Health Check & Service Discovery  ·  View 12 of 21  ·  Data

Registry Data Model

Eight durable entities. What is missing from this view is the point of it.

Editable source SVG draw.io All views
health_contract contract_id PK service_id FK version signal interval_ms timeout_ms fail_threshold pass_threshold dependency_authority service service_id PK name UQ owner_team tier protocol port_contract min_healthy_fraction capability_profile policy_change change_id PK service_id FK nullable kind contract|budget|evacuation actor justification staged_from at failure_domain domain_id PK kind region|zone|cluster parent_id FK evacuation_state instance instance_id PK never reused service_id FK domain_id FK address port runtime_type deploy_version lease_renewed_at lease_ttl_ms health_sample sample_id PK instance_id FK class probe|self|passive reporter_identity result observed_at eligibility instance_id PK FK state eligible|degraded| ineligible|unknown weight score quarantine_until computed_at transition transition_id PK instance_id FK from_state to_state cause evidence_sample_id FK actor at 1 : N 1 : N 1 : N 1 : N 1 : N 1 : 1 1 : N 0 : N Registry Data Model — Identity, Contract, Evidence Eight durable entities. Published views and client subscriptions are deliberately absent: they are computed state held in memory, not registry rows — see view 11. v 1.0 · owner Reliability Architecture

The two keys that carry the design

  • instance_id is never reused, so a restarted process is a new row and a cached endpoint referring to the old one is detectably stale.
  • transition.evidence_sample_id points at the actual sample that caused the verdict, which is what makes an explanation auditable rather than narrated.

Deliberately absent

  • published_view and subscription are computed state in memory, not registry rows — see view 11.
  • The lease is folded into the instance row rather than modelled separately: it is strictly 1:1 and the join bought nothing.

Assumptions

  • 450 service rows, 60,000 instance rows, ~2,500 eligibility updates a minute, 90 days of transitions.
◀  State Classes All views Critical Flow — A Replica Fails  ▶
Solution Architecture v1.0 · Amazon Web Services with an open-source Envoy/xDS data plane · Reliability Architecture · 2026-10 · 21 views · 16 architecture decision records12-registry-data-model