
                "sub": "own endpoint + IAM"
              },
              {
                "id": "sp1",
                "label": "Guardrail state",
                "kind": "store",
                "sub": "Spanner, regional"
              }
            ]
          },
          {
            "title": "Evidence",
            "kind": "boundary",
            "nodes": [
              {
                "id": "bq",
                "label": "Evidence warehouse",
                "kind": "store",
                "sub": "BigQuery"
              },
              {
                "id": "gcs",
                "label": "Bundle objects",
                "kind": "store",
                "sub": "Cloud Storage"
              }
            ]
          }
        ]
      },
      {
        "title": "us-east4 — control replica",
        "kind": "cloud",
        "dir": "row",
        "children": [
          {
            "title": "Warm standby",
            "kind": "boundary",
            "nodes": [
              {
                "id": "api2",
                "label": "Platform API",
                "kind": "app",
                "sub": "RTO 30 min"
              },
              {
                "id": "lease2",
                "label": "Lease issuer",
                "kind": "security",
                "sub": "RTO 60 s"
              },
              {
                "id": "sp2",
                "label": "Guardrail state",
                "kind": "store",
                "sub": "Spanner replica"
              }
            ]
          }
        ]
      },
      {
        "title": "Target clusters — 6 regional GKE clusters across 3 regions",
        "kind": "onprem",
        "dir": "row",
        "children": [
          {
            "title": "chaos-system namespace",
            "kind": "trust",
            "nodes": [
              {
                "id": "ds",
                "label": "Injection agent",
                "kind": "app",
                "sub": "DaemonSet, ≤1% CPU"
              },
              {
                "id": "wd",
                "label": "Lease watchdog",
                "kind": "security"
              },
              {
                "id": "oob",
                "label": "Out-of-band reverter",
                "kind": "security",
                "sub": "break-glass SA"
              }
            ]
          },
          {
            "title": "Workload namespaces",
            "kind": "lane",
            "nodes": [
              {
                "id": "wl",
                "label": "900 services",
                "kind": "app",
                "sub": "40,000 pods"
              }
            ]
          }
        ]
      }
    ],
    "edges": [
      {
        "from": "lease1",
        "to": "ds",
        "label": "lease, 5 s renew"
      },
      {
        "from": "kill1",
        "to": "wd",
        "label": "halt ≤ 30 s"
      },
      {
        "from": "ds",
        "to": "wl",
        "label": "fault applied"
      },
      {
        "from": "sp1",
        "to": "sp2",
        "label": "Spanner replication"
      },
      {
        "from": "eval1",
        "to": "lease1",
        "label": "renew or not"
      },
      {
        "from": "run1",
        "to": "bq",
        "label": "evidence"
      }
    ],
    "note": "Guardrail and lease state is regionally partitioned: no cross-region hop sits in the abort path.",
    "meta": {
      "v": "1.0",
      "owner": "Reliability Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "17-release-pipeline",
    "title": "Release Pipeline — Shipping the Platform That Breaks Production",
    "layout": "flow",
    "chain": false,
    "stages": [
      {
        "title": "Source",
        "nodes": [
          {
            "id": "src",
            "label": "Repo + review",
            "kind": "store",
            "sub": "2 approvals"
          },
          {
            "id": "adapters",
            "label": "Adapter contracts",
            "kind": "app"
          }
        ]
      },
      {
        "title": "Build",
        "nodes": [
          {
            "id": "build",
            "label": "Cloud Build",
            "kind": "app",
            "sub": "SLSA provenance"
          },
          {
            "id": "ar",
            "label": "Artifact Registry",
            "kind": "store",
            "sub": "signed images"
          }
        ]
      },
      {
        "title": "Adapter gate",
        "nodes": [
          {
            "id": "revert",
            "label": "Revert proof suite",
            "kind": "security",
            "sub": "every adapter"
          },
          {
            "id": "leasetest",
            "label": "Lease expiry test",
            "kind": "security",
            "sub": "kill the issuer"
          }
        ]
      },
      {
        "title": "Staging",
        "nodes": [
          {
            "id": "stg",
            "label": "Staging cluster",
            "kind": "app"
          },
          {
            "id": "selfchaos",
            "label": "Self-chaos suite",
            "kind": "app",
            "sub": "platform as target"
          }
        ]
      },
      {
        "title": "Canary",
        "nodes": [
          {
            "id": "can",
            "label": "One cluster, one class",
            "kind": "app",
            "sub": "24 h"
          },
          {
            "id": "abortsla",
            "label": "Abort-time SLO check",
            "kind": "decision",
            "sub": "p99 ≤ 10 s"
          }
        ]
      },
      {
        "title": "Fleet",
        "nodes": [
          {
            "id": "roll",
            "label": "Cluster-by-cluster",
            "kind": "app",
            "sub": "6 waves"
          },
          {
            "id": "back",
            "label": "Automatic rollback",
            "kind": "security"
          }
        ]
      }
    ],
    "edges": [
      {
        "from": "src",
        "to": "build",
        "label": "on merge"
      },
      {
        "from": "adapters",
        "to": "build",
        "label": "contract tests"
      },
      {
        "from": "build",
        "to": "ar",
        "label": "signed image"
      },
      {
        "from": "ar",
        "to": "revert",
        "label": "under test"
      },
      {
        "from": "revert",
        "to": "leasetest",
        "label": "then"
      },
      {
        "from": "leasetest",
        "to": "stg",
        "label": "expiry clears"
      },
      {
        "from": "stg",
        "to": "selfchaos",
        "label": "platform as target"
      },
      {
        "from": "selfchaos",
        "to": "can",
        "label": "green"
      },
      {
        "from": "can",
        "to": "abortsla",
        "label": "measured"
      },
      {
        "from": "abortsla",
        "to": "roll",
        "label": "in budget"
      },
      {
        "from": "abortsla",
        "to": "back",
        "label": "over budget",
        "kind": "error"
      }
    ],
    "note": "An agent release is gated on proving reversion, not on passing unit tests. That gate is the product.",
    "meta": {
      "v": "1.0",
      "owner": "Reliability Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "18-observability",
    "title": "Observability — Signal Type by Pipeline Stage",
    "layout": "grid",
    "columns": [
      "Definition & permit",
      "Injection",
      "Evaluation",
      "Abort & revert",
      "Evidence"
    ],
    "rows": [
      {
        "title": "Metrics",
        "cells": [
          [
            {
              "id": "m1",
              "label": "Definitions rejected",
              "kind": "app"
            },
            {
              "id": "m2",
              "label": "Guardrail refusals",
              "kind": "security"
            }
          ],
          [
            {
              "id": "m3",
              "label": "Active leases",
              "kind": "app"
            },
            {
              "id": "m4",
              "label": "Renewal rate",
              "kind": "app"
            }
          ],
          [
            {
              "id": "m5",
              "label": "Signal freshness p95",
              "kind": "app"
            }
          ],
          [
            {
              "id": "m6",
              "label": "Abort latency p99",
              "kind": "security"
            },
            {
              "id": "m7",
              "label": "Revert verify rate",
              "kind": "security"
            }
          ],
          [
            {
              "id": "m8",
              "label": "Verdict mix",
              "kind": "app"
            }
          ]
        ]
      },
      {
        "title": "Logs",
        "cells": [
          [
            {
              "id": "l1",
              "label": "Approval decisions",
              "kind": "store"
            }
          ],
          [
            {
              "id": "l2",
              "label": "Applied vs requested",
              "kind": "store"
            }
          ],
          [
            {
              "id": "l3",
              "label": "Window evaluations",
              "kind": "store"
            }
          ],
          [
            {
              "id": "l4",
              "label": "Revert attempts",
              "kind": "store"
            }
          ],
          [
            {
              "id": "l5",
              "label": "Bundle sealing",
              "kind": "store"
            }
          ]
        ]
      },
      {
        "title": "Traces",
        "cells": [
          [
            {
              "id": "t1",
              "label": "Dry-run resolve",
              "kind": "app"
            }
          ],
          [
            {
              "id": "t2",
              "label": "Lease issue to inject",
              "kind": "app"
            }
          ],
          [
            {
              "id": "t3",
              "label": "Collector to verdict",
              "kind": "app"
            }
          ],
          [
            {
              "id": "t4",
              "label": "Breach to cleared",
              "kind": "security"
            }
          ],
          [
            {
              "id": "t5",
              "label": "Write to warehouse",
              "kind": "app"
            }
          ]
        ]
      },
      {
        "title": "Alerts",
        "cells": [
          [
            {
              "id": "a1",
              "label": "Stale inventory",
              "kind": "risk"
            }
          ],
          [
            {
              "id": "a2",
              "label": "Agent unreachable",
              "kind": "risk"
            }
          ],
          [
            {
              "id": "a3",
              "label": "Evaluator blind",
              "kind": "risk"
            }
          ],
          [
            {
              "id": "a4",
              "label": "Revert unconfirmed",
              "kind": "risk"
            },
            {
              "id": "a5",
              "label": "Kill switch used",
              "kind": "risk"
            }
          ],
          [
            {
              "id": "a6",
              "label": "Evidence gap",
              "kind": "risk"
            }
          ]
        ]
      },
      {
        "title": "Reports",
        "cells": [
          [
            {
              "id": "r1",
              "label": "Escalations granted",
              "kind": "app"
            }
          ],
          [
            {
              "id": "r2",
              "label": "Classes exercised",
              "kind": "app"
            }
          ],
          [
            {
              "id": "r3",
              "label": "Inconclusive share",
              "kind": "app"
            }
          ],
          [
            {
              "id": "r4",
              "label": "Aborts by cause",
              "kind": "app"
            }
          ],
          [
            {
              "id": "r5",
              "label": "Untested dependencies",
              "kind": "app"
            },
            {
              "id": "r6",
              "label": "Cost per team",
              "kind": "app"
            }
          ]
        ]
      }
    ],
    "note": "Two signals are load-bearing: abort latency p99, and the share of runs the platform could not observe.",
    "meta": {
      "v": "1.0",
      "owner": "Reliability Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "19-finding-to-remediation-loop",
    "title": "The Loop That Makes It Worth Doing",
    "layout": "cycle",
    "centre": {
      "label": "Coverage",
      "sub": "per service & class"
    },
    "nodes": [
      {
        "id": "c1",
        "label": "Untested dependency",
        "kind": "risk",
        "sub": "the gap report"
      },
      {
        "id": "c2",
        "label": "Hypothesis written",
        "kind": "app",
        "sub": "falsifiable"
      },
      {
        "id": "c3",
        "label": "Bounded run",
        "kind": "app",
        "sub": "≤ 5% radius"
      },
      {
        "id": "c4",
        "label": "Verdict recorded",
        "kind": "store",
        "sub": "one of five"
      },
      {
        "id": "c5",
        "label": "Finding filed",
        "kind": "risk",
        "sub": "if refuted"
      },
      {
        "id": "c6",
        "label": "Remediation shipped",
        "kind": "app",
        "sub": "tracked item"
      },
      {
        "id": "c7",
        "label": "Re-run confirms",
        "kind": "security",
        "sub": "same definition"
      },
      {
        "id": "c8",
        "label": "Promoted to scheduled",
        "kind": "platform",
        "sub": "3 passes"
      }
    ],
    "ringLabels": [
      "gap found",
      "made testable",
      "executed safely",
      "judged",
      "weakness named",
      "fixed",
      "proven fixed",
      "kept fixed"
    ],
    "meta": {
      "v": "1.0",
      "owner": "Reliability Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "20-security-trust-zones",
    "title": "Security — Trust Zones and What Crosses Them",
    "layout": "zones",
    "zones": [
      {
        "title": "Human zone — authenticated people",
        "kind": "trust",
        "nodes": [
          {
            "id": "own",
            "label": "Service owner",
            "kind": "actor"
          },
          {
            "id": "appr",
            "label": "Tier-1 approver",
            "kind": "actor"
          },
          {
            "id": "sre",
            "label": "Facilitator",
            "kind": "actor"
          }
        ]
      },
      {
        "title": "Control zone — decides permission, holds no injection privilege",
        "kind": "boundary",
        "nodes": [
          {
            "id": "api",
            "label": "Platform API",
            "kind": "app"
          },
          {
            "id": "guard",
            "label": "Guardrail engine",
            "kind": "security"
          },
          {
            "id": "audit",
            "label": "Audit log",
            "kind": "store"
          }
        ]
      },
      {
        "title": "Authority zone — the only signer, separately deployed",
        "kind": "trust",
        "nodes": [
          {
            "id": "lease",
            "label": "Lease issuer",
            "kind": "security"
          },
          {
            "id": "kill",
            "label": "Kill switch",
            "kind": "security"
          },
          {
            "id": "kms",
            "label": "Signing key",
            "kind": "security",
            "sub": "Cloud KMS"
          }
        ]
      },
      {
        "title": "Target zone — the only privilege, scoped per lease",
        "kind": "onprem",
        "nodes": [
          {
            "id": "agent",
            "label": "Injection agent",
            "kind": "app"
          },
          {
            "id": "priv",
            "label": "Privileged adapters",
            "kind": "risk",
            "sub": "netem, node actions"
          },
          {
            "id": "wl",
            "label": "Target workloads",
            "kind": "app"
          }
        ]
      },
      {
        "title": "Evidence zone — append-only, read widely",
        "kind": "boundary",
        "nodes": [
          {
            "id": "bq",
            "label": "Evidence warehouse",
            "kind": "store"
          },
          {
            "id": "cov",
            "label": "Coverage reports",
            "kind": "app"
          }
        ]
      },
      {
        "title": "Break-glass zone — separately authorised",
        "kind": "trust",
        "nodes": [
          {
            "id": "oob",
            "label": "Out-of-band reverter",
            "kind": "security"
          },
          {
            "id": "sre2",
            "label": "Reliability on-call",
            "kind": "actor"
          }
        ]
      }
    ],
    "edges": [
      {
        "from": "own",
        "to": "api",
        "label": "OIDC, no static creds"
      },
      {
        "from": "appr",
        "to": "api",
        "label": "two-party approval"
      },
      {
        "from": "api",
        "to": "guard",
        "label": "resolve"
      },
      {
        "from": "guard",
        "to": "lease",
        "label": "permission only"
      },
      {
        "from": "kms",
        "to": "lease",
        "label": "sign"
      },
      {
        "from": "lease",
        "to": "agent",
        "label": "signed, target-bound"
      },
      {
        "from": "agent",
        "to": "priv",
        "label": "per-class authz"
      },
      {
        "from": "priv",
        "to": "wl",
        "label": "fault"
      },
      {
        "from": "agent",
        "to": "bq",
        "label": "applied state"
      },
      {
        "from": "kill",
        "to": "agent",
        "label": "halt"
      },
      {
        "from": "sre2",
        "to": "oob",
        "label": "break glass"
      },
      {
        "from": "oob",
        "to": "wl",
        "label": "force revert"
      },
      {
        "from": "api",
        "to": "audit",
        "label": "every action"
      }
    ],
    "note": "The control zone can never inject and the target zone can never self-authorise. Only the authority zone signs.",
    "meta": {
      "v": "1.0",
      "owner": "Reliability Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "21-identity-and-lease-issuance",
    "title": "Identity Flow — Who Proves What Before a Fault Exists",
    "layout": "sequence",
    "lifelines": [
      {
        "id": "own",
        "label": "Service owner",
        "kind": "actor"
      },
      {
        "id": "idp",
        "label": "Identity provider",
        "kind": "security"
      },
      {
        "id": "api",
        "label": "Platform API",
        "kind": "app"
      },
      {
        "id": "cat",
        "label": "Service catalogue",
        "kind": "external"
      },
      {
        "id": "lease",
        "label": "Lease issuer",
        "kind": "security"
      },
      {
        "id": "kms",
        "label": "Cloud KMS",
        "kind": "security"
      },
      {
        "id": "agent",
        "label": "Injection agent",
        "kind": "app"
      }
    ],
    "messages": [
      {
        "from": "own",
        "to": "idp",
        "label": "authenticate"
      },
      {
        "from": "idp",
        "to": "own",
        "label": "OIDC token"
      },
      {
        "from": "own",
        "to": "api",
        "label": "start run + token"
      },
      {
        "from": "api",
        "to": "idp",
        "label": "verify token"
      },
      {
        "from": "api",
        "to": "cat",
        "label": "owns this service?"
      },
      {
        "from": "cat",
        "to": "api",
        "label": "owner + tier 1"
      },
      {
        "from": "api",
        "to": "own",
        "label": "approver required"
      },
      {
        "from": "own",
        "to": "api",
        "label": "approval attached"
      },
      {
        "from": "api",
        "to": "lease",
        "label": "issue for targets + class"
      },
      {
        "from": "lease",
        "to": "kms",
        "label": "sign claim"
      },
      {
        "from": "kms",
        "to": "lease",
        "label": "signature"
      },
      {
        "from": "agent",
        "to": "idp",
        "label": "workload identity"
      },
      {
        "from": "idp",
        "to": "agent",
        "label": "cluster-scoped token"
      },
      {
        "from": "agent",
        "to": "lease",
        "label": "fetch lease"
      },
      {
        "from": "lease",
        "to": "agent",
        "label": "lease, 15 s, this target only"
      },
      {
        "from": "agent",
        "to": "agent",
        "label": "verify signature + scope"
      },
      {
        "from": "agent",
        "to": "lease",
        "label": "renew every 5 s"
      },
      {
        "from": "lease",
        "to": "agent",
        "label": "refuse after abort",
        "kind": "error"
      }
    ],
    "note": "The agent verifies the lease itself. A forged or out-of-scope lease is refused in the data plane, not upstream.",
    "meta": {
      "v": "1.0",
      "owner": "Reliability Architecture",
      "date": "2026-09"
    }
  }
]