Incident Management Platform  ·  View 30 of 34  ·  6 · Operations

Roadmap — What Ships First, and Why in That Order

An eight-week proof, then the requirement's MVP, Phase 2 and Phase 3, with one deliberate change: independence from the estate is in the MVP, not deferred.

Editable source SVG draw.io All views
Prove · 8 weeks Stretched JetStream 3-site latency Carrier routes receipts · DTMF Critical alerts iOS entitlement MVP Ingest · dedup · raw webhooks Schedules · snapshot gaps · DST verifier Escalation · 4 channels two providers · acks Event log · synthetic break-glass · APIs Phase 2 Grouping · merge · split maintenance · flood Channels · roles stakeholder updates Reviews · tracker sync computed intervals Outbound stream · cost status page Phase 3 Dependency hints annotate, never withhold Interrupt analytics rotation fairness Regional failover drills automated Sensitive incidents factor search · fallback kit Roadmap — What Ships First, and Why in That Order Decision point Risk / gap Application we own Security / platform The MVP already runs across three sites. Independence is not a Phase 3 feature, because a paging path that shares the estate's failure is not an MVP of this platform. v 1.0 · owner Reliability Architecture · date 2026-09

Decisions

  • The proof phase attacks the three assumptions most likely to be wrong: JetStream quorum latency across three sites, the real fidelity of both carriers' receipts and DTMF, and whether Apple grants the critical-alert entitlement.
  • Three-site paging ships in the MVP. The requirement places multi-region active-active in Phase 3, but a first release that shares a failure domain with the estate fails the one test it exists for, and adding a cell later is harder than starting with three.
  • Dependency-aware correlation stays last and arrives as annotation only. It is the capability most likely to hide a real page, and it needs a year of the platform's own incident data to tune.

Exit criteria

  • MVP exit: 60 days of synthetic pages at p95 under 15 s from every cell, one exercised cell loss, one exercised control-plane rebuild, and all 25 rotations verified across their next DST boundary.

Risks

  • If Apple does not grant the critical-alert entitlement, SEV1 bypass of do-not-disturb on iOS relies on voice calls from a contact the responder has marked as an emergency bypass. The fallback is documented in onboarding, not discovered at 03:12.
◀  Cost and Human Load — What Gets Measured, Charged and Reported All views The Loop the Platform Exists to Close  ▶
Solution Architecture v1.0 · Reliability Architecture · 2026-09 · 34 views · open source, fully on-premises30-roadmap