[ { "id": "01-system-context", "title": "Flipkart Marketplace — System Context", "layout": "context", "canvas": { "width": 1700 }, "colWidth": 260, "system": { "label": "Flipkart Marketplace Platform", "sub": "500M customers · 6M orders/day" }, "groups": [ { "side": "left", "title": "People", "nodes": [ { "id": "shopper", "label": "Shopper", "kind": "actor", "sub": "500M registered", "rel": "browse and buy", "dir": "in" }, { "id": "seller", "label": "Seller", "kind": "actor", "sub": "1.4M onboarded", "rel": "list and ship", "dir": "in" }, { "id": "agent", "label": "Care agent", "kind": "actor", "sub": "one order console", "rel": "resolve", "dir": "in" }, { "id": "rider", "label": "Delivery partner", "kind": "actor", "sub": "hub and last mile", "rel": "deliver", "dir": "in" } ] }, { "side": "right", "title": "Money and compliance", "nodes": [ { "id": "upi", "label": "UPI / NPCI", "kind": "external", "sub": "collect + intent", "rel": "authorise" }, { "id": "psp", "label": "Cards, wallets, BNPL", "kind": "external", "sub": "3 acquirers routed", "rel": "capture" }, { "id": "bank", "label": "Nodal settlement bank", "kind": "external", "rel": "payouts", "kind2": "batch" } ] }, { "side": "top", "title": "Demand and content partners", "nodes": [ { "id": "ondc", "label": "ONDC network", "kind": "external", "rel": "catalog", "kind2": "bidirectional" }, { "id": "brand", "label": "Brand catalog feeds", "kind": "external", "rel": "SKU master", "dir": "in", "kind2": "batch" }, { "id": "ads", "label": "Ad and affiliate partners", "kind": "external", "rel": "clicks", "kind2": "bidirectional" } ] }, { "side": "bottom", "title": "Supply, identity and messaging", "nodes": [ { "id": "carrier", "label": "3PL carriers", "kind": "external", "sub": "8 integrated", "rel": "manifest", "kind2": "bidirectional" }, { "id": "kyc", "label": "KYC, GST and e-invoice", "kind": "external", "sub": "PAN · GSTIN · IRP", "rel": "verify" }, { "id": "comms", "label": "SMS / WhatsApp / push", "kind": "external", "rel": "notify", "dir": "out", "kind2": "async" } ] } ], "note": "Everything inside the boundary is drawn from view 08 onwards. Warehousing robotics and the seller lending book are out of scope.", "meta": { "v": "1.0", "owner": "Enterprise Architecture", "date": "2026-09" } }, { "id": "02-high-level-architecture", "title": "High-Level Architecture — Edge to Data Platform", "layout": "flow", "canvas": { "width": 1860 }, "chain": true, "align": "top", "nodeWidth": 196, "stages": [ { "title": "Edge", "nodes": [ { "id": "afd", "label": "Front Door + WAF", "kind": "integration", "sub": "Azure Front Door", "icon": "azure_frontdoor" }, { "id": "cdn", "label": "Media and CDN", "kind": "integration", "sub": "Blob + imgproxy", "icon": "azure_cdn-profiles" }, { "id": "bot", "label": "Bot and rate limit", "kind": "security", "sub": "Envoy + Redis" } ] }, { "title": "Entry", "nodes": [ { "id": "bff", "label": "Customer BFF", "kind": "app", "sub": "Envoy Gateway", "icon": "envoy" }, { "id": "apim", "label": "Seller and partner API", "kind": "integration", "sub": "API Management" }, { "id": "idp", "label": "Identity", "kind": "security", "sub": "Keycloak OIDC" } ] }, { "title": "Discovery", "nodes": [ { "id": "catalog", "label": "Catalog", "kind": "app", "sub": "Cosmos DB NoSQL" }, { "id": "search", "label": "Search", "kind": "app", "sub": "OpenSearch" }, { "id": "reco", "label": "Recommendations", "kind": "app", "sub": "KServe" }, { "id": "price", "label": "Pricing and offers", "kind": "app", "sub": "Redis + rules" } ] }, { "title": "Commerce", "nodes": [ { "id": "cart", "label": "Cart and checkout", "kind": "app", "sub": "Java 21" }, { "id": "inv", "label": "Inventory", "kind": "app", "sub": "Redis + Citus", "icon": "fa5_boxes" }, { "id": "order", "label": "Order", "kind": "app", "sub": "Citus shards", "icon": "fa5_receipt" }, { "id": "pay", "label": "Payments", "kind": "app", "sub": "PCI enclave" } ] }, { "title": "Backbone", "nodes": [ { "id": "kafka", "label": "Event backbone", "kind": "queue", "sub": "Kafka / Strimzi", "icon": "kafka" }, { "id": "flink", "label": "Stream processing", "kind": "app", "sub": "Flink" }, { "id": "temporal", "label": "Saga orchestration", "kind": "platform", "sub": "Temporal" } ] }, { "title": "Fulfilment", "nodes": [ { "id": "ff", "label": "Fulfilment engine", "kind": "app", "sub": "OR-Tools" }, { "id": "logi", "label": "Logistics and last mile", "kind": "app" }, { "id": "notify", "label": "Notification", "kind": "app", "sub": "fan-out workers", "icon": "fa5_bell" } ] }, { "title": "Data and ML", "nodes": [ { "id": "lake", "label": "Lakehouse", "kind": "store", "sub": "Iceberg on ADLS" }, { "id": "ml", "label": "ML platform", "kind": "platform", "sub": "MLflow + KServe" }, { "id": "trust", "label": "Trust and fraud", "kind": "security", "sub": "Flink + models" } ] } ], "edges": [ { "from": "kafka", "to": "lake", "label": "raw events", "kind": "async" }, { "from": "kafka", "to": "search", "label": "index updates", "kind": "async", "route": "gutter" }, { "from": "ml", "to": "reco", "label": "models", "kind": "batch", "route": "gutter" } ], "note": "Read paths are cached at every hop; only inventory, payment and order state are read through to their systems of record.", "meta": { "v": "1.0", "owner": "Enterprise Architecture", "date": "2026-09" } }, { "id": "03-actors-and-journeys", "title": "Actors and Their Core Journeys", "layout": "actors", "canvas": { "width": 1780 }, "cardWidth": 268, "groups": [ { "title": "The people who buy", "kind": "boundary", "actors": [ { "id": "returning", "label": "Returning shopper", "sub": "180M monthly active", "goal": "Buy the thing I already decided on, in under a minute, without losing my basket to a bank page.", "journeys": [ { "id": "j-peak", "label": "Buy during a sale event", "sub": "1.5M orders/hour peak" }, { "id": "j-track", "label": "Track a delivery" }, { "id": "j-return", "label": "Return and get refunded", "sub": "6-8% of units" } ] }, { "id": "newbuyer", "label": "First-time buyer", "sub": "tier-2 and tier-3, 3G", "goal": "Work out whether this seller is real before I pay anything, and pay cash if I am not sure.", "journeys": [ { "id": "j-browse", "label": "Search and compare offers" }, { "id": "j-cod", "label": "Place a COD order" } ] } ] }, { "title": "The people who sell", "kind": "boundary", "actors": [ { "id": "smb", "label": "Small seller", "sub": "1.4M total, 90% long tail", "goal": "Get listed and paid without hiring anyone to operate a dashboard for me.", "journeys": [ { "id": "j-onboard", "label": "Onboard and pass KYC" }, { "id": "j-list", "label": "List, price and stock a SKU" }, { "id": "j-settle", "label": "Get settled and reconciled", "sub": "T+7 cycle" } ] }, { "id": "brandseller", "label": "Brand or large seller", "sub": "top 2% by GMV", "goal": "Push a 200k-SKU catalog and a price change through an API and see it live everywhere within minutes.", "journeys": [ { "id": "j-bulk", "label": "Bulk catalog and price feed" }, { "id": "j-campaign", "label": "Run a sale campaign" } ] } ] }, { "title": "The people who run it", "kind": "onprem", "actors": [ { "id": "care", "label": "Care agent", "sub": "one console, 11 languages", "goal": "Answer where is my order and issue the refund on one screen, without asking the customer twice.", "journeys": [ { "id": "j-resolve", "label": "Resolve an order query" }, { "id": "j-goodwill", "label": "Issue a goodwill refund" } ] }, { "id": "trustops", "label": "Trust and safety analyst", "sub": "marketplace governance", "goal": "Take a fraudulent seller off the platform before the orders they cannot fulfil are paid for.", "journeys": [ { "id": "j-riskcase", "label": "Work a seller risk case" }, { "id": "j-dispute", "label": "Adjudicate a dispute" } ] }, { "id": "sre", "label": "On-call engineer", "sub": "follow the sun, 2 regions", "goal": "Know which of 400 services broke checkout before the conversion graph does.", "journeys": [ { "id": "j-incident", "label": "Triage a peak-hour incident" }, { "id": "j-degrade", "label": "Shed load deliberately" } ] } ] }, { "title": "Partners and machines", "kind": "cloud", "actors": [ { "id": "rider2", "label": "Delivery partner", "kind": "actor", "sub": "hub scan to doorstep", "goal": "Get a route I can finish before dark and a way to take cash that reconciles itself.", "journeys": [ { "id": "j-lastmile", "label": "Run a last-mile route" }, { "id": "j-codrec", "label": "Remit COD collections" } ] }, { "id": "carrier2", "label": "3PL carrier API", "kind": "external", "sub": "8 integrated", "goal": "Receive a manifest that loads without a human touching it, and post scans back at my own cadence.", "journeys": [ { "id": "j-manifest", "label": "Collect a despatch manifest" }, { "id": "j-scan", "label": "Post a tracking scan" } ] }, { "id": "settlejob", "label": "Settlement run", "kind": "platform", "sub": "nightly, T+1 close", "goal": "Close the day so that every rupee taken, refunded and commissioned reconciles to the paisa.", "journeys": [ { "id": "j-recon", "label": "Reconcile PSP and ledger" } ] }, { "id": "mljob", "label": "Ranking retrain", "kind": "platform", "sub": "hourly features, daily model", "goal": "Refresh ranking and fraud models before the evening peak without touching the serving path.", "journeys": [ { "id": "j-retrain", "label": "Retrain and canary a model" } ] } ] } ], "note": "Volumes are the stated public scale plus a 10x sale-event multiplier. Machines with an SLA are actors here because otherwise they end up with no owner and no failure path.", "meta": { "v": "1.0", "owner": "Product + Enterprise Architecture", "date": "2026-09" } }, { "id": "04-journey-peak-purchase", "title": "User Journey — Shopper Buys During a Sale Event", "layout": "journey", "canvas": { "width": 1780 }, "actor": { "label": "Returning shopper", "sub": "mobile-first, 180M MAU", "goal": "Get the deal I set an alarm for, before it sells out", "trigger": "A push notification at the top of the sale hour", "success": "Order confirmed, unit reserved, payment captured once" }, "phases": [ { "title": "Notice", "sub": "push" }, { "title": "Find", "sub": "search" }, { "title": "Decide", "sub": "offers" }, { "title": "Reserve", "moment": true }, { "title": "Pay", "moment": true }, { "title": "Confirm" } ], "lanes": [ { "title": "What they do", "kind": "step", "cells": [ [ { "label": "Taps the sale push" } ], [ { "label": "Searches the model" }, { "label": "Filters by price" } ], [ { "label": "Compares sellers" }, { "label": "Applies a coupon" } ], [ { "label": "Adds to cart" }, { "label": "Hits Buy Now" } ], [ { "label": "Chooses UPI" }, { "label": "Approves in bank app" } ], [ { "label": "Sees the order" } ] ] }, { "title": "Where", "kind": "touch", "cells": [ [ { "label": "Push", "sub": "FCM / APNs" } ], [ { "label": "App search", "sub": "typeahead" } ], [ { "label": "Product page", "sub": "Buy Box" } ], [ { "label": "Cart", "sub": "server held" } ], [ { "label": "UPI intent", "sub": "leaves the app" } ], [ { "label": "Order tracker" } ] ] }, { "title": "How it feels", "kind": "emotion", "levels": [ "Delighted", "Fine", "Frustrated" ], "points": [ 2, 1, 1, 0, 0, 2 ] }, { "title": "Behind the glass", "kind": "system", "cells": [ [ { "label": "Campaign service" } ], [ { "label": "Search and ranking" } ], [ { "label": "Buy Box and pricing" } ], [ { "label": "Inventory reserve" } ], [ { "label": "Payment orchestrator" } ], [ { "label": "Order and notify" } ] ] }, { "title": "Where it hurts", "kind": "pain", "cells": [ [], [ { "label": "Queue page at 12:00" } ], [ { "label": "Price differs from list" } ], [ { "label": "Oversold at checkout" } ], [ { "label": "UPI app loses the cart" }, { "label": "Double debit, no order" } ], [] ] }, { "title": "What would fix it", "kind": "gain", "cells": [ [], [ { "label": "Pre-warmed cache" } ], [ { "label": "One price source" } ], [ { "label": "Reserve before pay" } ], [ { "label": "Server-side cart" }, { "label": "Idempotent capture" } ], [] ] }, { "title": "How we know", "kind": "metric", "cells": [ [ { "label": "Open rate 14%" } ], [ { "label": "p95 search 280 ms" } ], [ { "label": "PDP p95 300 ms" } ], [ { "label": "Oversell rate 0" } ], [ { "label": "Drop-off 11.4%" } ], [ { "label": "Confirm p95 2 s" } ] ] } ], "note": "Reserve and Pay are the trough and the two moments of truth. Views 14 and 15 are the architectural answer to them.", "meta": { "v": "1.0", "owner": "Product + Enterprise Architecture", "date": "2026-09" } }, { "id": "05-journey-seller-listing-to-settlement", "title": "User Journey — Seller From First Listing to Settlement", "layout": "journey", "canvas": { "width": 1780 }, "actor": { "label": "Small seller", "sub": "long tail, 1.4M sellers", "goal": "Be listed, sell, and be paid, without a back office", "trigger": "Signing up with a PAN and a GSTIN on a phone", "success": "Money in the bank on T+7, matching what the app said" }, "phases": [ { "title": "Onboard", "sub": "KYC" }, { "title": "List", "sub": "catalog" }, { "title": "Win", "sub": "Buy Box" }, { "title": "Ship", "moment": true }, { "title": "Get paid", "moment": true }, { "title": "Reconcile" } ], "lanes": [ { "title": "What they do", "kind": "step", "cells": [ [ { "label": "Submits PAN, GSTIN" }, { "label": "Adds bank account" } ], [ { "label": "Matches to a product" }, { "label": "Sets price and stock" } ], [ { "label": "Watches the offer rank" } ], [ { "label": "Packs and hands over" } ], [ { "label": "Reads the payout" } ], [ { "label": "Disputes a deduction" } ] ] }, { "title": "Where", "kind": "touch", "cells": [ [ { "label": "Seller app", "sub": "OTP and documents" } ], [ { "label": "Listing tool", "sub": "or bulk API" } ], [ { "label": "Seller dashboard", "sub": "Pinot backed" } ], [ { "label": "Manifest", "sub": "label and pickup" } ], [ { "label": "Payout statement" } ], [ { "label": "Dispute case" } ] ] }, { "title": "How it feels", "kind": "emotion", "levels": [ "Delighted", "Fine", "Frustrated" ], "points": [ 1, 0, 1, 1, 2, 0 ] }, { "title": "Behind the glass", "kind": "system", "cells": [ [ { "label": "Seller onboarding" }, { "label": "KYC and risk score" } ], [ { "label": "Catalog moderation" } ], [ { "label": "Buy Box scoring" } ], [ { "label": "Fulfilment engine" } ], [ { "label": "Settlement ledger" } ], [ { "label": "Dispute workflow" } ] ] }, { "title": "Where it hurts", "kind": "pain", "cells": [ [ { "label": "KYC stalls for days" } ], [ { "label": "Rejected, no reason" } ], [], [ { "label": "SLA breach, no warning" } ], [], [ { "label": "Deduction unexplained" } ] ] }, { "title": "What would fix it", "kind": "gain", "cells": [ [ { "label": "Async KYC with status" } ], [ { "label": "Reason code on reject" } ], [ { "label": "Show the Buy Box gap" } ], [ { "label": "Predictive SLA alert" } ], [ { "label": "Line-item statement" } ], [ { "label": "Traceable ledger entry" } ] ] }, { "title": "How we know", "kind": "metric", "cells": [ [ { "label": "KYC p50 4 h" } ], [ { "label": "Live in 15 min" } ], [ { "label": "Buy Box win rate" } ], [ { "label": "SLA breach 1.8%" } ], [ { "label": "T+7 on time 99.9%" } ], [ { "label": "Dispute age p90" } ] ] } ], "note": "Settlement is the only phase where the platform holds the money of another business; the ledger behind it is why view 13 exists.", "meta": { "v": "1.0", "owner": "Product + Enterprise Architecture", "date": "2026-09" } }, { "id": "06-journey-return-and-refund", "title": "User Journey — Return, Reverse Pickup and Refund", "layout": "journey", "canvas": { "width": 1700 }, "actor": { "label": "Returning shopper", "sub": "6-8% of units come back", "goal": "Send the wrong item back and get money, not a credit note", "trigger": "Opening a box that is damaged, wrong or not as described", "success": "Refund on the original instrument, visible while it happens" }, "phases": [ { "title": "Raise", "sub": "in the app" }, { "title": "Pick up", "sub": "reverse leg" }, { "title": "Inspect", "moment": true }, { "title": "Refund", "moment": true }, { "title": "Recover", "sub": "who pays" } ], "lanes": [ { "title": "What they do", "kind": "step", "cells": [ [ { "label": "Picks a reason" }, { "label": "Uploads a photo" } ], [ { "label": "Hands to the rider" } ], [ { "label": "Waits" } ], [ { "label": "Checks the bank" } ], [] ] }, { "title": "Where", "kind": "touch", "cells": [ [ { "label": "Returns flow", "sub": "app" } ], [ { "label": "Rider app", "sub": "QR handover" } ], [ { "label": "Return centre" } ], [ { "label": "Refund status" } ], [ { "label": "Seller dashboard" } ] ] }, { "title": "How it feels", "kind": "emotion", "levels": [ "Delighted", "Fine", "Frustrated" ], "points": [ 1, 1, 0, 2, null ] }, { "title": "Behind the glass", "kind": "system", "cells": [ [ { "label": "Returns service" }, { "label": "Abuse scoring" } ], [ { "label": "Reverse logistics" } ], [ { "label": "Grading and restock" } ], [ { "label": "Refund saga" } ], [ { "label": "Claims and chargeback" } ] ] }, { "title": "Where it hurts", "kind": "pain", "cells": [ [], [ { "label": "Pickup missed twice" } ], [ { "label": "Silence for 5 days" } ], [ { "label": "COD refund needs IFSC" } ], [ { "label": "Seller charged unfairly" } ] ] }, { "title": "What would fix it", "kind": "gain", "cells": [ [ { "label": "Instant refund if low risk" } ], [ { "label": "Slot the pickup" } ], [ { "label": "Push on each grade step" } ], [ { "label": "UPI handle at checkout" } ], [ { "label": "Evidence-linked claim" } ] ] }, { "title": "How we know", "kind": "metric", "cells": [ [ { "label": "Return rate 6.8%" } ], [ { "label": "Pickup SLA 92%" } ], [ { "label": "Grade p50 36 h" } ], [ { "label": "Refund p90 48 h" } ], [ { "label": "Claim win rate" } ] ] } ], "note": "The empty Recover cells are where the customer view ends, not a gap. Inspect is where trust is lost, and instant refunds trade money for retention.", "meta": { "v": "1.0", "owner": "Product + Enterprise Architecture", "date": "2026-09" } }, { "id": "07-layered-architecture", "title": "Layered Architecture — What Depends on What", "layout": "bands", "canvas": { "width": 1740 }, "layerHeaderWidth": 168, "bands": [ { "name": "Experience", "nodes": [ { "id": "l-and", "label": "Android app", "kind": "app", "sub": "Kotlin" }, { "id": "l-ios", "label": "iOS app", "kind": "app", "sub": "Swift" }, { "id": "l-web", "label": "Mobile web", "kind": "app", "sub": "React PWA" }, { "id": "l-sell", "label": "Seller app", "kind": "app", "sub": "React" }, { "id": "l-care", "label": "Care console", "kind": "app" }, { "id": "l-ride", "label": "Rider app", "kind": "app", "sub": "offline first" } ] }, { "name": "Edge and API", "nodes": [ { "id": "l-afd", "label": "Front Door + WAF", "kind": "integration", "sub": "Azure Front Door", "icon": "azure_frontdoor" }, { "id": "l-bff", "label": "Customer BFF", "kind": "integration", "sub": "Envoy Gateway", "icon": "envoy" }, { "id": "l-apim", "label": "Partner API", "kind": "integration", "sub": "API Management" }, { "id": "l-oidc", "label": "Identity", "kind": "security", "sub": "Keycloak" }, { "id": "l-rl", "label": "Quota and bot defence", "kind": "security", "sub": "Redis token bucket" } ] }, { "name": "Discovery domain", "nodes": [ { "id": "l-cat", "label": "Catalog", "kind": "app" }, { "id": "l-srch", "label": "Search", "kind": "app", "sub": "OpenSearch" }, { "id": "l-reco", "label": "Recommendation", "kind": "app" }, { "id": "l-prc", "label": "Pricing", "kind": "app" }, { "id": "l-promo", "label": "Promotions", "kind": "app" }, { "id": "l-rev", "label": "Reviews", "kind": "app" } ] }, { "name": "Commerce domain", "nodes": [ { "id": "l-cart", "label": "Cart", "kind": "app" }, { "id": "l-chk", "label": "Checkout", "kind": "app" }, { "id": "l-inv", "label": "Inventory", "kind": "app", "icon": "fa5_boxes" }, { "id": "l-ord", "label": "Order", "kind": "app", "icon": "fa5_receipt" }, { "id": "l-pay", "label": "Payments", "kind": "app", "sub": "PCI scoped" }, { "id": "l-bb", "label": "Buy Box", "kind": "app" } ] }, { "name": "Seller, supply and trust", "nodes": [ { "id": "l-slr", "label": "Seller", "kind": "app" }, { "id": "l-ff", "label": "Fulfilment", "kind": "app" }, { "id": "l-log", "label": "Logistics", "kind": "app" }, { "id": "l-ret", "label": "Returns", "kind": "app" }, { "id": "l-set", "label": "Settlement", "kind": "app" }, { "id": "l-trust", "label": "Trust and fraud", "kind": "security" } ] }, { "name": "Platform services", "nodes": [ { "id": "l-kafka", "label": "Event backbone", "kind": "queue", "sub": "Kafka", "icon": "kafka" }, { "id": "l-flink", "label": "Stream processing", "kind": "app", "sub": "Flink" }, { "id": "l-temp", "label": "Saga engine", "kind": "platform", "sub": "Temporal" }, { "id": "l-redis", "label": "Cache and locks", "kind": "store", "sub": "Redis" }, { "id": "l-feat", "label": "Feature store", "kind": "platform", "sub": "Feast" }, { "id": "l-not", "label": "Notification", "kind": "app", "icon": "fa5_bell" } ] }, { "name": "Data and cloud foundation", "nodes": [ { "id": "l-citus", "label": "Sharded OLTP", "kind": "store", "sub": "Citus PostgreSQL" }, { "id": "l-cos", "label": "Catalog store", "kind": "store", "sub": "Cosmos DB" }, { "id": "l-os", "label": "Search index", "kind": "store", "sub": "OpenSearch" }, { "id": "l-lake", "label": "Lakehouse", "kind": "store", "sub": "Iceberg on ADLS" }, { "id": "l-pinot", "label": "Real-time OLAP", "kind": "store", "sub": "Apache Pinot", "icon": "fa5_database" }, { "id": "l-aks", "label": "AKS + Istio", "kind": "platform", "sub": "Azure Kubernetes" } ] } ], "edges": [ { "from": "l-and", "to": "l-bff", "label": "HTTPS / JSON" }, { "from": "l-sell", "to": "l-apim", "label": "OAuth2 client" }, { "from": "l-bff", "to": "l-cat", "label": "gRPC" }, { "from": "l-bff", "to": "l-cart", "label": "gRPC" }, { "from": "l-chk", "to": "l-inv", "label": "reserve" }, { "from": "l-kafka", "to": "l-lake", "label": "raw topics", "kind": "async" }, { "from": "l-not", "to": "l-ord", "label": "sync read", "kind": "error" } ], "note": "Dependencies point down. The one red arrow is the exception the platform still carries: notification reads order state synchronously instead of consuming it.", "meta": { "v": "1.0", "owner": "Enterprise Architecture", "date": "2026-09" } }, { "id": "08-container-architecture", "title": "Container Architecture — Deployable Units and Their Stores", "layout": "nested", "canvas": { "width": 1760 }, "boxes": [ { "title": "Azure global edge", "kind": "cloud", "nodes": [ { "id": "k-afd", "label": "Front Door Premium", "kind": "integration", "sub": "WAF + TLS 1.3", "icon": "azure_frontdoor" }, { "id": "k-cdn", "label": "Static and media CDN", "kind": "integration", "sub": "Blob origin", "icon": "azure_cdn-profiles" }, { "id": "k-ddos", "label": "DDoS Protection", "kind": "security", "sub": "network tier" } ] }, { "title": "AKS — customer plane", "kind": "boundary", "dir": "row", "children": [ { "title": "Entry", "kind": "cloud", "nodes": [ { "id": "k-bff", "label": "Customer BFF", "kind": "app", "sub": "Go 1.23", "icon": "envoy" }, { "id": "k-kc", "label": "Keycloak", "kind": "security", "sub": "OIDC + refresh" }, { "id": "k-rl", "label": "Quota service", "kind": "security", "sub": "Redis buckets" } ] }, { "title": "Discovery", "kind": "cloud", "nodes": [ { "id": "k-cat", "label": "Catalog API", "kind": "app", "sub": "Java 21" }, { "id": "k-srch", "label": "Search API", "kind": "app", "sub": "Go 1.23" }, { "id": "k-reco", "label": "Reco API", "kind": "app", "sub": "KServe" }, { "id": "k-prc", "label": "Pricing and offers", "kind": "app", "sub": "Java 21" } ] }, { "title": "Commerce", "kind": "cloud", "nodes": [ { "id": "k-cart", "label": "Cart", "kind": "app", "sub": "Java 21" }, { "id": "k-chk", "label": "Checkout", "kind": "app", "sub": "Java 21" }, { "id": "k-inv", "label": "Inventory", "kind": "app", "sub": "Go 1.23", "icon": "fa5_boxes" }, { "id": "k-ord", "label": "Order", "kind": "app", "sub": "Java 21", "icon": "fa5_receipt" } ] } ] }, { "title": "AKS — PCI cardholder data environment (separate subscription)", "kind": "trust", "nodes": [ { "id": "k-payo", "label": "Payment orchestrator", "kind": "app", "sub": "Java 21" }, { "id": "k-vault", "label": "Token vault", "kind": "security", "sub": "HashiCorp Vault" }, { "id": "k-psp", "label": "PSP connectors", "kind": "integration", "sub": "UPI · card · wallet" }, { "id": "k-hook", "label": "Webhook receiver", "kind": "integration", "sub": "idempotent" } ] }, { "title": "AKS — seller, supply and trust plane", "kind": "boundary", "dir": "row", "children": [ { "title": "Seller", "kind": "cloud", "nodes": [ { "id": "k-slr", "label": "Seller service", "kind": "app" }, { "id": "k-ing", "label": "Catalog ingest", "kind": "app", "sub": "bulk feeds" }, { "id": "k-set", "label": "Settlement", "kind": "app", "sub": "double entry" } ] }, { "title": "Supply", "kind": "cloud", "nodes": [ { "id": "k-ff", "label": "Fulfilment engine", "kind": "app", "sub": "OR-Tools" }, { "id": "k-log", "label": "Logistics", "kind": "app" }, { "id": "k-ret", "label": "Returns", "kind": "app" } ] }, { "title": "Trust", "kind": "cloud", "nodes": [ { "id": "k-risk", "label": "Risk scoring", "kind": "security", "sub": "KServe" }, { "id": "k-mod", "label": "Content moderation", "kind": "security" }, { "id": "k-disp", "label": "Dispute workflow", "kind": "app", "sub": "Temporal" } ] } ] }, { "title": "Stateful platform on AKS", "kind": "boundary", "nodes": [ { "id": "k-kafka", "label": "Kafka", "kind": "queue", "sub": "Strimzi · 300 brokers" }, { "id": "k-flink", "label": "Flink", "kind": "app", "sub": "operator · 900 slots" }, { "id": "k-temp", "label": "Temporal", "kind": "platform", "sub": "sagas" }, { "id": "k-os", "label": "OpenSearch", "kind": "store", "sub": "150M docs" }, { "id": "k-pinot", "label": "Apache Pinot", "kind": "store", "sub": "seller analytics", "icon": "fa5_database" } ] }, { "title": "Azure managed data services", "kind": "cloud", "nodes": [ { "id": "k-citus", "label": "Cosmos DB for PostgreSQL", "kind": "store", "sub": "Citus · 64 shards" }, { "id": "k-cos", "label": "Cosmos DB NoSQL", "kind": "store", "sub": "catalog · multi-write", "icon": "azure_cosmosdb" }, { "id": "k-redis", "label": "Azure Managed Redis", "kind": "store", "sub": "cart · locks · price" }, { "id": "k-adls", "label": "ADLS Gen2", "kind": "store", "sub": "media + lakehouse", "icon": "azure_storage-accounts" }, { "id": "k-kv", "label": "Key Vault", "kind": "security", "sub": "HSM keys", "icon": "azure_key-vaults" } ] } ], "outside": [ { "id": "k-upi", "label": "UPI / NPCI", "kind": "external" }, { "id": "k-acq", "label": "Card acquirer", "kind": "external" }, { "id": "k-3pl", "label": "3PL carrier APIs", "kind": "external" }, { "id": "k-kyc", "label": "KYC provider", "kind": "external" }, { "id": "k-push", "label": "FCM / APNs / SMS", "kind": "external" } ], "edges": [ { "from": "k-afd", "to": "k-bff", "label": "HTTPS · Private Link" }, { "from": "k-bff", "to": "k-kc", "label": "OIDC introspect" }, { "from": "k-chk", "to": "k-inv", "label": "gRPC reserve" }, { "from": "k-chk", "to": "k-payo", "label": "mTLS · tokenised" }, { "from": "k-payo", "to": "k-upi", "label": "HTTPS" }, { "from": "k-ord", "to": "k-citus", "label": "SQL · shard key" }, { "from": "k-payo", "to": "k-vault", "label": "detokenise" } ], "note": "One AKS fleet, four node-pool tenancies. Only the cardholder plane is a separate subscription and a separate cluster; everything else is namespace and mesh policy isolation.", "meta": { "v": "1.0", "owner": "Platform Engineering", "date": "2026-09" } }, { "id": "09-integration-catalogue", "title": "Integration Architecture — Every Interface, Both Directions", "layout": "hub", "canvas": { "width": 1700 }, "left": { "title": "Inbound consumers", "nodes": [ { "id": "n-app", "label": "Customer apps", "kind": "app", "rel": "REST" }, { "id": "n-sell", "label": "Seller portal and app", "kind": "app", "rel": "REST" }, { "id": "n-bulk", "label": "Brand bulk feeds", "kind": "external", "rel": "bulk", "kind2": "batch" }, { "id": "n-ondc", "label": "ONDC buyer apps", "kind": "external", "rel": "Beckn" }, { "id": "n-aff", "label": "Affiliate and ads", "kind": "external", "rel": "REST" }, { "id": "n-care", "label": "Care and ops consoles", "kind": "app", "rel": "REST" } ] }, "centre": { "title": "Platform interfaces", "nodes": [ { "id": "n-apim", "label": "API Management", "kind": "integration", "sub": "OAuth2 · quotas" }, { "id": "n-bff", "label": "Customer BFF", "kind": "integration", "sub": "Envoy Gateway", "icon": "envoy" }, { "id": "n-bus", "label": "Event backbone", "kind": "queue", "sub": "38 topics · webhooks", "icon": "kafka" } ] }, "right": { "title": "Outbound dependencies", "nodes": [ { "id": "n-upi", "label": "Payment rails", "kind": "external", "sub": "UPI, cards, wallets", "rel": "REST", "dir": "out", "icon": "fa5_credit_card" }, { "id": "n-bank", "label": "Nodal bank", "kind": "external", "sub": "payouts", "rel": "NACH", "dir": "out", "kind2": "batch" }, { "id": "n-kyc", "label": "KYC and GST", "kind": "external", "rel": "REST", "dir": "out" }, { "id": "n-3pl", "label": "3PL carriers", "kind": "external", "rel": "scans", "dir": "out", "kind2": "async" } ] }, "note": "SMS, WhatsApp and push providers are omitted here and drawn on the notification path. We own every contract except NPCI, the acquirer webhooks and the NACH file format. Each third-party call sits behind a circuit breaker with a stated fallback.", "meta": { "v": "1.0", "owner": "Integration Architecture", "date": "2026-09" } }, { "id": "10-data-architecture-zones", "title": "Data Architecture — Ownership and Rebuildability", "layout": "nested", "canvas": { "width": 1740 }, "boxes": [ { "title": "Systems of record — strongly consistent, never rebuilt from anything else", "kind": "boundary", "nodes": [ { "id": "d-ord", "label": "Orders", "kind": "store", "sub": "Citus · shard by order" }, { "id": "d-pay", "label": "Payments and refunds", "kind": "store", "sub": "Citus · PCI scope" }, { "id": "d-inv", "label": "Inventory ledger", "kind": "store", "sub": "Citus · append only" }, { "id": "d-set", "label": "Settlement ledger", "kind": "store", "sub": "Citus · double entry" }, { "id": "d-idn", "label": "Identity and consent", "kind": "store", "sub": "PostgreSQL" } ] }, { "title": "Authored masters — eventually consistent, owned by a person or a feed", "kind": "boundary", "nodes": [ { "id": "d-cat", "label": "Catalog and listings", "kind": "store", "sub": "Cosmos DB NoSQL", "icon": "azure_cosmosdb" }, { "id": "d-prc", "label": "Prices and promotions", "kind": "store", "sub": "Cosmos DB + Redis" }, { "id": "d-slr", "label": "Seller profile and KYC", "kind": "store", "sub": "PostgreSQL + Blob" }, { "id": "d-med", "label": "Media and documents", "kind": "store", "sub": "ADLS Gen2", "icon": "azure_storage-accounts" } ] }, { "title": "Derived — rebuildable from the record or the log, so never backed up", "kind": "cloud", "nodes": [ { "id": "d-os", "label": "Search index", "kind": "store", "sub": "OpenSearch · 150M docs" }, { "id": "d-feat", "label": "Online features", "kind": "store", "sub": "Feast on Redis" }, { "id": "d-pinot", "label": "Seller analytics", "kind": "store", "sub": "Apache Pinot", "icon": "fa5_database" }, { "id": "d-cache", "label": "Read caches", "kind": "store", "sub": "Redis · PDP, cart" } ] }, { "title": "Analytical estate — the lakehouse", "kind": "cloud", "dir": "row", "children": [ { "title": "Bronze · raw", "kind": "boundary", "nodes": [ { "id": "d-brz", "label": "Raw topic landing", "kind": "store", "sub": "Iceberg · 30 d" } ] }, { "title": "Silver · conformed", "kind": "boundary", "nodes": [ { "id": "d-slv", "label": "Conformed entities", "kind": "store", "sub": "Iceberg · 3 y" } ] }, { "title": "Gold · marts", "kind": "boundary", "nodes": [ { "id": "d-gld", "label": "Business marts", "kind": "store", "sub": "GMV, funnel, supply" }, { "id": "d-ml", "label": "Training sets", "kind": "store", "sub": "point in time" } ] } ] } ], "outside": [ { "id": "d-arch", "label": "Regulatory archive", "kind": "store", "sub": "immutable · 8 y" } ], "edges": [ { "from": "d-ord", "to": "d-brz", "label": "CDC · Debezium", "kind": "async" }, { "from": "d-cat", "to": "d-os", "label": "index rebuild", "kind": "async" }, { "from": "d-slv", "to": "d-pinot", "label": "upsert stream", "kind": "async" }, { "from": "d-set", "to": "d-arch", "label": "WORM export", "kind": "batch" } ], "note": "The classification decides the backup bill: only the top two boxes are backed up and point-in-time restorable. Everything in the derived box is rebuilt from Kafka or the record within an hour.", "meta": { "v": "1.0", "owner": "Data Architecture", "date": "2026-09" } }, { "id": "11-data-flow", "title": "Data Flow — Source to Decision", "layout": "flow", "canvas": { "width": 1820 }, "chain": true, "align": "top", "nodeWidth": 210, "stages": [ { "title": "Sources", "nodes": [ { "id": "f-click", "label": "App clickstream", "kind": "app", "sub": "4B events/day" }, { "id": "f-dom", "label": "Domain events", "kind": "app", "sub": "38 topics" }, { "id": "f-cdc", "label": "OLTP change feed", "kind": "app", "sub": "Debezium" }, { "id": "f-part", "label": "Partner feeds", "kind": "external", "sub": "carriers, PSPs" } ] }, { "title": "Ingest", "nodes": [ { "id": "f-kafka", "label": "Kafka", "kind": "queue", "sub": "7 d hot, tiered" }, { "id": "f-sr", "label": "Schema registry", "kind": "platform", "sub": "Avro · compat gate", "icon": "fa5_file_contract" }, { "id": "f-dlq", "label": "Dead letter topics", "kind": "queue", "sub": "replayable" } ] }, { "title": "Process", "nodes": [ { "id": "f-flink", "label": "Flink streaming", "kind": "app", "sub": "exactly once" }, { "id": "f-spark", "label": "Spark batch", "kind": "app", "sub": "nightly restate" }, { "id": "f-dq", "label": "Quality gates", "kind": "security", "sub": "expectations" } ] }, { "title": "Store", "nodes": [ { "id": "f-ice", "label": "Iceberg lakehouse", "kind": "store", "sub": "bronze/silver/gold" }, { "id": "f-pinot", "label": "Pinot", "kind": "store", "sub": "sub-second OLAP", "icon": "fa5_database" }, { "id": "f-feat", "label": "Feature store", "kind": "store", "sub": "Feast online/offline" } ] }, { "title": "Serve", "nodes": [ { "id": "f-trino", "label": "Trino", "kind": "app", "sub": "ad hoc SQL" }, { "id": "f-bi", "label": "Superset", "kind": "app", "sub": "dashboards", "icon": "superset" }, { "id": "f-api", "label": "Metrics API", "kind": "integration", "sub": "seller and internal" }, { "id": "f-serve", "label": "Model serving", "kind": "platform", "sub": "KServe" } ] }, { "title": "Consume", "nodes": [ { "id": "f-slr", "label": "Sellers", "kind": "actor" }, { "id": "f-anl", "label": "Analysts", "kind": "actor" }, { "id": "f-ml", "label": "Ranking and fraud", "kind": "app" }, { "id": "f-reg", "label": "Finance and audit", "kind": "actor" } ] } ], "edges": [ { "from": "f-kafka", "to": "f-dlq", "label": "poison messages", "kind": "error" }, { "from": "f-flink", "to": "f-feat", "label": "online features", "kind": "async" }, { "from": "f-ice", "to": "f-ml", "label": "training sets", "kind": "batch", "route": "gutter" } ], "note": "One log, two speeds. Flink computes what has to be right within seconds; Spark restates the same tables nightly so a late or corrected event never leaves the marts wrong.", "meta": { "v": "1.0", "owner": "Data Architecture", "date": "2026-09" } }, { "id": "12-event-backbone", "title": "Event Backbone — Who Publishes, Who Reacts", "layout": "swimlane", "canvas": { "width": 1800 }, "laneHeaderWidth": 150, "stages": [ "Producer", "Topic", "Stream processing", "Consumers", "Materialised in" ], "lanes": [ { "title": "Commerce", "cells": [ [ { "id": "e-ord", "label": "Order service", "kind": "app" } ], [ { "id": "e-t1", "label": "orders.v2", "kind": "queue", "sub": "256 partitions" } ], [ { "id": "e-f1", "label": "Order state fan-out", "kind": "app", "sub": "Flink" } ], [ { "id": "e-c1", "label": "Fulfilment, notify, care", "kind": "app" } ], [ { "id": "e-m1", "label": "Order timeline", "kind": "store", "sub": "Pinot", "icon": "fa5_database" } ] ] }, { "title": "Inventory", "cells": [ [ { "id": "e-inv", "label": "Inventory service", "kind": "app" } ], [ { "id": "e-t2", "label": "inventory.delta", "kind": "queue", "sub": "compacted" } ], [ { "id": "e-f2", "label": "Availability rollup", "kind": "app", "sub": "Flink" } ], [ { "id": "e-c2", "label": "Search, PDP, Buy Box", "kind": "app" } ], [ { "id": "e-m2", "label": "Availability cache", "kind": "store", "sub": "Redis" } ] ] }, { "title": "Payments", "cells": [ [ { "id": "e-pay", "label": "Payment orchestrator", "kind": "app" } ], [ { "id": "e-t3", "label": "payments.v1", "kind": "queue", "sub": "PII redacted" } ], [ { "id": "e-f3", "label": "Settlement accrual", "kind": "app", "sub": "Flink" } ], [ { "id": "e-c3", "label": "Order, settlement, risk", "kind": "app" } ], [ { "id": "e-m3", "label": "Ledger entries", "kind": "store", "sub": "Citus" } ] ] }, { "title": "Catalog", "cells": [ [ { "id": "e-cat", "label": "Catalog and pricing", "kind": "app" } ], [ { "id": "e-t4", "label": "catalog.changes", "kind": "queue", "sub": "log compacted" } ], [ { "id": "e-f4", "label": "Enrich and embed", "kind": "app", "sub": "Flink + AOAI" } ], [ { "id": "e-c4", "label": "Search indexer", "kind": "app" } ], [ { "id": "e-m4", "label": "Search index", "kind": "store", "sub": "OpenSearch" } ] ] }, { "title": "Behaviour", "cells": [ [ { "id": "e-app", "label": "Apps and web", "kind": "app", "icon": "net_mobile" } ], [ { "id": "e-t5", "label": "clickstream.raw", "kind": "queue", "sub": "4B/day" } ], [ { "id": "e-f5", "label": "Sessionise", "kind": "app", "sub": "Flink" } ], [ { "id": "e-c5", "label": "Reco, ads, growth", "kind": "app" } ], [ { "id": "e-m5", "label": "Feature store", "kind": "store", "sub": "Feast" } ] ] }, { "title": "Trust", "cells": [ [ { "id": "e-all", "label": "Every domain", "kind": "app" } ], [ { "id": "e-t6", "label": "risk.signals", "kind": "queue" } ], [ { "id": "e-f6", "label": "Rules + model score", "kind": "app", "sub": "Flink + KServe" } ], [ { "id": "e-c6", "label": "Case queue, blocks", "kind": "security" } ], [ { "id": "e-m6", "label": "Risk decisions", "kind": "store", "sub": "Citus" } ] ] } ], "note": "Every topic carries a versioned Avro schema and an idempotency key. Compacted topics hold current state; append-only topics hold history and are the replay source for every derived store.", "meta": { "v": "1.0", "owner": "Platform Engineering", "date": "2026-09" } }, { "id": "13-core-data-model", "title": "Core Data Model — Marketplace Entities", "layout": "er", "canvas": { "width": 1680, "cols": 4 }, "rowGap": 250, "entities": [ { "id": "cust", "name": "customer", "kind": "store", "row": 0, "col": 0, "attrs": [ "customer_id PK", "phone_hash UQ", "tier", "created_at" ] }, { "id": "addr", "name": "address", "kind": "store", "row": 0, "col": 1, "attrs": [ "address_id PK", "customer_id FK", "pincode", "geo_cell" ] }, { "id": "prod", "name": "product", "kind": "store", "row": 0, "col": 2, "attrs": [ "product_id PK", "brand", "category_path", "attributes JSONB" ] }, { "id": "slr", "name": "seller", "kind": "store", "row": 0, "col": 3, "attrs": [ "seller_id PK", "gstin UQ", "kyc_state", "risk_band" ] }, { "id": "ord", "name": "order", "kind": "store", "row": 1, "col": 0, "attrs": [ "order_id PK", "customer_id FK", "state", "placed_at", "shard_key" ] }, { "id": "line", "name": "order_line", "kind": "store", "row": 1, "col": 1, "attrs": [ "line_id PK", "order_id FK", "listing_id FK", "qty", "unit_price" ] }, { "id": "lst", "name": "listing", "kind": "store", "row": 1, "col": 2, "attrs": [ "listing_id PK", "product_id FK", "seller_id FK", "price", "buy_box_score" ] }, { "id": "ivl", "name": "inventory_ledger", "kind": "store", "row": 1, "col": 3, "attrs": [ "entry_id PK", "listing_id FK", "node_id", "delta", "reason" ] }, { "id": "pay", "name": "payment", "kind": "store", "row": 2, "col": 0, "attrs": [ "payment_id PK", "order_id FK", "instrument", "psp_ref UQ", "state" ] }, { "id": "ref", "name": "refund", "kind": "store", "row": 2, "col": 1, "attrs": [ "refund_id PK", "payment_id FK", "reason_code", "amount" ] }, { "id": "stl", "name": "settlement_entry", "kind": "store", "row": 2, "col": 2, "attrs": [ "entry_id PK", "line_id FK", "type DR/CR", "amount", "cycle" ] }, { "id": "shp", "name": "shipment", "kind": "store", "row": 2, "col": 3, "attrs": [ "shipment_id PK", "entry_id FK", "carrier", "tracking_ref", "state" ] } ], "relations": [ { "from": "cust", "to": "addr", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "cust", "to": "ord", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "ord", "to": "line", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "lst", "to": "line", "label": "1 : N", "from_side": "w", "to_side": "e" }, { "from": "prod", "to": "lst", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "slr", "to": "ivl", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "lst", "to": "ivl", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "ord", "to": "pay", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "pay", "to": "ref", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "line", "to": "stl", "label": "1 : N", "from_side": "s3", "to_side": "n" }, { "from": "ivl", "to": "shp", "label": "1 : N", "from_side": "s", "to_side": "n" } ], "note": "listing is the join that makes this a marketplace: the same product carries many seller listings, and every commercial fact hangs off the listing, not the product.", "meta": { "v": "1.0", "owner": "Data Architecture", "date": "2026-09" } }, { "id": "14-checkout-and-payment-sequence", "title": "Critical Flow — Reserve, Pay, Confirm", "layout": "sequence", "canvas": { "width": 1720 }, "lifelines": [ { "id": "s-usr", "label": "Shopper", "kind": "actor" }, { "id": "s-bff", "label": "Customer BFF", "kind": "integration", "icon": "envoy" }, { "id": "s-chk", "label": "Checkout", "kind": "app" }, { "id": "s-inv", "label": "Inventory", "kind": "app", "icon": "fa5_boxes" }, { "id": "s-pay", "label": "Payment orch", "kind": "app" }, { "id": "s-psp", "label": "UPI / PSP", "kind": "external" }, { "id": "s-ord", "label": "Order", "kind": "app", "icon": "fa5_receipt" }, { "id": "s-bus", "label": "Kafka", "kind": "queue" } ], "messages": [ { "from": "s-usr", "to": "s-bff", "label": "POST /checkout", "kind": "call" }, { "from": "s-bff", "to": "s-chk", "label": "create intent + idem key", "kind": "call" }, { "from": "s-chk", "to": "s-inv", "label": "reserve(listing, qty, ttl 900s)", "kind": "call" }, { "from": "s-inv", "to": "s-inv", "label": "Lua CAS on Redis counter", "kind": "self" }, { "from": "s-inv", "to": "s-chk", "label": "reservation_id", "kind": "return" }, { "from": "s-chk", "to": "s-pay", "label": "authorise(amount, idem key)", "kind": "call" }, { "from": "s-pay", "to": "s-psp", "label": "collect request", "kind": "call" }, { "from": "s-psp", "to": "s-usr", "label": "approve in bank app", "kind": "call" }, { "from": "s-psp", "to": "s-pay", "label": "webhook: authorised", "kind": "async" }, { "from": "s-pay", "to": "s-pay", "label": "dedupe on psp_ref", "kind": "self" }, { "from": "s-pay", "to": "s-ord", "label": "create order (Temporal saga)", "kind": "call" }, { "from": "s-ord", "to": "s-inv", "label": "confirm(reservation_id)", "kind": "call" }, { "from": "s-ord", "to": "s-bus", "label": "OrderCreated", "kind": "async" }, { "from": "s-ord", "to": "s-bff", "label": "order_id, ETA", "kind": "return" }, { "from": "s-bff", "to": "s-usr", "label": "confirmation screen", "kind": "return" }, { "from": "s-psp", "to": "s-pay", "label": "no webhook in 90 s", "kind": "error" }, { "from": "s-pay", "to": "s-psp", "label": "status poll, then void", "kind": "call" }, { "from": "s-pay", "to": "s-inv", "label": "release(reservation_id)", "kind": "error" } ], "note": "Stock is reserved before money is asked for, and the reservation expires on its own. Every step carries the same idempotency key, so a retried webhook cannot create a second order or a second debit.", "meta": { "v": "1.0", "owner": "Commerce Engineering", "date": "2026-09" } }, { "id": "15-inventory-reservation-lifecycle", "title": "Inventory — The Reservation Loop That Prevents Overselling", "layout": "cycle", "canvas": { "width": 1500 }, "centre": { "label": "One SKU at one node" }, "nodes": [ { "id": "i-av", "label": "Available", "kind": "store", "sub": "Redis counter" }, { "id": "i-rs", "label": "Reserved", "kind": "app", "sub": "TTL 900 s", "icon": "fa5_lock" }, { "id": "i-cf", "label": "Confirmed", "kind": "app", "sub": "ledger row written" }, { "id": "i-al", "label": "Allocated", "kind": "app", "sub": "node and wave" }, { "id": "i-fl", "label": "Fulfilled", "kind": "opportunity", "sub": "handover scan" }, { "id": "i-rc", "label": "Reconciled", "kind": "platform", "sub": "count vs ledger" } ], "ringLabels": [ "reserve · Lua CAS", "payment authorised", "fulfilment engine picks node", "picked and packed", "delivered, RTO or return", "drift correction, hourly" ], "note": "Expiry and cancellation return units to Available on the same path as reconciliation, so there is exactly one way stock comes back.", "meta": { "v": "1.0", "owner": "Commerce Engineering", "date": "2026-09" } }, { "id": "16-order-lifecycle-and-failure-paths", "title": "Order Lifecycle — States and Every Way Out", "layout": "flow", "canvas": { "width": 1820 }, "chain": true, "align": "top", "nodeWidth": 200, "stages": [ { "title": "Capture", "nodes": [ { "id": "o-cr", "label": "CREATED", "kind": "app" }, { "id": "o-pp", "label": "PAYMENT_PENDING", "kind": "decision" } ] }, { "title": "Authorise", "nodes": [ { "id": "o-au", "label": "AUTHORISED", "kind": "app" }, { "id": "o-pf", "label": "PAYMENT_FAILED", "kind": "risk" } ] }, { "title": "Commit", "nodes": [ { "id": "o-cn", "label": "CONFIRMED", "kind": "app", "sub": "stock committed" }, { "id": "o-cx", "label": "CANCELLED", "kind": "risk", "sub": "by buyer" } ] }, { "title": "Prepare", "nodes": [ { "id": "o-pk", "label": "PACKED", "kind": "app" }, { "id": "o-sc", "label": "SELLER_CANCELLED", "kind": "risk", "sub": "SLA penalty" } ] }, { "title": "Move", "nodes": [ { "id": "o-sh", "label": "SHIPPED", "kind": "app" }, { "id": "o-od", "label": "OUT_FOR_DELIVERY", "kind": "app" }, { "id": "o-rto", "label": "RTO", "kind": "risk", "sub": "undeliverable" } ] }, { "title": "Close", "nodes": [ { "id": "o-dl", "label": "DELIVERED", "kind": "opportunity" }, { "id": "o-rr", "label": "RETURN_REQUESTED", "kind": "decision" }, { "id": "o-rf", "label": "REFUNDED", "kind": "app" } ] } ], "edges": [ { "from": "o-pp", "to": "o-pf", "label": "declined or timeout", "kind": "error" }, { "from": "o-au", "to": "o-cx", "label": "buyer cancels", "kind": "error" }, { "from": "o-cn", "to": "o-sc", "label": "no stock at pick", "kind": "error" }, { "from": "o-od", "to": "o-rto", "label": "3 attempts", "kind": "error" }, { "from": "o-dl", "to": "o-rr", "label": "within window" }, { "from": "o-rr", "to": "o-rf", "label": "graded and accepted" }, { "from": "o-rto", "to": "o-rf", "label": "auto refund", "kind": "error" } ], "note": "The Order service owns this machine and nothing else writes to it. Every red transition emits a compensating event; refunds and inventory releases are Temporal sagas, not in-line calls.", "meta": { "v": "1.0", "owner": "Commerce Engineering", "date": "2026-09" } }, { "id": "17-search-and-recommendation-pipeline", "title": "Discovery Pipeline — Index, Retrieve, Rank, Learn", "layout": "flow", "canvas": { "width": 1820 }, "chain": true, "align": "top", "nodeWidth": 205, "stages": [ { "title": "Change capture", "nodes": [ { "id": "p-cat", "label": "Catalog changes", "kind": "queue", "sub": "compacted topic" }, { "id": "p-prc", "label": "Price and offer", "kind": "queue" }, { "id": "p-av", "label": "Availability delta", "kind": "queue" } ] }, { "title": "Enrich", "nodes": [ { "id": "p-norm", "label": "Attribute normalise", "kind": "app", "sub": "Flink" }, { "id": "p-emb", "label": "Embed title and image", "kind": "app", "sub": "Azure OpenAI" }, { "id": "p-qual", "label": "Listing quality score", "kind": "app" } ] }, { "title": "Index", "nodes": [ { "id": "p-bulk", "label": "Bulk indexer", "kind": "app", "sub": "p95 lag 30 s" }, { "id": "p-idx", "label": "Lexical + kNN index", "kind": "store", "sub": "OpenSearch" }, { "id": "p-alias", "label": "Alias swap", "kind": "platform", "sub": "zero downtime" } ] }, { "title": "Serve", "nodes": [ { "id": "p-qu", "label": "Query understanding", "kind": "app", "sub": "spell, intent" }, { "id": "p-ret", "label": "Retrieve", "kind": "app", "sub": "BM25 + vector", "icon": "opensearch" }, { "id": "p-rank", "label": "Rank", "kind": "platform", "sub": "KServe · 40 ms" }, { "id": "p-bb", "label": "Buy Box choose", "kind": "app", "sub": "price, SLA, rating" } ] }, { "title": "Learn", "nodes": [ { "id": "p-clk", "label": "Clicks and buys", "kind": "queue" }, { "id": "p-feat", "label": "Feature store", "kind": "store", "sub": "Feast" }, { "id": "p-train", "label": "Train and register", "kind": "platform", "sub": "MLflow" }, { "id": "p-can", "label": "Canary and rollback", "kind": "decision", "sub": "1% traffic" } ] } ], "edges": [ { "from": "p-can", "to": "p-rank", "label": "promote model", "kind": "batch", "route": "gutter" }, { "from": "p-idx", "to": "p-ret", "label": "search", "kind": "sync" } ], "note": "Search never reads the catalog database. If the pipeline stops, the index serves stale-but-correct results and the availability filter is applied at query time from Redis.", "meta": { "v": "1.0", "owner": "Discovery Engineering", "date": "2026-09" } }, { "id": "18-fulfilment-and-last-mile", "title": "Fulfilment — Three Supply Models, One Promise", "layout": "swimlane", "canvas": { "width": 1800 }, "laneHeaderWidth": 165, "stages": [ "Allocate", "Pick and pack", "First mile", "Line haul", "Last mile", "Proof" ], "lanes": [ { "title": "Platform fulfilled", "cells": [ [ { "id": "u-a1", "label": "Node selection", "kind": "app", "sub": "OR-Tools" } ], [ { "id": "u-b1", "label": "Wave and pick", "kind": "app", "sub": "WMS" } ], [ { "id": "u-c1", "label": "Sortation", "kind": "app" } ], [ { "id": "u-d1", "label": "Own line haul", "kind": "app" } ], [ { "id": "u-e1", "label": "Delivery hub", "kind": "app", "sub": "route plan" } ], [ { "id": "u-f1", "label": "OTP or QR", "kind": "security" } ] ] }, { "title": "Seller fulfilled", "cells": [ [ { "id": "u-a2", "label": "Seller node", "kind": "app", "sub": "pincode serviceability" } ], [ { "id": "u-b2", "label": "Label and manifest", "kind": "integration" } ], [ { "id": "u-c2", "label": "Carrier pickup", "kind": "external" } ], [ { "id": "u-d2", "label": "Carrier network", "kind": "external", "sub": "8 partners" } ], [ { "id": "u-e2", "label": "Carrier last mile", "kind": "external" } ], [ { "id": "u-f2", "label": "Scan webhook", "kind": "integration", "sub": "signed" } ] ] }, { "title": "Reverse", "cells": [ [ { "id": "u-a3", "label": "Return authorised", "kind": "app", "sub": "abuse score" } ], [ { "id": "u-b3", "label": "Reverse pickup slot", "kind": "app" } ], [ { "id": "u-c3", "label": "Rider collects", "kind": "app" } ], [ { "id": "u-d3", "label": "Return centre", "kind": "app" } ], [ { "id": "u-e3", "label": "Grade and restock", "kind": "decision" } ], [ { "id": "u-f3", "label": "Refund trigger", "kind": "app", "sub": "saga" } ] ] }, { "title": "Promise and money", "cells": [ [ { "id": "u-a4", "label": "Delivery promise", "kind": "platform", "sub": "ML ETA" } ], [ { "id": "u-b4", "label": "SLA clock starts", "kind": "platform" } ], [ { "id": "u-c4", "label": "Breach alerting", "kind": "security" } ], [ { "id": "u-d4", "label": "Track and trace", "kind": "app" } ], [ { "id": "u-e4", "label": "COD collection", "kind": "app", "sub": "cash or UPI" } ], [ { "id": "u-f4", "label": "Remittance match", "kind": "app", "sub": "T+2", "icon": "fa5_coins" } ] ] } ], "note": "The promise shown at checkout is computed from the same node-selection model that later allocates the order, so the ETA a shopper sees and the ETA operations plans against are one number.", "meta": { "v": "1.0", "owner": "Supply Chain Engineering", "date": "2026-09" } }, { "id": "19-deployment-topology", "title": "Deployment — Regions, Zones and Failure Domains", "layout": "nested", "canvas": { "width": 1760 }, "boxes": [ { "title": "Global · Azure Front Door Premium (anycast, 190+ PoPs)", "kind": "cloud", "nodes": [ { "id": "g-afd", "label": "Front Door + WAF", "kind": "integration", "sub": "latency routing", "icon": "azure_frontdoor" }, { "id": "g-dns", "label": "Azure DNS", "kind": "integration", "sub": "health probes" }, { "id": "g-cdn", "label": "CDN cache", "kind": "integration", "sub": "media, static", "icon": "azure_cdn-profiles" } ] }, { "title": "Azure Central India · primary, active", "kind": "cloud", "dir": "row", "children": [ { "title": "Zone 1", "kind": "boundary", "nodes": [ { "id": "r-a1", "label": "AKS system + app", "kind": "platform", "sub": "800 nodes", "icon": "azure_kubernetes-services" }, { "id": "r-a2", "label": "Citus coordinators", "kind": "store", "sub": "writer" }, { "id": "r-a3", "label": "Kafka brokers", "kind": "queue", "sub": "100 of 300" } ] }, { "title": "Zone 2", "kind": "boundary", "nodes": [ { "id": "r-b1", "label": "AKS app + spot", "kind": "platform", "sub": "800 nodes", "icon": "azure_kubernetes-services" }, { "id": "r-b2", "label": "Citus workers", "kind": "store", "sub": "sync replica" }, { "id": "r-b3", "label": "Kafka brokers", "kind": "queue", "sub": "100 of 300" } ] }, { "title": "Zone 3", "kind": "boundary", "nodes": [ { "id": "r-c1", "label": "AKS app + GPU", "kind": "platform", "sub": "ranking, embed", "icon": "azure_kubernetes-services" }, { "id": "r-c2", "label": "OpenSearch data", "kind": "store", "sub": "3 replicas" }, { "id": "r-c3", "label": "Kafka brokers", "kind": "queue", "sub": "100 of 300" } ] } ] }, { "title": "Azure South India · secondary, read-active and failover", "kind": "cloud", "dir": "row", "children": [ { "title": "Zone 1", "kind": "boundary", "nodes": [ { "id": "r-d1", "label": "AKS read plane", "kind": "platform", "sub": "30% capacity", "icon": "azure_kubernetes-services" }, { "id": "r-d2", "label": "Citus read replica", "kind": "store", "sub": "async" } ] }, { "title": "Zone 2", "kind": "boundary", "nodes": [ { "id": "r-e1", "label": "OpenSearch replica", "kind": "store", "sub": "full index" }, { "id": "r-e2", "label": "Kafka mirror", "kind": "queue", "sub": "MirrorMaker 2" } ] } ] }, { "title": "Multi-region managed services", "kind": "cloud", "nodes": [ { "id": "r-cos", "label": "Cosmos DB NoSQL", "kind": "store", "sub": "multi-region write", "icon": "azure_cosmosdb" }, { "id": "r-blob", "label": "ADLS / Blob", "kind": "store", "sub": "GZRS", "icon": "azure_storage-accounts" }, { "id": "r-kv", "label": "Key Vault", "kind": "security", "sub": "paired region", "icon": "azure_key-vaults" } ] } ], "edges": [ { "from": "r-a2", "to": "r-b2", "label": "sync · RPO 0" }, { "from": "r-a2", "to": "r-d2", "label": "async 30 s", "kind": "async" }, { "from": "g-afd", "to": "r-a1", "label": "primary origin" }, { "from": "g-afd", "to": "r-d1", "label": "read spill", "kind": "async" } ], "note": "RTO 20 min, RPO 30 s for the transactional tier; catalog and media are RPO 0 by construction. Regional failover is a rehearsed runbook with a human decision, not an automatic flip.", "meta": { "v": "1.0", "owner": "Platform Engineering", "date": "2026-09" } }, { "id": "20-cicd-and-environments", "title": "Delivery Pipeline — What Stops a Bad Change", "layout": "flow", "canvas": { "width": 1820 }, "chain": true, "align": "top", "nodeWidth": 200, "stages": [ { "title": "Source", "nodes": [ { "id": "c-git", "label": "GitHub", "kind": "app", "sub": "trunk + PR" }, { "id": "c-rev", "label": "Review + CODEOWNERS", "kind": "decision" }, { "id": "c-tf", "label": "Terraform modules", "kind": "platform", "sub": "infra as code" } ] }, { "title": "Build", "nodes": [ { "id": "c-ci", "label": "GitHub Actions", "kind": "platform", "sub": "hermetic build" }, { "id": "c-sbom", "label": "SBOM + sign", "kind": "security", "sub": "Syft · Cosign" }, { "id": "c-acr", "label": "Container Registry", "kind": "store", "sub": "Azure ACR" } ] }, { "title": "Verify", "nodes": [ { "id": "c-unit", "label": "Unit + contract", "kind": "app", "sub": "Pact" }, { "id": "c-sast", "label": "SAST + secrets", "kind": "security", "sub": "SonarQube" }, { "id": "c-scan", "label": "Image + CVE scan", "kind": "security", "sub": "Trivy", "icon": "fa5_search" }, { "id": "c-pol", "label": "Policy gate", "kind": "decision", "sub": "Kyverno", "icon": "fa5_gavel" } ] }, { "title": "Environments", "nodes": [ { "id": "c-dev", "label": "dev", "kind": "app", "sub": "ephemeral" }, { "id": "c-stg", "label": "staging", "kind": "app", "sub": "prod-shaped data" }, { "id": "c-perf", "label": "perf and game day", "kind": "app", "sub": "10x replay" } ] }, { "title": "Release", "nodes": [ { "id": "c-argo", "label": "Argo CD", "kind": "platform", "sub": "GitOps sync", "icon": "argocd" }, { "id": "c-roll", "label": "Argo Rollouts", "kind": "platform", "sub": "canary 1-5-25%" }, { "id": "c-slo", "label": "SLO gate", "kind": "decision", "sub": "auto rollback" }, { "id": "c-frz", "label": "Sale freeze window", "kind": "security", "sub": "code freeze" } ] }, { "title": "Production", "nodes": [ { "id": "c-prd", "label": "AKS · 2 regions", "kind": "platform", "icon": "azure_kubernetes-services" }, { "id": "c-flag", "label": "Feature flags", "kind": "platform", "sub": "kill switches" }, { "id": "c-aud", "label": "Change audit", "kind": "security", "sub": "who, what, when" } ] } ], "edges": [ { "from": "c-slo", "to": "c-argo", "label": "burn rate breach: roll back", "kind": "error", "route": "gutter" } ], "note": "Nothing reaches production except by a signed image referenced from a Git commit. During a sale window the freeze is enforced by policy, and only flag flips and rollbacks are allowed.", "meta": { "v": "1.0", "owner": "Platform Engineering", "date": "2026-09" } }, { "id": "21-observability", "title": "Observability — Signal to Action", "layout": "grid", "canvas": { "width": 1780 }, "columns": [ "Emit", "Collect", "Store", "Consume", "Act" ], "rows": [ { "title": "Metrics", "cells": [ [ { "id": "m1", "label": "OpenTelemetry SDK", "kind": "app", "icon": "opentelemetry" } ], [ { "id": "m2", "label": "OTel Collector", "kind": "integration", "sub": "per node", "icon": "opentelemetry" } ], [ { "id": "m3", "label": "Prometheus + Thanos", "kind": "store", "sub": "13 mo" } ], [ { "id": "m4", "label": "Grafana SLO boards", "kind": "platform" } ], [ { "id": "m5", "label": "Page on burn rate", "kind": "security", "sub": "multi-window" } ] ] }, { "title": "Logs", "cells": [ [ { "id": "g1", "label": "Structured JSON", "kind": "app", "sub": "trace id bound" } ], [ { "id": "g2", "label": "Fluent Bit", "kind": "integration" } ], [ { "id": "g3", "label": "Loki", "kind": "store", "sub": "30 d hot" } ], [ { "id": "g4", "label": "Incident search", "kind": "platform" } ], [ { "id": "g5", "label": "Runbook link", "kind": "security" } ] ] }, { "title": "Traces", "cells": [ [ { "id": "t1", "label": "OTel auto-instr", "kind": "app", "sub": "1% + tail sample", "icon": "opentelemetry" } ], [ { "id": "t2", "label": "OTel Collector", "kind": "integration", "icon": "opentelemetry" } ], [ { "id": "t3", "label": "Tempo", "kind": "store", "sub": "7 d" } ], [ { "id": "t4", "label": "Checkout latency", "kind": "platform" } ], [ { "id": "t5", "label": "Blame the hop", "kind": "security", "sub": "service map", "icon": "jaeger" } ] ] }, { "title": "Business", "cells": [ [ { "id": "u1", "label": "Order and pay events", "kind": "queue" } ], [ { "id": "u2", "label": "Flink aggregates", "kind": "app", "sub": "10 s window" } ], [ { "id": "u3", "label": "Pinot", "kind": "store", "sub": "GMV, conversion", "icon": "fa5_database" } ], [ { "id": "u4", "label": "War room board", "kind": "platform", "sub": "sale day" } ], [ { "id": "u5", "label": "Page on conversion", "kind": "security", "sub": "drop vs baseline" } ] ] }, { "title": "Pipeline health", "cells": [ [ { "id": "k1", "label": "Consumer lag", "kind": "queue" } ], [ { "id": "k2", "label": "Kafka exporter", "kind": "integration" } ], [ { "id": "k3", "label": "Prometheus", "kind": "store" } ], [ { "id": "k4", "label": "Lag and DLQ board", "kind": "platform" } ], [ { "id": "k5", "label": "Auto scale consumers", "kind": "platform", "sub": "KEDA" } ] ] }, { "title": "Cost", "cells": [ [ { "id": "x1", "label": "Namespace tags", "kind": "app" } ], [ { "id": "x2", "label": "OpenCost", "kind": "integration", "sub": "per service", "icon": "kubernetes" } ], [ { "id": "x3", "label": "Cost mart", "kind": "store", "sub": "Iceberg" } ], [ { "id": "x4", "label": "Unit cost per order", "kind": "platform" } ], [] ] } ], "note": "The empty cell is deliberate: cost has no automated action, it has a monthly review. Business signal is treated as a first-class alerting source because conversion drops before CPU does.", "meta": { "v": "1.0", "owner": "SRE", "date": "2026-09" } }, { "id": "22-peak-load-and-degradation", "title": "Peak Load — What Must Work and What May Break", "layout": "grid", "canvas": { "width": 1720 }, "columns": [ "Normal day", "3x traffic", "10x sale hour", "Brownout" ], "rows": [ { "title": "Search", "cells": [ [ { "id": "q1", "label": "Full ranking", "kind": "app", "sub": "p95 280 ms" } ], [ { "id": "q2", "label": "Scale replicas", "kind": "app" } ], [ { "id": "q3", "label": "Cached top queries", "kind": "store" } ], [ { "id": "q4", "label": "Lexical only", "kind": "decision", "sub": "no vector" } ] ] }, { "title": "Product page", "cells": [ [ { "id": "w1", "label": "Live price and stock", "kind": "app" } ], [ { "id": "w2", "label": "Edge cache 30 s", "kind": "integration" } ], [ { "id": "w3", "label": "Edge cache 120 s", "kind": "integration" } ], [ { "id": "w4", "label": "Static shell + stock call", "kind": "decision" } ] ] }, { "title": "Cart and checkout", "cells": [ [ { "id": "y1", "label": "Full flow", "kind": "app", "sub": "p95 500 ms" } ], [ { "id": "y2", "label": "Dedicated node pool", "kind": "platform" } ], [ { "id": "y3", "label": "Virtual waiting room", "kind": "security", "sub": "fair queue" } ], [ { "id": "y4", "label": "Protected — never shed", "kind": "opportunity" } ] ] }, { "title": "Payments", "cells": [ [ { "id": "z1", "label": "All instruments", "kind": "app" } ], [ { "id": "z2", "label": "PSP health routing", "kind": "integration" } ], [ { "id": "z3", "label": "Drop slow PSPs", "kind": "decision" } ], [ { "id": "z4", "label": "Protected — never shed", "kind": "opportunity" } ] ] }, { "title": "Recommendations", "cells": [ [ { "id": "v1", "label": "Personalised", "kind": "app" } ], [ { "id": "v2", "label": "Shorter candidate set", "kind": "app" } ], [ { "id": "v3", "label": "Precomputed segments", "kind": "store" } ], [ { "id": "v4", "label": "Off", "kind": "risk" } ] ] }, { "title": "Reviews and Q&A", "cells": [ [ { "id": "s1", "label": "Live counts", "kind": "app" } ], [ { "id": "s2", "label": "Cached counts", "kind": "store" } ], [ { "id": "s3", "label": "Read only", "kind": "decision" } ], [ { "id": "s4", "label": "Off", "kind": "risk" } ] ] }, { "title": "Seller analytics", "cells": [ [ { "id": "n1", "label": "Near real time", "kind": "app", "sub": "60 s" } ], [ { "id": "n2", "label": "5 min refresh", "kind": "app" } ], [ { "id": "n3", "label": "Hourly refresh", "kind": "decision" } ], [ { "id": "n4", "label": "Yesterday only", "kind": "risk" } ] ] }, { "title": "Notifications", "cells": [ [ { "id": "b1", "label": "All classes", "kind": "app" } ], [ { "id": "b2", "label": "Priority queue", "kind": "queue" } ], [ { "id": "b3", "label": "Transactional only", "kind": "decision" } ], [ { "id": "b4", "label": "Order and payment only", "kind": "risk" } ] ] } ], "note": "This table is the load-shedding contract, and it is enforced by feature flags rather than by judgement at 02:00. Yellow is a deliberate downgrade; red is switched off.", "meta": { "v": "1.0", "owner": "SRE + Product", "date": "2026-09" } }, { "id": "23-security-zones", "title": "Security Architecture — Trust Zones and What Crosses Them", "layout": "zones", "canvas": { "width": 1720 }, "zones": [ { "title": "Untrusted · internet", "kind": "trust", "nodes": [ { "id": "v-usr", "label": "Shopper and seller", "kind": "actor" }, { "id": "v-bot", "label": "Bots and account takeover", "kind": "risk", "sub": "scraping · stuffing" } ] }, { "title": "Perimeter · Azure edge", "kind": "trust", "nodes": [ { "id": "v-waf", "label": "Front Door WAF", "kind": "security", "sub": "OWASP + custom", "icon": "azure_frontdoor" }, { "id": "v-ddos", "label": "DDoS Protection", "kind": "security", "sub": "network tier" }, { "id": "v-bd", "label": "Bot defence", "kind": "security", "sub": "device + behaviour" }, { "id": "v-rl", "label": "Quota and throttle", "kind": "security", "sub": "per token, per IP" } ] }, { "title": "Application · private VNet, no public IP", "kind": "trust", "nodes": [ { "id": "v-gw", "label": "Envoy Gateway", "kind": "integration", "sub": "OIDC verify" }, { "id": "v-kc", "label": "Keycloak", "kind": "security", "sub": "MFA on risk" }, { "id": "v-svc", "label": "Domain services", "kind": "app", "sub": "Istio mTLS" }, { "id": "v-opa", "label": "Authorisation", "kind": "security", "sub": "OPA policy", "icon": "fa5_user_shield" } ] }, { "title": "Cardholder data environment · separate subscription", "kind": "trust", "nodes": [ { "id": "v-pay", "label": "Payment orchestrator", "kind": "app", "sub": "PCI DSS scope" }, { "id": "v-tok", "label": "Token vault", "kind": "security", "sub": "no PAN leaves" }, { "id": "v-hsm", "label": "Managed HSM", "kind": "security", "sub": "keys never exported" } ] }, { "title": "Data · restricted, private endpoints only", "kind": "trust", "nodes": [ { "id": "v-db", "label": "Citus and Cosmos DB", "kind": "store", "sub": "CMK at rest" }, { "id": "v-pii", "label": "PII tokenisation", "kind": "security", "sub": "phone, address" }, { "id": "v-aud", "label": "Audit log", "kind": "security", "sub": "WORM · 8 y" } ] } ], "edges": [ { "from": "v-usr", "to": "v-waf", "label": "HTTPS 443" }, { "from": "v-bot", "to": "v-bd", "label": "challenged", "kind": "error" }, { "from": "v-waf", "to": "v-gw", "label": "TLS" }, { "from": "v-gw", "to": "v-svc", "label": "mTLS + JWT" }, { "from": "v-svc", "to": "v-pay", "label": "tokens" }, { "from": "v-svc", "to": "v-db", "label": "least priv" }, { "from": "v-svc", "to": "v-aud", "label": "audit", "kind": "async" } ], "note": "No service holds a card number and no service reaches the internet directly; egress is through a firewall with an allow-list. Seller documents and customer PII are tokenised before they leave the owning service.", "meta": { "v": "1.0", "owner": "Security Architecture", "date": "2026-09" } }, { "id": "24-identity-and-access-flow", "title": "Identity — Who Proves What, To Whom, In What Order", "layout": "sequence", "canvas": { "width": 1660 }, "lifelines": [ { "id": "h-usr", "label": "Shopper", "kind": "actor" }, { "id": "h-app", "label": "Mobile app", "kind": "app" }, { "id": "h-gw", "label": "Envoy Gateway", "kind": "integration" }, { "id": "h-kc", "label": "Keycloak", "kind": "security" }, { "id": "h-risk", "label": "Risk engine", "kind": "security" }, { "id": "h-svc", "label": "Order service", "kind": "app" }, { "id": "h-opa", "label": "Policy engine", "kind": "security" }, { "id": "h-aud", "label": "Audit log", "kind": "security" } ], "messages": [ { "from": "h-usr", "to": "h-app", "label": "phone number", "kind": "call" }, { "from": "h-app", "to": "h-kc", "label": "PKCE auth request", "kind": "call" }, { "from": "h-kc", "to": "h-risk", "label": "device, geo, velocity", "kind": "call" }, { "from": "h-risk", "to": "h-kc", "label": "risk score", "kind": "return" }, { "from": "h-kc", "to": "h-usr", "label": "OTP, step-up if risky", "kind": "call" }, { "from": "h-kc", "to": "h-app", "label": "access 15 min + refresh", "kind": "return" }, { "from": "h-app", "to": "h-gw", "label": "GET /orders + bearer", "kind": "call" }, { "from": "h-gw", "to": "h-gw", "label": "verify JWT, no introspect", "kind": "self" }, { "from": "h-gw", "to": "h-svc", "label": "mTLS + identity header", "kind": "call" }, { "from": "h-svc", "to": "h-opa", "label": "may this subject read?", "kind": "call" }, { "from": "h-opa", "to": "h-svc", "label": "allow, field mask", "kind": "return" }, { "from": "h-svc", "to": "h-aud", "label": "access record", "kind": "async" }, { "from": "h-svc", "to": "h-app", "label": "orders, masked PII", "kind": "return" }, { "from": "h-app", "to": "h-kc", "label": "refresh, rotate token", "kind": "call" }, { "from": "h-kc", "to": "h-app", "label": "reuse detected: revoke family", "kind": "error" } ], "note": "Customers, sellers and staff use three separate realms. Staff and seller staff federate to Microsoft Entra ID with conditional access; only the customer realm is Keycloak-native, and no realm shares a token audience.", "meta": { "v": "1.0", "owner": "Security Architecture", "date": "2026-09" } }, { "id": "25-trust-and-marketplace-governance", "title": "Trust and Marketplace Governance — Signal to Enforcement", "layout": "swimlane", "canvas": { "width": 1780 }, "laneHeaderWidth": 170, "stages": [ "Signal", "Detect", "Decide", "Act", "Appeal" ], "lanes": [ { "title": "Seller risk", "cells": [ [ { "id": "a1", "label": "KYC, GSTIN, bank", "kind": "external" }, { "id": "a1b", "label": "Cancel and SLA rate", "kind": "queue" } ], [ { "id": "a2", "label": "Risk band model", "kind": "security", "sub": "KServe" } ], [ { "id": "a3", "label": "Auto or analyst", "kind": "decision", "sub": "band threshold" } ], [ { "id": "a4", "label": "Payout hold, delist", "kind": "security" } ], [ { "id": "a5", "label": "Evidence upload", "kind": "app", "sub": "SLA 72 h" } ] ] }, { "title": "Buyer abuse", "cells": [ [ { "id": "b1", "label": "Return and RTO rate", "kind": "queue" } ], [ { "id": "b2", "label": "Abuse score", "kind": "security", "sub": "graph features" } ], [ { "id": "b3", "label": "Instant refund gate", "kind": "decision" } ], [ { "id": "b4", "label": "Inspect before refund", "kind": "app" } ], [ { "id": "b5", "label": "Care override", "kind": "actor" } ] ] }, { "title": "Payment fraud", "cells": [ [ { "id": "c1", "label": "Device, velocity, BIN", "kind": "queue" } ], [ { "id": "c2", "label": "Real-time scoring", "kind": "security", "sub": "Flink · 40 ms" } ], [ { "id": "c3", "label": "Allow, step-up, block", "kind": "decision" } ], [ { "id": "c4", "label": "3DS or decline", "kind": "security" } ], [ { "id": "c5", "label": "Chargeback defence", "kind": "app" } ] ] }, { "title": "Counterfeit and content", "cells": [ [ { "id": "d1", "label": "Listing text and image", "kind": "app" }, { "id": "d1b", "label": "Brand complaint", "kind": "external" } ], [ { "id": "d2", "label": "Classifier + brand match", "kind": "security", "sub": "Azure OpenAI" } ], [ { "id": "d3", "label": "Moderation queue", "kind": "decision" } ], [ { "id": "d4", "label": "Take down listing", "kind": "security" } ], [ { "id": "d5", "label": "Seller counter-notice", "kind": "app" } ] ] }, { "title": "Review integrity", "cells": [ [ { "id": "e1", "label": "Review burst pattern", "kind": "queue" } ], [ { "id": "e2", "label": "Ring detection", "kind": "security", "sub": "graph clustering" } ], [ { "id": "e3", "label": "Confidence threshold", "kind": "decision" } ], [ { "id": "e4", "label": "Suppress and reweight", "kind": "app" } ], [] ] } ], "note": "Every enforcement writes an immutable decision record with the model version and the features that fired, because an appeal that cannot be reconstructed is an appeal that will be lost. Review integrity has no appeal path by design: suppression is silent.", "meta": { "v": "1.0", "owner": "Trust and Safety Architecture", "date": "2026-09" } } ]