Container Registry and Software Supply Chain Platform  ·  View 33 of 33  ·  6 · Assurance

Failure Modes and Degraded Operation

Every named failure class, how it is detected, what the platform does, and what risk is left over.

Editable source SVG draw.io All views
Failure Detected by Degraded behaviour Residual risk Artifact read path Registry pull down Pull SLO burn rate Node and regional cache serve Cold digest scale-out fails Artifact write path Registry push down Push error rate Builds queue and back off Release-day backlog Decision point Policy service unreachable Bundle age metric Cached bundle ≤ 30 min Beyond that, env posture Transparency and keys Rekor or Vault down Signing error rate Proofs queue, verify continues Unproofed: non-prod only Intelligence Scanner backlog, feed stale Queue age and feed lag Production scanned first No scan, no production Evidence integrity Missing attestation, bit-rot Digest re-verified on read Quarantine and alert Absent evidence is a denial Time and replication Clock skew, replication lag Bounded tolerance check Distinct retryable reason Denied, never allowed Policy change Bundle misconfiguration Dry run over last 24 h Override needed over 2% Override is still human Failure Modes and Degraded Operation Risk / gap Security / platform Application we own Decision point Every degraded behaviour is a stated policy choice. None of them is a silent allow. v 1.0 · owner SRE and Security · date 2026-09

The rule

  • Absent evidence is a denial. Nothing is trusted because nobody checked it
  • Every degraded behaviour is a stated policy choice recorded in the bundle, never a library default
  • None of the degraded paths is a silent allow

Recoverability

  • The platform is recoverable from the evidence store and blob store alone
  • Loss of the metadata store or the component index is a rebuild, not a data loss
  • Digest is re-verified on read at the enforcement point; a mismatch quarantines the artifact and alerts

What still needs a decision

  • Whether development really tolerates fail-open, or whether that is convenience arguing with the threat model
  • Whether a changed verdict should evict running workloads, and who owns the disruption budget if it does
  • Whether 7-year retention is what audit actually requires, or an assumption that has never been tested against the obligation
◀  Tenant Isolation All views
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 33 views · open-source, on-premises33-failure-modes