[
  {
    "id": "01-system-context",
    "title": "Model Evaluation Service — System Context",
    "layout": "context",
    "system": {
      "label": "Model Evaluation Service",
      "sub": "Evidence · verdict · gate"
    },
    "groups": [
      {
        "side": "left",
        "title": "People",
        "nodes": [
          {
            "id": "mle",
            "label": "ML Engineer",
            "kind": "actor",
            "rel": "submits candidates",
            "dir": "in"
          },
          {
            "id": "qlead",
            "label": "Quality Lead",
            "kind": "actor",
            "rel": "owns the gates",
            "dir": "in"
          },
          {
            "id": "rater",
            "label": "Human Rater",
            "kind": "actor",
            "rel": "labels · adjudicates",
            "dir": "in"
          },
          {
            "id": "sre",
            "label": "Release On-Call",
            "kind": "actor",
            "rel": "acts on verdicts",
            "dir": "in"
          }
        ]
      },
      {
        "side": "right",
        "title": "Inference surfaces",
        "nodes": [
          {
            "id": "vertex",
            "label": "Vertex AI",
            "kind": "external",
            "rel": "candidate endpoints"
          },
          {
            "id": "prov",
            "label": "External Providers",
            "kind": "external",
            "rel": "judge · rival models"
          }
        ]
      },
      {
        "side": "top",
        "title": "Release path",
        "nodes": [
          {
            "id": "pipe",
            "label": "Deployment Pipeline",
            "kind": "external",
            "rel": "asks for a verdict",
            "dir": "in"
          },
          {
            "id": "serve",
            "label": "Assistant Serving",
            "kind": "external",
            "rel": "the incumbent"
          }
        ]
      },
      {
        "side": "bottom",
        "title": "Signals and governance",
        "nodes": [
          {
            "id": "telem",
            "label": "Production Telemetry",
            "kind": "external",
            "rel": "traces · guardrails",
            "kind2": "batch"
          },
          {
            "id": "priv",
            "label": "Privacy Controls",
            "kind": "security",
            "rel": "consent · erasure"
          }
        ]
      }
    ],
    "note": "The platform answers one question for the pipeline: is this candidate better than the incumbent, and where is it worse.",
    "meta": {
      "v": "1.0",
      "owner": "Data & AI Global Practice",
      "date": "2026-09"
    }
  },
  {
    "id": "02-high-level-architecture",
    "title": "Model Evaluation Service — High-Level Architecture",
    "layout": "flow",
    "chain": true,
    "stages": [
      {
        "title": "Submit",
        "nodes": [
          {
            "id": "h-reg",
            "label": "Candidate Register",
            "kind": "app",
            "sub": "config digest"
          },
          {
            "id": "h-pol",
            "label": "Policy Repository",
            "kind": "external",
            "sub": "suites · gates"
          }
        ]
      },
      {
        "title": "Plan",
        "nodes": [
          {
            "id": "h-frame",
            "label": "Frame Resolver",
            "kind": "app",
            "sub": "4-axis tuple"
          },
          {
            "id": "h-plan",
            "label": "Run Planner",
            "kind": "app",
            "sub": "cost ceiling"
          }
        ]
      },
      {
        "title": "Generate",
        "nodes": [
          {
            "id": "h-harn",
            "label": "Evaluation Harness",
            "kind": "app",
            "sub": "GKE · fan-out"
          },
          {
            "id": "h-sbx",
            "label": "Tool Sandbox",
            "kind": "security",
            "sub": "no prod route"
          }
        ]
      },
      {
        "title": "Score",
        "nodes": [
          {
            "id": "h-det",
            "label": "Deterministic Scorers",
            "kind": "app"
          },
          {
            "id": "h-judge",
            "label": "Model Judges",
            "kind": "app",
            "sub": "pinned · calibrated"
          },
          {
            "id": "h-hum",
            "label": "Human Review Queue",
            "kind": "integration"
          }
        ]
      },
      {
        "title": "Store",
        "nodes": [
          {
            "id": "h-scores",
            "label": "Score Store",
            "kind": "store",
            "sub": "BigQuery · append-only"
          },
          {
            "id": "h-art",
            "label": "Artefact Store",
            "kind": "store",
            "sub": "Cloud Storage"
          }
        ]
      },
      {
        "title": "Decide",
        "nodes": [
          {
            "id": "h-gate",
            "label": "Gate Engine",
            "kind": "decision",
            "sub": "per slice"
          },
          {
            "id": "h-verd",
            "label": "Verdict API",
            "kind": "integration",
            "sub": "fail closed"
          }
        ]
      }
    ],
    "note": "Online evaluation closes the loop from serving back into targeted regression sets; see the data flow and lifecycle views.",
    "meta": {
      "v": "1.0",
      "owner": "Data & AI Global Practice",
      "date": "2026-09"
    }
  },
  {
    "id": "03-actors-and-journeys",
    "title": "Model Evaluation Service — Actors and Their Core Journeys",
    "layout": "actors",
    "groups": [
      {
        "title": "The people who ship models",
        "kind": "boundary",
        "actors": [
          {
            "id": "a-mle",
            "label": "ML Engineer",
            "sub": "25 candidates / week",
            "goal": "Find out whether my change made the assistant better, before I have to defend it in a review.",
            "journeys": [
              {
                "id": "j-smoke",
                "label": "Run a smoke check",
                "sub": "≤ 8 min, waits for it"
              },
              {
                "id": "j-gate",
                "label": "Take a candidate through the gate",
                "sub": "≤ 90 min"
              },
              {
                "id": "j-argue",
                "label": "Argue with a block",
                "sub": "wants the examples"
              }
            ]
          },
          {
            "id": "a-pm",
            "label": "Product Manager",
            "sub": "owns the assistant",
            "goal": "Know what this release actually changes for users, in plain terms, before it goes out.",
            "journeys": [
              {
                "id": "j-read",
                "label": "Read the release evidence"
              },
              {
                "id": "j-slice",
                "label": "Check a cohort that matters",
                "sub": "language · task"
              }
            ]
          }
        ]
      },
      {
        "title": "The people who own quality",
        "kind": "onprem",
        "actors": [
          {
            "id": "a-qlead",
            "label": "Quality Lead",
            "sub": "18 suites · 34 gated slices",
            "goal": "Keep the gate trusted — sensitive enough to catch regressions, honest enough that nobody routes around it.",
            "journeys": [
              {
                "id": "j-author",
                "label": "Author a suite and its gate"
              },
              {
                "id": "j-rebase",
                "label": "Approve a frame change",
                "sub": "costs a re-baseline"
              },
              {
                "id": "j-waiver",
                "label": "Review the waiver register"
              }
            ]
          },
          {
            "id": "a-rater",
            "label": "Human Rater",
            "sub": "40 reviewer-h / week",
            "goal": "Judge which answer is actually better, without being told which one the company hopes wins.",
            "journeys": [
              {
                "id": "j-cal",
                "label": "Label the calibration set"
              },
              {
                "id": "j-adj",
                "label": "Adjudicate a blocked regression",
                "sub": "blinded pairwise"
              }
            ]
          }
        ]
      },
      {
        "title": "The people who carry the release",
        "kind": "trust",
        "actors": [
          {
            "id": "a-sre",
            "label": "Release On-Call",
            "sub": "rollout + rollback",
            "goal": "Ship when the evidence says ship, and get the old model back fast when it does not.",
            "journeys": [
              {
                "id": "j-canary",
                "label": "Watch a canary"
              },
              {
                "id": "j-roll",
                "label": "Roll back on a guardrail breach",
                "sub": "≤ 5 min"
              }
            ]
          },
          {
            "id": "a-priv",
            "label": "Privacy Officer",
            "sub": "governs production-derived data",
            "goal": "Be able to say exactly which user data is in which dataset, and get it out when asked.",
            "journeys": [
              {
                "id": "j-prov",
                "label": "Trace an example to its consent"
              },
              {
                "id": "j-erase",
                "label": "Action a deletion request"
              }
            ]
          }
        ]
      },
      {
        "title": "Who this is not for",
        "kind": "plain",
        "actors": [
          {
            "id": "a-user",
            "label": "End User",
            "sub": "40 M monthly",
            "goal": "Never meet this platform, and never meet the release it stopped.",
            "journeys": [
              {
                "id": "j-none",
                "label": "Gets a better assistant",
                "sub": "or does not get a worse one"
              }
            ]
          }
        ]
      }
    ],
    "note": "The end user is the beneficiary and never a participant — the only evidence they generate is telemetry, redacted before it becomes an example.",
    "meta": {
      "v": "1.0",
      "owner": "Data & AI Global Practice",
      "date": "2026-09"
    }
  },
  {
    "id": "04-journey-ship-a-candidate",
    "title": "User Journey — ML Engineer Takes a Candidate Through the Gate",
    "layout": "journey",
    "actor": {
      "label": "ML Engineer",
      "sub": "ships 2-3 candidates a week",
      "goal": "Get a defensible yes or no on a prompt change before the end of the day",
      "trigger": "A rewritten system prompt that looks better on a dozen hand-picked examples",
      "success": "A PASS with evidence, or a BLOCK naming the slice and the examples that moved"
    },
    "phases": [
      {
        "title": "Try",
        "sub": "local, hand-picked"
      },
      {
        "title": "Smoke",
        "sub": "400 examples"
      },
      {
        "title": "Submit",
        "sub": "config pinned"
      },
      {
        "title": "Wait",
        "moment": true,
        "sub": "≤ 90 min"
      },
      {
        "title": "Read the verdict",
        "moment": true
      },
      {
        "title": "Act"
      }
    ],
    "lanes": [
      {
        "title": "What they do",
        "kind": "step",
        "cells": [
          [
            {
              "label": "Eyeballs a dozen outputs"
            }
          ],
          [
            {
              "label": "Runs the smoke tier"
            }
          ],
          [
            {
              "label": "Pins the full config"
            },
            {
              "label": "Submits the candidate"
            }
          ],
          [
            {
              "label": "Works on something else"
            }
          ],
          [
            {
              "label": "Opens the slice report"
            }
          ],
          [
            {
              "label": "Fixes, waives or ships"
            }
          ]
        ]
      },
      {
        "title": "Where",
        "kind": "touch",
        "cells": [
          [
            {
              "label": "Notebook"
            }
          ],
          [
            {
              "label": "CLI"
            }
          ],
          [
            {
              "label": "CLI · register"
            }
          ],
          [
            {
              "label": "Chat notification"
            }
          ],
          [
            {
              "label": "Verdict page"
            }
          ],
          [
            {
              "label": "Pull request"
            }
          ]
        ]
      },
      {
        "title": "What the platform does",
        "kind": "system",
        "cells": [
          [
            {
              "label": "Nothing — not its job"
            }
          ],
          [
            {
              "label": "400 examples · 3 gens"
            }
          ],
          [
            {
              "label": "Digest · frame resolve"
            },
            {
              "label": "Cost ceiling check"
            }
          ],
          [
            {
              "label": "6,500 × 3 gens"
            },
            {
              "label": "39k judge calls"
            }
          ],
          [
            {
              "label": "Per-slice deltas + CI"
            }
          ],
          [
            {
              "label": "Records the decision"
            }
          ]
        ]
      },
      {
        "title": "Feeling",
        "kind": "sentiment",
        "cells": [
          [
            {
              "label": "Confident",
              "score": 2
            }
          ],
          [
            {
              "label": "Encouraged",
              "score": 1
            }
          ],
          [
            {
              "label": "Fiddly",
              "score": 0
            }
          ],
          [
            {
              "label": "Blocked and idle",
              "score": -2
            }
          ],
          [
            {
              "label": "Blocked — on one slice",
              "score": -3
            }
          ],
          [
            {
              "label": "Knows what to fix",
              "score": 1
            }
          ]
        ]
      }
    ],
    "note": "The trough is the 90-minute wait followed by a block on a slice the engineer never looked at. The smoke tier exists to move that discovery earlier; the example-level diff exists to make the block arguable rather than final.",
    "meta": {
      "v": "1.0",
      "owner": "Data & AI Global Practice",
      "date": "2026-09"
    }
  },
  {
    "id": "05-journey-regression-hunt",
    "title": "User Journey — Quality Lead Chases a Regression Users Already Met",
    "layout": "journey",
    "actor": {
      "label": "Quality Lead",
      "sub": "owns 18 suites",
      "goal": "Explain how a regression got past the gate, and make sure that class never does again",
      "trigger": "A spike in regeneration rate on the canary cohort, four hours after rollout",
      "success": "Rolled back, root cause named, and a permanent regression test in place"
    },
    "phases": [
      {
        "title": "Notice",
        "sub": "online signal"
      },
      {
        "title": "Confirm",
        "moment": true
      },
      {
        "title": "Roll back",
        "moment": true,
        "sub": "≤ 5 min"
      },
      {
        "title": "Explain"
      },
      {
        "title": "Prevent"
      }
    ],
    "lanes": [
      {
        "title": "What they do",
        "kind": "step",
        "cells": [
          [
            {
              "label": "Sees the guardrail alert"
            }
          ],
          [
            {
              "label": "Checks for a confound"
            },
            {
              "label": "Reads canary deltas"
            }
          ],
          [
            {
              "label": "Calls the rollback"
            }
          ],
          [
            {
              "label": "Finds the offline blind spot"
            }
          ],
          [
            {
              "label": "Turns failures into a suite"
            }
          ]
        ]
      },
      {
        "title": "Where",
        "kind": "touch",
        "cells": [
          [
            {
              "label": "Pager"
            }
          ],
          [
            {
              "label": "Confound register"
            }
          ],
          [
            {
              "label": "Deployment pipeline"
            }
          ],
          [
            {
              "label": "Slice report"
            }
          ],
          [
            {
              "label": "Policy repository"
            }
          ]
        ]
      },
      {
        "title": "What the platform does",
        "kind": "system",
        "cells": [
          [
            {
              "label": "Guardrail breach fires"
            }
          ],
          [
            {
              "label": "Names overlapping changes"
            }
          ],
          [
            {
              "label": "Auto-rollback trigger"
            }
          ],
          [
            {
              "label": "Offline-online correlation"
            }
          ],
          [
            {
              "label": "Redacts · versions · gates"
            }
          ]
        ]
      },
      {
        "title": "Feeling",
        "kind": "sentiment",
        "cells": [
          [
            {
              "label": "Alarmed",
              "score": -2
            }
          ],
          [
            {
              "label": "Uncertain — was it us?",
              "score": -3
            }
          ],
          [
            {
              "label": "Relieved",
              "score": 0
            }
          ],
          [
            {
              "label": "Exposed — gate missed it",
              "score": -1
            }
          ],
          [
            {
              "label": "Rebuilt trust",
              "score": 2
            }
          ]
        ]
      }
    ],
    "note": "The worst moment is not the regression — it is the twenty minutes spent not knowing whether the model or a concurrent UI change caused it. The confound register is a structural answer to that moment, not a reporting nicety.",
    "meta": {
      "v": "1.0",
      "owner": "Data & AI Global Practice",
      "date": "2026-09"
    }
  },
  {
    "id": "06-layered-architecture",
    "title": "Model Evaluation Service — Layered Architecture",
    "layout": "bands",
    "bands": [
      {
        "name": "Consumers",
        "nodes": [
          {
            "id": "l-cli",
            "label": "Engineer CLI",
            "kind": "app"
          },
          {
            "id": "l-verdict",
            "label": "Verdict Page",
            "kind": "app"
          },
          {
            "id": "l-review",
            "label": "Rater Console",
            "kind": "app"
          },
          {
            "id": "l-pipe",
            "label": "Deployment Pipeline",
            "kind": "external"
          }
        ]
      },
      {
        "name": "Decision",
        "nodes": [
          {
            "id": "l-gate",
            "label": "Gate Engine",
            "kind": "decision"
          },
          {
            "id": "l-stat",
            "label": "Significance",
            "kind": "app"
          },
          {
            "id": "l-waiv",
            "label": "Waiver Register",
            "kind": "security"
          }
        ]
      },
      {
        "name": "Evidence",
        "nodes": [
          {
            "id": "l-det",
            "label": "Deterministic Scorers",
            "kind": "app"
          },
          {
            "id": "l-judge",
            "label": "Judge Service",
            "kind": "app"
          },
          {
            "id": "l-cal",
            "label": "Calibration Monitor",
            "kind": "platform"
          },
          {
            "id": "l-hum",
            "label": "Human Review",
            "kind": "integration"
          }
        ]
      },
      {
        "name": "Execution",
        "nodes": [
          {
            "id": "l-plan",
            "label": "Run Planner",
            "kind": "app"
          },
          {
            "id": "l-harn",
            "label": "Harness Workers",
            "kind": "app"
          },
          {
            "id": "l-sbx",
            "label": "Tool Sandbox",
            "kind": "security"
          }
        ]
      },
      {
        "name": "Corpus",
        "nodes": [
          {
            "id": "l-ds",
            "label": "Dataset Store",
            "kind": "store"
          },
          {
            "id": "l-art",
            "label": "Artefact Store",
            "kind": "store"
          },
          {
            "id": "l-score",
            "label": "Score Store",
            "kind": "store"
          },
          {
            "id": "l-label",
            "label": "Label Store",
            "kind": "store"
          }
        ]
      },
      {
        "name": "Platform",
        "nodes": [
          {
            "id": "l-gke",
            "label": "GKE",
            "kind": "platform"
          },
          {
            "id": "l-ps",
            "label": "Pub/Sub",
            "kind": "queue"
          },
          {
            "id": "l-iam",
            "label": "Workload Identity",
            "kind": "security"
          },
          {
            "id": "l-obs",
            "label": "Cloud Observability",
            "kind": "platform"
          }
        ]
      }
    ],
    "note": "The frame — dataset, scorer, judge and harness version — is resolved once at the execution layer and travels with every score to the decision layer. Nothing above the evidence band may compare across frames.",
    "meta": {
      "v": "1.0",
      "owner": "Data & AI Global Practice",
      "date": "2026-09"
    }
  },
  {
    "id": "07-platform-components",
    "title": "Model Evaluation Service — Container View",
    "layout": "nested",
    "boxes": [
      {
        "title": "Model Evaluation Service · Google Cloud europe-west4",
        "kind": "boundary",
        "dir": "col",
        "children": [
          {
            "title": "Control plane · GKE Autopilot",
            "kind": "cloud",
            "nodes": [
              {
                "id": "c-reg",
                "label": "Candidate Register",
                "kind": "app",
                "sub": "Go · 3 pods"
              },
              {
                "id": "c-frame",
                "label": "Frame Resolver",
                "kind": "app",
                "sub": "Go · 3 pods"
              },
              {
                "id": "c-plan",
                "label": "Run Planner",
                "kind": "app",
                "sub": "Go · 3 pods"
              },
              {
                "id": "c-gate",
                "label": "Gate Engine",
                "kind": "decision",
                "sub": "Python · 4 pods"
              }
            ]
          },
          {
            "title": "Execution plane · GKE node pools",
            "kind": "cloud",
            "nodes": [
              {
                "id": "c-harn",
                "label": "Harness Workers",
                "kind": "app",
                "sub": "0-600 pods"
              },
              {
                "id": "c-sbx",
                "label": "Tool Sandbox",
                "kind": "security",
                "sub": "gVisor · no egress"
              },
              {
                "id": "c-score",
                "label": "Scoring Workers",
                "kind": "app",
                "sub": "0-200 pods"
              }
            ]
          },
          {
            "title": "State",
            "kind": "cloud",
            "nodes": [
              {
                "id": "c-sql",
                "label": "Run State",
                "kind": "store",
                "sub": "Cloud SQL · HA"
              },
              {
                "id": "c-bq",
                "label": "Score Store",
                "kind": "store",
                "sub": "BigQuery"
              },
              {
                "id": "c-gcs",
                "label": "Artefacts",
                "kind": "store",
                "sub": "Cloud Storage"
              },
              {
                "id": "c-lbl",
                "label": "Label Store",
                "kind": "store",
                "sub": "Cloud SQL"
              }
            ]
          },
          {
            "title": "Spine",
            "kind": "cloud",
            "nodes": [
              {
                "id": "c-ps",
                "label": "Work + Events",
                "kind": "queue",
                "sub": "Pub/Sub"
              },
              {
                "id": "c-mem",
                "label": "Score Cache",
                "kind": "store",
                "sub": "Memorystore"
              }
            ]
          }
        ]
      },
      {
        "title": "Outside the boundary",
        "kind": "trust",
        "dir": "row",
        "children": [
          {
            "title": "Inference",
            "kind": "plain",
            "nodes": [
              {
                "id": "c-vx",
                "label": "Vertex AI",
                "kind": "external",
                "sub": "candidates"
              },
              {
                "id": "c-prov",
                "label": "Provider APIs",
                "kind": "external",
                "sub": "judges"
              }
            ]
          },
          {
            "title": "Governance",
            "kind": "plain",
            "nodes": [
              {
                "id": "c-git",
                "label": "Policy Repository",
                "kind": "external",
                "sub": "suites · gates"
              },
              {
                "id": "c-rate",
                "label": "Rater Console",
                "kind": "external",
                "sub": "vendor SaaS"
              }
            ]
          }
        ]
      }
    ],
    "note": "Edges are omitted deliberately: the control plane writes work to Pub/Sub and reads scores from BigQuery, and every execution-plane call to an inference surface leaves through the egress proxy shown in the trust-zone view.",
    "meta": {
      "v": "1.0",
      "owner": "Data & AI Global Practice",
      "date": "2026-09"
    }
  },
  {
    "id": "08-integration-surface",
    "title": "Model Evaluation Service — Integration Architecture",
    "layout": "hub",
    "left": {
      "title": "Inbound",
      "nodes": [
        {
          "id": "i-cli",
          "label": "Engineer CLI",
          "kind": "app",
          "rel": "submit"
        },
        {
          "id": "i-pipe",
          "label": "Deployment Pipeline",
          "kind": "external",
          "rel": "verdict"
        },
        {
          "id": "i-git",
          "label": "Policy Repository",
          "kind": "external",
          "rel": "webhook",
          "kind2": "async"
        },
        {
          "id": "i-tel",
          "label": "Production Telemetry",
          "kind": "external",
          "rel": "traces",
          "kind2": "batch"
        },
        {
          "id": "i-rate",
          "label": "Rater Console",
          "kind": "external",
          "rel": "labels",
          "dir": "in",
          "kind2": "async"
        }
      ]
    },
    "centre": {
      "title": "Platform",
      "nodes": [
        {
          "id": "i-api",
          "label": "Evaluation API",
          "kind": "integration",
          "sub": "9 endpoints"
        },
        {
          "id": "i-core",
          "label": "Run + Gate Core",
          "kind": "app"
        },
        {
          "id": "i-bus",
          "label": "Event Spine",
          "kind": "queue",
          "sub": "6 topics"
        }
      ]
    },
    "right": {
      "title": "Outbound",
      "nodes": [
        {
          "id": "i-vx",
          "label": "Vertex AI",
          "kind": "external",
          "rel": "candidates",
          "dir": "out"
        },
        {
          "id": "i-prov",
          "label": "Provider APIs",
          "kind": "external",
          "rel": "judges",
          "dir": "out"
        }
      ]
    },
    "note": "The verdict query is the only synchronous integration the platform must honour during a release window; everything else degrades to slower. Slice reporting is a read of the score store, and chat and pager delivery is a transport on the event spine — neither is drawn as an integration.",
    "meta": {
      "v": "1.0",
      "owner": "Data & AI Global Practice",
      "date": "2026-09"
    }
  },
  {
    "id": "09-data-flow",
    "title": "Model Evaluation Service — Data Flow",
    "layout": "flow",
    "chain": true,
    "stages": [
      {
        "title": "Sources",
        "nodes": [
          {
            "id": "d-prod",
            "label": "Production Traces",
            "kind": "external",
            "sub": "40 M MAU"
          },
          {
            "id": "d-cur",
            "label": "Curated Examples",
            "kind": "external"
          },
          {
            "id": "d-inc",
            "label": "Incident Reports",
            "kind": "external"
          }
        ]
      },
      {
        "title": "Admission",
        "nodes": [
          {
            "id": "d-dlp",
            "label": "Redaction",
            "kind": "security",
            "sub": "Sensitive Data Protection"
          },
          {
            "id": "d-prov",
            "label": "Provenance Stamp",
            "kind": "app",
            "sub": "consent · basis"
          }
        ]
      },
      {
        "title": "Corpus",
        "nodes": [
          {
            "id": "d-gold",
            "label": "Frozen Golden Set",
            "kind": "store",
            "sub": "immutable"
          },
          {
            "id": "d-roll",
            "label": "Rolling Set",
            "kind": "store",
            "sub": "refreshed"
          },
          {
            "id": "d-tgt",
            "label": "Targeted Sets",
            "kind": "store",
            "sub": "from incidents"
          }
        ]
      },
      {
        "title": "Execution",
        "nodes": [
          {
            "id": "d-harn",
            "label": "Harness",
            "kind": "app",
            "sub": "3 gens / example"
          },
          {
            "id": "d-trace",
            "label": "Run Traces",
            "kind": "store",
            "sub": "~2.2 TB / year"
          }
        ]
      },
      {
        "title": "Scoring",
        "nodes": [
          {
            "id": "d-sc",
            "label": "Scorers + Judges",
            "kind": "app"
          },
          {
            "id": "d-lbl",
            "label": "Human Labels",
            "kind": "store",
            "sub": "separate store"
          }
        ]
      },
      {
        "title": "Facts",
        "nodes": [
          {
            "id": "d-bq",
            "label": "Score Store",
            "kind": "store",
            "sub": "55 M rows / year"
          },
          {
            "id": "d-ver",
            "label": "Verdict Record",
            "kind": "store",
            "sub": "7 years"
          }
        ]
      },
      {
        "title": "Consumers",
        "nodes": [
          {
            "id": "d-rep",
            "label": "Slice Reports",
            "kind": "app"
          },
          {
            "id": "d-corr",
            "label": "Offline-Online Correlation",
            "kind": "platform"
          }
        ]
      }
    ],
    "note": "Every score carries its frame. The loop back from production into targeted sets is the only path by which user data becomes an example, and it passes through redaction before anything is durable.",
    "meta": {
      "v": "1.0",
      "owner": "Data & AI Global Practice",
      "date": "2026-09"
    }
  },
  {
    "id": "10-storage-zones",
    "title": "Model Evaluation Service — Data Architecture and Ownership",
    "layout": "nested",
    "boxes": [
      {
        "title": "Immutable · the reason old scores still mean something",
        "kind": "boundary",
        "dir": "row",
        "children": [
          {
            "title": "Corpus",
            "kind": "plain",
            "nodes": [
              {
                "id": "z-ds",
                "label": "Dataset Versions",
                "kind": "store",
                "sub": "GCS · indefinite"
              },
              {
                "id": "z-can",
                "label": "Contamination Canaries",
                "kind": "store",
                "sub": "never published"
              }
            ]
          },
          {
            "title": "Evidence",
            "kind": "plain",
            "nodes": [
              {
                "id": "z-tr",
                "label": "Run Traces",
                "kind": "store",
                "sub": "GCS · 400 d"
              },
              {
                "id": "z-rat",
                "label": "Judge Rationales",
                "kind": "store",
                "sub": "GCS · 400 d"
              }
            ]
          },
          {
            "title": "Facts",
            "kind": "plain",
            "nodes": [
              {
                "id": "z-sc",
                "label": "Scores",
                "kind": "store",
                "sub": "BigQuery · 5 y"
              },
              {
                "id": "z-vd",
                "label": "Verdicts",
                "kind": "store",
                "sub": "BigQuery · 7 y"
              }
            ]
          }
        ]
      },
      {
        "title": "Ground truth · survives any re-scoring of the platform's own output",
        "kind": "trust",
        "dir": "row",
        "children": [
          {
            "title": "Owned by the rater programme",
            "kind": "plain",
            "nodes": [
              {
                "id": "z-lbl",
                "label": "Human Labels",
                "kind": "store",
                "sub": "Cloud SQL · indefinite"
              },
              {
                "id": "z-adj",
                "label": "Adjudications",
                "kind": "store",
                "sub": "Cloud SQL"
              }
            ]
          }
        ]
      },
      {
        "title": "Mutable · operational, rebuildable",
        "kind": "cloud",
        "dir": "row",
        "children": [
          {
            "title": "Run state",
            "kind": "plain",
            "nodes": [
              {
                "id": "z-run",
                "label": "Run + Checkpoint State",
                "kind": "store",
                "sub": "Cloud SQL · RPO 5 min"
              },
              {
                "id": "z-cand",
                "label": "Candidate Register",
                "kind": "store",
                "sub": "Cloud SQL"
              }
            ]
          },
          {
            "title": "Derived",
            "kind": "plain",
            "nodes": [
              {
                "id": "z-cache",
                "label": "Score Cache",
                "kind": "store",
                "sub": "Memorystore · disposable"
              },
              {
                "id": "z-rep",
                "label": "Report Views",
                "kind": "store",
                "sub": "BigQuery · rebuildable"
              }
            ]
          }
        ]
      },
      {
        "title": "Source of truth for policy · outside every database",
        "kind": "onprem",
        "dir": "row",
        "children": [
          {
            "title": "Reviewed as code",
            "kind": "plain",
            "nodes": [
              {
                "id": "z-pol",
                "label": "Suites · Gates · Rubrics",
                "kind": "external",
                "sub": "Git · RPO 0"
              },
              {
                "id": "z-slice",
                "label": "Slice Taxonomy",
                "kind": "external",
                "sub": "Git"
              }
            ]
          }
        ]
      }
    ],
    "note": "Nothing in the immutable zone is ever updated. A correction is a superseding record; a dataset fix is a new version; a re-score is a new frame. Deletion requests are the one exception and are handled as a tombstone, which is why the reproducibility claim is bounded.",
    "meta": {
      "v": "1.0",
      "owner": "Data & AI Global Practice",
      "date": "2026-09"
    }
  },
  {
    "id": "11-data-model",
    "title": "Model Evaluation Service — Core Data Model",
    "layout": "er",
    "canvas": {
      "width": 1760,
      "cols": 4
    },
    "rowGap": 260,
    "entities": [
      {
        "id": "e-cand",
        "name": "candidate",
        "kind": "store",
        "row": 0,
        "col": 0,
        "attrs": [
          "candidate_id  PK",
          "config_digest  UNIQUE",
          "model_ref",
          "prompt_version",
          "tool_defs_version",
          "index_version",
          "is_incumbent",
          "submitted_at"
        ]
      },
      {
        "id": "e-frame",
        "name": "frame",
        "kind": "store",
        "row": 1,
        "col": 1,
        "attrs": [
          "frame_id  PK",
          "dataset_version  FK",
          "scorer_version",
          "judge_version",
          "harness_version",
          "retired_at"
        ]
      },
      {
        "id": "e-run",
        "name": "run",
        "kind": "store",
        "row": 0,
        "col": 1,
        "attrs": [
          "run_id  PK",
          "candidate_id  FK",
          "frame_id  FK",
          "suite_id  FK",
          "state",
          "harness_error_rate",
          "cost_cents"
        ]
      },
      {
        "id": "e-ds",
        "name": "dataset_version",
        "kind": "store",
        "row": 2,
        "col": 3,
        "attrs": [
          "dataset_version  PK",
          "dataset_id",
          "class",
          "owner",
          "example_count",
          "published_at"
        ]
      },
      {
        "id": "e-ex",
        "name": "example",
        "kind": "store",
        "row": 0,
        "col": 3,
        "attrs": [
          "example_id  PK",
          "dataset_version  FK",
          "input_ref",
          "slice_labels",
          "provenance",
          "consent_state",
          "is_canary",
          "tombstoned_at"
        ]
      },
      {
        "id": "e-score",
        "name": "score",
        "kind": "store",
        "row": 0,
        "col": 2,
        "attrs": [
          "score_id  PK",
          "run_id  FK",
          "example_id  FK",
          "frame_id  FK",
          "scorer_id  FK",
          "value",
          "generation_idx",
          "trace_ref",
          "superseded_by"
        ]
      },
      {
        "id": "e-suite",
        "name": "suite",
        "kind": "store",
        "row": 2,
        "col": 2,
        "attrs": [
          "suite_id  PK",
          "dataset_id  FK",
          "gated_slices",
          "repetitions",
          "online_correlation"
        ]
      },
      {
        "id": "e-scorer",
        "name": "scorer",
        "kind": "store",
        "row": 1,
        "col": 2,
        "attrs": [
          "scorer_id  PK",
          "family",
          "version",
          "rubric_version",
          "kappa_vs_human",
          "gate_admissible"
        ]
      },
      {
        "id": "e-gate",
        "name": "gate",
        "kind": "store",
        "row": 2,
        "col": 1,
        "attrs": [
          "gate_id  PK",
          "suite_id  FK",
          "slice",
          "strength",
          "threshold",
          "alpha"
        ]
      },
      {
        "id": "e-verd",
        "name": "verdict",
        "kind": "store",
        "row": 1,
        "col": 0,
        "attrs": [
          "verdict_id  PK",
          "candidate_id  FK",
          "frame_id  FK",
          "outcome",
          "baseline_run_id  FK",
          "decided_at"
        ]
      },
      {
        "id": "e-label",
        "name": "human_label",
        "kind": "store",
        "row": 1,
        "col": 3,
        "attrs": [
          "label_id  PK",
          "example_id  FK",
          "rater_id",
          "preference",
          "blinded",
          "labelled_at"
        ]
      },
      {
        "id": "e-waiv",
        "name": "waiver",
        "kind": "store",
        "row": 2,
        "col": 0,
        "attrs": [
          "waiver_id  PK",
          "verdict_id  FK",
          "gate_id  FK",
          "approver",
          "reason",
          "expires_at"
        ]
      }
    ],
    "relations": [
      {
        "from": "e-cand",
        "to": "e-run",
        "label": "evaluated by",
        "fromCard": "1",
        "toCard": "N"
      },
      {
        "from": "e-frame",
        "to": "e-run",
        "label": "scopes",
        "fromCard": "1",
        "toCard": "N"
      },
      {
        "from": "e-ex",
        "to": "e-score",
        "label": "scored as",
        "fromCard": "1",
        "toCard": "N"
      },
      {
        "from": "e-scorer",
        "to": "e-score",
        "label": "emits",
        "fromCard": "1",
        "toCard": "N"
      },
      {
        "from": "e-ex",
        "to": "e-label",
        "label": "labelled by",
        "fromCard": "1",
        "toCard": "N"
      },
      {
        "from": "e-cand",
        "to": "e-verd",
        "label": "cleared by",
        "fromCard": "1",
        "toCard": "N"
      },
      {
        "from": "e-verd",
        "to": "e-waiv",
        "label": "excused by",
        "fromCard": "1",
        "toCard": "N"
      },
      {
        "from": "e-suite",
        "to": "e-gate",
        "label": "gated by",
        "fromCard": "1",
        "toCard": "N"
      }
    ],
    "note": "frame_id on both run and score is deliberate redundancy: a score must be self-describing even if its run row is lost, because the frame is what makes the number mean anything. Three foreign keys are carried as columns rather than drawn — score.run_id, example.dataset_version and suite.dataset_id — to keep the relations readable.",
    "meta": {
      "v": "1.0",
      "owner": "Data & AI Global Practice",
      "date": "2026-09"
    }
  },
  {
    "id": "12-gate-run-sequence",
    "title": "Take a Candidate Through the Gate — Critical Flow",
    "layout": "sequence",
    "lifelines": [
      {
        "id": "q-eng",
        "label": "ML Engineer",
        "kind": "actor"
      },
      {
        "id": "q-reg",
        "label": "Candidate Register",
        "kind": "app"
      },
      {
        "id": "q-frame",
        "label": "Frame Resolver",
        "kind": "app"
      },
      {
        "id": "q-harn",
        "label": "Harness",
        "kind": "app"
      },
      {
        "id": "q-judge",
        "label": "Judge Service",
        "kind": "app"
      },
      {
        "id": "q-store",
        "label": "Score Store",
        "kind": "store"
      },
      {
        "id": "q-gate",
        "label": "Gate Engine",
        "kind": "decision"
      }
    ],
    "messages": [
      {
        "from": "q-eng",
        "to": "q-reg",
        "label": "submit candidate",
        "kind": "call"
      },
      {
        "from": "q-reg",
        "to": "q-reg",
        "label": "digest config",
        "kind": "self"
      },
      {
        "from": "q-reg",
        "to": "q-frame",
        "label": "resolve frame",
        "kind": "call"
      },
      {
        "from": "q-frame",
        "to": "q-store",
        "label": "incumbent in frame?",
        "kind": "call"
      },
      {
        "from": "q-store",
        "to": "q-frame",
        "label": "absent",
        "kind": "error"
      },
      {
        "from": "q-frame",
        "to": "q-harn",
        "label": "re-baseline first",
        "kind": "call"
      },
      {
        "from": "q-frame",
        "to": "q-harn",
        "label": "run candidate",
        "kind": "call"
      },
      {
        "from": "q-harn",
        "to": "q-harn",
        "label": "fan out 6,500 × 3",
        "kind": "self"
      },
      {
        "from": "q-harn",
        "to": "q-judge",
        "label": "score outputs",
        "kind": "call"
      },
      {
        "from": "q-judge",
        "to": "q-judge",
        "label": "both orderings",
        "kind": "self"
      },
      {
        "from": "q-judge",
        "to": "q-store",
        "label": "append frame-bound scores",
        "kind": "async"
      },
      {
        "from": "q-harn",
        "to": "q-store",
        "label": "harness error rate",
        "kind": "async"
      },
      {
        "from": "q-gate",
        "to": "q-store",
        "label": "deltas per slice",
        "kind": "call"
      },
      {
        "from": "q-gate",
        "to": "q-gate",
        "label": "significance + guardrails",
        "kind": "self"
      },
      {
        "from": "q-gate",
        "to": "q-eng",
        "label": "BLOCK + slice evidence",
        "kind": "return"
      }
    ],
    "note": "The re-baseline step is not an error path. A frame the incumbent has never been scored in is the normal consequence of changing a dataset, a rubric or a judge, and the run planner pays for it before it will compare anything.",
    "meta": {
      "v": "1.0",
      "owner": "Data & AI Global Practice",
      "date": "2026-09"
    }
  },
  {
    "id": "13-scoring-pipeline",
    "title": "Model Evaluation Service — Scoring Pipeline",
    "layout": "flow",
    "chain": true,
    "stages": [
      {
        "title": "Work",
        "nodes": [
          {
            "id": "p-item",
            "label": "Example Work Item",
            "kind": "queue",
            "sub": "Pub/Sub"
          },
          {
            "id": "p-cache",
            "label": "Cache Probe",
            "kind": "decision",
            "sub": "temp 0 only"
          }
        ]
      },
      {
        "title": "Generate",
        "nodes": [
          {
            "id": "p-ctx",
            "label": "Assemble Prompt",
            "kind": "app",
            "sub": "pinned config"
          },
          {
            "id": "p-inf",
            "label": "Candidate Inference",
            "kind": "external",
            "sub": "Vertex AI"
          },
          {
            "id": "p-tool",
            "label": "Tool Sandbox",
            "kind": "security",
            "sub": "gVisor"
          }
        ]
      },
      {
        "title": "Classify",
        "nodes": [
          {
            "id": "p-cls",
            "label": "Outcome Classifier",
            "kind": "decision",
            "sub": "model vs harness"
          },
          {
            "id": "p-retry",
            "label": "Retry / Quarantine",
            "kind": "app"
          }
        ]
      },
      {
        "title": "Score",
        "nodes": [
          {
            "id": "p-det",
            "label": "Deterministic Checks",
            "kind": "app"
          },
          {
            "id": "p-jd",
            "label": "Judge Pass",
            "kind": "app",
            "sub": "2 orderings"
          },
          {
            "id": "p-hum",
            "label": "Human Sample",
            "kind": "integration",
            "sub": "audit fraction"
          }
        ]
      },
      {
        "title": "Bind",
        "nodes": [
          {
            "id": "p-fr",
            "label": "Stamp Frame",
            "kind": "app",
            "sub": "4-axis tuple"
          },
          {
            "id": "p-tr",
            "label": "Persist Trace",
            "kind": "store",
            "sub": "Cloud Storage"
          }
        ]
      },
      {
        "title": "Aggregate",
        "nodes": [
          {
            "id": "p-agg",
            "label": "Slice Aggregation",
            "kind": "app"
          },
          {
            "id": "p-bq",
            "label": "Score Store",
            "kind": "store",
            "sub": "BigQuery"
          }
        ]
      }
    ],
    "note": "The outcome classifier is the load-bearing stage: a sandbox timeout or a provider 5xx leaves the pipeline as a harness error and never as a wrong answer. A run whose harness-error rate exceeds its budget cannot yield a PASS.",
    "meta": {
      "v": "1.0",
      "owner": "Data & AI Global Practice",
      "date": "2026-09"
    }
  },
  {
    "id": "14-scorer-lanes",
    "title": "Scoring by Family — What Each Kind of Scorer Costs and Proves",
    "layout": "swimlane",
    "stages": [
      "Trigger",
      "Input",
      "Method",
      "Output",
      "Authority"
    ],
    "lanes": [
      {
        "title": "Deterministic",
        "cells": [
          [
            {
              "id": "d1",
              "label": "Every example",
              "kind": "app"
            }
          ],
          [
            {
              "id": "d2",
              "label": "Output + expectation",
              "kind": "store"
            }
          ],
          [
            {
              "id": "d3",
              "label": "Schema · tools · regex",
              "kind": "app"
            }
          ],
          [
            {
              "id": "d4",
              "label": "Pass / fail",
              "kind": "store"
            }
          ],
          [
            {
              "id": "d5",
              "label": "Blocking",
              "kind": "decision"
            }
          ]
        ]
      },
      {
        "title": "Model judge",
        "cells": [
          [
            {
              "id": "j1",
              "label": "Every example",
              "kind": "app"
            }
          ],
          [
            {
              "id": "j2",
              "label": "Pair + rubric",
              "kind": "store"
            }
          ],
          [
            {
              "id": "j3",
              "label": "Pinned judge · 2 orders",
              "kind": "external"
            }
          ],
          [
            {
              "id": "j4",
              "label": "Score + rationale",
              "kind": "store"
            }
          ],
          [
            {
              "id": "j5",
              "label": "Blocking if κ ≥ 0.75",
              "kind": "decision"
            }
          ]
        ]
      },
      {
        "title": "Calibration monitor",
        "cells": [
          [
            {
              "id": "c1",
              "label": "Continuous",
              "kind": "platform"
            }
          ],
          [
            {
              "id": "c2",
              "label": "Fixed calibration set",
              "kind": "store"
            }
          ],
          [
            {
              "id": "c3",
              "label": "Re-score · compare κ",
              "kind": "platform"
            }
          ],
          [
            {
              "id": "c4",
              "label": "Drift alarm",
              "kind": "risk"
            }
          ],
          [
            {
              "id": "c5",
              "label": "Retires a frame",
              "kind": "security"
            }
          ]
        ]
      },
      {
        "title": "Human audit",
        "cells": [
          [
            {
              "id": "h1",
              "label": "Sampled fraction",
              "kind": "integration"
            }
          ],
          [
            {
              "id": "h2",
              "label": "Blinded pair",
              "kind": "store"
            }
          ],
          [
            {
              "id": "h3",
              "label": "Rater preference",
              "kind": "actor"
            }
          ],
          [
            {
              "id": "h4",
              "label": "Label",
              "kind": "store"
            }
          ],
          [
            {
              "id": "h5",
              "label": "Ground truth",
              "kind": "decision"
            }
          ]
        ]
      },
      {
        "title": "Human adjudication",
        "cells": [
          [
            {
              "id": "a1",
              "label": "Every BLOCK",
              "kind": "integration"
            }
          ],
          [
            {
              "id": "a2",
              "label": "Moved examples",
              "kind": "store"
            }
          ],
          [
            {
              "id": "a3",
              "label": "Blinded review",
              "kind": "actor"
            }
          ],
          [
            {
              "id": "a4",
              "label": "Upheld / overturned",
              "kind": "store"
            }
          ],
          [
            {
              "id": "a5",
              "label": "Final on a refusal",
              "kind": "decision"
            }
          ]
        ]
      }
    ],
    "note": "The judge is the only lane whose authority is conditional. Below 0.65 κ against the calibration set it may still produce scores, but those scores are observational and cannot block a release.",
    "meta": {
      "v": "1.0",
      "owner": "Data & AI Global Practice",
      "date": "2026-09"
    }
  },
  {
    "id": "15-rebaseline-on-frame-change",
    "title": "Frame Change — Why a Rubric Edit Costs a Re-Baseline",
    "layout": "flow",
    "chain": true,
    "stages": [
      {
        "title": "Proposal",
        "nodes": [
          {
            "id": "r-pr",
            "label": "Policy Change",
            "kind": "external",
            "sub": "rubric · dataset · judge"
          },
          {
            "id": "r-rev",
            "label": "Quality Lead Review",
            "kind": "actor"
          }
        ]
      },
      {
        "title": "Impact",
        "nodes": [
          {
            "id": "r-axis",
            "label": "Which Axis Moved",
            "kind": "decision",
            "sub": "1 of 4"
          },
          {
            "id": "r-cost",
            "label": "Re-Baseline Estimate",
            "kind": "app",
            "sub": "suites × examples"
          }
        ]
      },
      {
        "title": "Decision",
        "nodes": [
          {
            "id": "r-appr",
            "label": "Approve or Defer",
            "kind": "decision",
            "sub": "priced choice"
          }
        ]
      },
      {
        "title": "New frame",
        "nodes": [
          {
            "id": "r-new",
            "label": "Frame Registered",
            "kind": "app"
          },
          {
            "id": "r-old",
            "label": "Old Frame Retired",
            "kind": "store",
            "sub": "artefacts kept"
          }
        ]
      },
      {
        "title": "Re-score",
        "nodes": [
          {
            "id": "r-run",
            "label": "Incumbent Re-Scored",
            "kind": "app",
            "sub": "≤ 12 h"
          },
          {
            "id": "r-budget",
            "label": "Charged to Budget",
            "kind": "platform"
          }
        ]
      },
      {
        "title": "Resume",
        "nodes": [
          {
            "id": "r-gate",
            "label": "Gating Resumes",
            "kind": "decision"
          },
          {
            "id": "r-mark",
            "label": "Series Discontinuity Marked",
            "kind": "platform"
          }
        ]
      }
    ],
    "note": "Gating is suspended between frame registration and the incumbent's re-score. That pause is the honest cost of the critical design decision, and the reason the re-baseline budget is a standing line rather than an exception.",
    "meta": {
      "v": "1.0",
      "owner": "Data & AI Global Practice",
      "date": "2026-09"
    }
  },
  {
    "id": "16-deployment-architecture",
    "title": "Model Evaluation Service — Deployment Architecture",
    "layout": "nested",
    "boxes": [
      {
        "title": "Google Cloud · project mes-prod · europe-west4",
        "kind": "boundary",
        "dir": "col",
        "children": [
          {
            "title": "GKE Autopilot · control plane namespace",
            "kind": "cloud",
            "nodes": [
              {
                "id": "k-api",
                "label": "Evaluation API",
                "kind": "integration",
                "sub": "3 pods · 2 zones"
              },
              {
                "id": "k-plan",
                "label": "Run Planner",
                "kind": "app",
                "sub": "3 pods"
              },
              {
                "id": "k-gate",
                "label": "Gate Engine",
                "kind": "decision",
                "sub": "4 pods"
              }
            ]
          },
          {
            "title": "GKE · execution node pool · Spot with on-demand floor",
            "kind": "cloud",
            "nodes": [
              {
                "id": "k-harn",
                "label": "Harness Workers",
                "kind": "app",
                "sub": "0-600 pods"
              },
              {
                "id": "k-sbx",
                "label": "Sandbox Pods",
                "kind": "security",
                "sub": "gVisor · egress deny"
              },
              {
                "id": "k-score",
                "label": "Scoring Workers",
                "kind": "app",
                "sub": "0-200 pods"
              }
            ]
          },
          {
            "title": "Managed data services",
            "kind": "cloud",
            "nodes": [
              {
                "id": "k-sql",
                "label": "Cloud SQL",
                "kind": "store",
                "sub": "HA · PITR"
              },
              {
                "id": "k-bq",
                "label": "BigQuery",
                "kind": "store",
                "sub": "EU multi-region"
              },
              {
                "id": "k-gcs",
                "label": "Cloud Storage",
                "kind": "store",
                "sub": "dual-region · versioned"
              },
              {
                "id": "k-mem",
                "label": "Memorystore",
                "kind": "store",
                "sub": "cache only"
              }
            ]
          },
          {
            "title": "Perimeter",
            "kind": "cloud",
            "nodes": [
              {
                "id": "k-psc",
                "label": "Private Service Connect",
                "kind": "security"
              },
              {
                "id": "k-vpcsc",
                "label": "VPC Service Controls",
                "kind": "security",
                "sub": "data perimeter"
              },
              {
                "id": "k-egr",
                "label": "Egress Proxy",
                "kind": "security",
                "sub": "allowlist"
              }
            ]
          }
        ]
      },
      {
        "title": "Separate projects · blast-radius boundary",
        "kind": "trust",
        "dir": "row",
        "children": [
          {
            "title": "mes-corpus",
            "kind": "plain",
            "nodes": [
              {
                "id": "k-ds",
                "label": "Dataset Versions",
                "kind": "store",
                "sub": "no delete role"
              },
              {
                "id": "k-can",
                "label": "Canary Subset",
                "kind": "store",
                "sub": "restricted"
              }
            ]
          },
          {
            "title": "mes-labels",
            "kind": "plain",
            "nodes": [
              {
                "id": "k-lbl",
                "label": "Human Labels",
                "kind": "store",
                "sub": "rater programme"
              }
            ]
          }
        ]
      }
    ],
    "note": "The corpus and label projects are separate so that no identity in the execution plane can reach them for write. The harness reads datasets and writes traces; it cannot touch a label or delete a dataset version.",
    "meta": {
      "v": "1.0",
      "owner": "Data & AI Global Practice",
      "date": "2026-09"
    }
  },
  {
    "id": "17-release-pipeline",
    "title": "Platform Release Pipeline — and Where the Gate Sits in the Model's",
    "layout": "flow",
    "chain": true,
    "stages": [
      {
        "title": "Source",
        "nodes": [
          {
            "id": "b-code",
            "label": "Platform Code",
            "kind": "external",
            "sub": "Git"
          },
          {
            "id": "b-pol",
            "label": "Suites + Gates",
            "kind": "external",
            "sub": "Git · reviewed"
          }
        ]
      },
      {
        "title": "Build",
        "nodes": [
          {
            "id": "b-cb",
            "label": "Cloud Build",
            "kind": "app"
          },
          {
            "id": "b-ar",
            "label": "Artifact Registry",
            "kind": "store",
            "sub": "signed images"
          }
        ]
      },
      {
        "title": "Platform gates",
        "nodes": [
          {
            "id": "b-unit",
            "label": "Scorer Fixtures",
            "kind": "decision",
            "sub": "regression suite"
          },
          {
            "id": "b-synth",
            "label": "Synthetic Regressed Candidate",
            "kind": "decision",
            "sub": "gate must block it"
          }
        ]
      },
      {
        "title": "Promote",
        "nodes": [
          {
            "id": "b-stg",
            "label": "Staging",
            "kind": "app"
          },
          {
            "id": "b-prod",
            "label": "Production",
            "kind": "app",
            "sub": "harness version bump"
          }
        ]
      },
      {
        "title": "Model release",
        "nodes": [
          {
            "id": "b-cand",
            "label": "Candidate Submitted",
            "kind": "app"
          },
          {
            "id": "b-verd",
            "label": "Verdict Required",
            "kind": "decision",
            "sub": "fail closed"
          }
        ]
      },
      {
        "title": "Exposure",
        "nodes": [
          {
            "id": "b-shadow",
            "label": "Shadow",
            "kind": "app"
          },
          {
            "id": "b-can",
            "label": "Canary",
            "kind": "app",
            "sub": "guardrails armed"
          },
          {
            "id": "b-roll",
            "label": "Progressive Rollout",
            "kind": "app"
          }
        ]
      }
    ],
    "note": "A harness version bump is a frame change, so promoting the platform to production triggers the same re-baseline the policy repository does. The synthetic regressed candidate is the platform's own test that the gate still blocks.",
    "meta": {
      "v": "1.0",
      "owner": "Data & AI Global Practice",
      "date": "2026-09"
    }
  },
  {
    "id": "18-observability",
    "title": "Observability and Operations",
    "layout": "grid",
    "columns": [
      "Emit",
      "Collect",
      "Store",
      "Consume",
      "Act"
    ],
    "rows": [
      {
        "title": "Run health",
        "cells": [
          [
            {
              "id": "o1",
              "label": "OpenTelemetry",
              "kind": "app"
            }
          ],
          [
            {
              "id": "o2",
              "label": "OTel Collector",
              "kind": "integration"
            }
          ],
          [
            {
              "id": "o3",
              "label": "Cloud Monitoring",
              "kind": "store"
            }
          ],
          [
            {
              "id": "o4",
              "label": "Run SLO board",
              "kind": "platform"
            }
          ],
          [
            {
              "id": "o5",
              "label": "Page on gate latency",
              "kind": "security"
            }
          ]
        ]
      },
      {
        "title": "Measurement quality",
        "cells": [
          [
            {
              "id": "o6",
              "label": "Calibration re-score",
              "kind": "platform"
            }
          ],
          [
            {
              "id": "o7",
              "label": "Drift job",
              "kind": "app"
            }
          ],
          [
            {
              "id": "o8",
              "label": "BigQuery",
              "kind": "store"
            }
          ],
          [
            {
              "id": "o9",
              "label": "κ over time",
              "kind": "platform"
            }
          ],
          [
            {
              "id": "o10",
              "label": "Retire the frame",
              "kind": "risk"
            }
          ]
        ]
      },
      {
        "title": "Gate behaviour",
        "cells": [
          [
            {
              "id": "o11",
              "label": "Verdict events",
              "kind": "app"
            }
          ],
          [
            {
              "id": "o12",
              "label": "Pub/Sub",
              "kind": "queue"
            }
          ],
          [
            {
              "id": "o13",
              "label": "Verdict table",
              "kind": "store"
            }
          ],
          [
            {
              "id": "o14",
              "label": "Block + waiver rates",
              "kind": "platform"
            }
          ],
          [
            {
              "id": "o15",
              "label": "Escalate policy defect",
              "kind": "security"
            }
          ]
        ]
      },
      {
        "title": "Corpus health",
        "cells": [
          [
            {
              "id": "o16",
              "label": "Distribution sampler",
              "kind": "app"
            }
          ],
          [
            {
              "id": "o17",
              "label": "Staleness job",
              "kind": "app"
            }
          ],
          [
            {
              "id": "o18",
              "label": "BigQuery",
              "kind": "store"
            }
          ],
          [
            {
              "id": "o19",
              "label": "Drift + canary gap",
              "kind": "platform"
            }
          ],
          [
            {
              "id": "o20",
              "label": "Demote to observational",
              "kind": "risk"
            }
          ]
        ]
      },
      {
        "title": "Cost",
        "cells": [
          [
            {
              "id": "o21",
              "label": "Per-run metering",
              "kind": "app"
            }
          ],
          [
            {
              "id": "o22",
              "label": "Billing export",
              "kind": "integration"
            }
          ],
          [
            {
              "id": "o23",
              "label": "BigQuery",
              "kind": "store"
            }
          ],
          [
            {
              "id": "o24",
              "label": "Cost per candidate",
              "kind": "platform"
            }
          ],
          [
            {
              "id": "o25",
              "label": "Halt at ceiling",
              "kind": "security"
            }
          ]
        ]
      },
      {
        "title": "Online truth",
        "cells": [
          [
            {
              "id": "o26",
              "label": "Serving telemetry",
              "kind": "external"
            }
          ],
          [
            {
              "id": "o27",
              "label": "Guardrail evaluator",
              "kind": "app"
            }
          ],
          [
            {
              "id": "o28",
              "label": "BigQuery",
              "kind": "store"
            }
          ],
          [
            {
              "id": "o29",
              "label": "Offline-online correlation",
              "kind": "platform"
            }
          ],
          [
            {
              "id": "o30",
              "label": "Auto-rollback",
              "kind": "security"
            }
          ]
        ]
      }
    ],
    "note": "Measurement quality is monitored as a production signal, not as a research activity. A judge whose agreement has drifted is an incident with the same shape as a failing dependency.",
    "meta": {
      "v": "1.0",
      "owner": "Data & AI Global Practice",
      "date": "2026-09"
    }
  },
  {
    "id": "19-candidate-lifecycle",
    "title": "The Evidence Loop — From Candidate to Corpus and Back",
    "layout": "cycle",
    "centre": {
      "label": "Evaluation",
      "sub": "25 / week"
    },
    "nodes": [
      {
        "id": "y1",
        "label": "Submit",
        "kind": "app",
        "sub": "config pinned"
      },
      {
        "id": "y2",
        "label": "Measure",
        "kind": "app",
        "sub": "frame-bound"
      },
      {
        "id": "y3",
        "label": "Decide",
        "kind": "decision",
        "sub": "per slice"
      },
      {
        "id": "y4",
        "label": "Expose",
        "kind": "app",
        "sub": "shadow → canary"
      },
      {
        "id": "y5",
        "label": "Observe",
        "kind": "platform",
        "sub": "guardrails"
      },
      {
        "id": "y6",
        "label": "Capture",
        "kind": "store",
        "sub": "failures → suites"
      }
    ],
    "ringLabels": [
      "candidate id",
      "scores + evidence",
      "verdict",
      "live traffic",
      "online outcome",
      "new regression set"
    ],
    "note": "The loop closes only if step 6 actually happens. A production failure that does not become an example is a regression the gate will miss again.",
    "meta": {
      "v": "1.0",
      "owner": "Data & AI Global Practice",
      "date": "2026-09"
    }
  },
  {
    "id": "20-security-trust-zones",
    "title": "Security Architecture — Trust Zones",
    "layout": "zones",
    "zones": [
      {
        "title": "Untrusted · model-generated content",
        "kind": "trust",
        "nodes": [
          {
            "id": "v-out",
            "label": "Candidate Output",
            "kind": "risk",
            "sub": "untrusted text"
          },
          {
            "id": "v-tool",
            "label": "Generated Tool Calls",
            "kind": "risk",
            "sub": "at volume"
          }
        ]
      },
      {
        "title": "Sandbox · no route to production",
        "kind": "trust",
        "nodes": [
          {
            "id": "v-sbx",
            "label": "Tool Sandbox",
            "kind": "security",
            "sub": "gVisor · egress deny"
          },
          {
            "id": "v-stub",
            "label": "Stubbed Tools",
            "kind": "app",
            "sub": "no side effects"
          }
        ]
      },
      {
        "title": "Execution · workload identity only",
        "kind": "trust",
        "nodes": [
          {
            "id": "v-harn",
            "label": "Harness Workers",
            "kind": "app",
            "sub": "read corpus · write traces"
          },
          {
            "id": "v-egr",
            "label": "Egress Proxy",
            "kind": "security",
            "sub": "provider allowlist"
          }
        ]
      },
      {
        "title": "Control · separation of duties",
        "kind": "trust",
        "nodes": [
          {
            "id": "v-gate",
            "label": "Gate Engine",
            "kind": "decision",
            "sub": "writes verdicts"
          },
          {
            "id": "v-pol",
            "label": "Policy Repository",
            "kind": "security",
            "sub": "two-person review"
          }
        ]
      },
      {
        "title": "Restricted · production-derived data",
        "kind": "trust",
        "nodes": [
          {
            "id": "v-ds",
            "label": "Dataset Versions",
            "kind": "store",
            "sub": "VPC-SC perimeter"
          },
          {
            "id": "v-lbl",
            "label": "Human Labels",
            "kind": "store",
            "sub": "separate project"
          },
          {
            "id": "v-tr",
            "label": "Run Traces",
            "kind": "store",
            "sub": "access logged"
          }
        ]
      }
    ],
    "flows": [
      {
        "from": "v-out",
        "to": "v-sbx",
        "label": "executed only here",
        "kind": "sync"
      },
      {
        "from": "v-sbx",
        "to": "v-harn",
        "label": "result + trace",
        "kind": "sync"
      },
      {
        "from": "v-harn",
        "to": "v-egr",
        "label": "inference calls",
        "kind": "sync"
      },
      {
        "from": "v-harn",
        "to": "v-tr",
        "label": "write traces",
        "kind": "async"
      },
      {
        "from": "v-pol",
        "to": "v-gate",
        "label": "gate policy",
        "kind": "sync"
      },
      {
        "from": "v-ds",
        "to": "v-harn",
        "label": "read examples",
        "kind": "sync"
      }
    ],
    "note": "The harness executes text a model wrote, against tools, thousands of times an hour. Treating that as an untrusted workload rather than as an internal batch job is the security decision the rest of the zoning follows from.",
    "meta": {
      "v": "1.0",
      "owner": "Data & AI Global Practice",
      "date": "2026-09"
    }
  },
  {
    "id": "21-identity-and-access",
    "title": "Identity and Access — Who May Change a Gate",
    "layout": "sequence",
    "lifelines": [
      {
        "id": "x-eng",
        "label": "ML Engineer",
        "kind": "actor"
      },
      {
        "id": "x-git",
        "label": "Policy Repository",
        "kind": "security"
      },
      {
        "id": "x-rev",
        "label": "Second Reviewer",
        "kind": "actor"
      },
      {
        "id": "x-ci",
        "label": "Cloud Build",
        "kind": "app"
      },
      {
        "id": "x-wif",
        "label": "Workload Identity",
        "kind": "security"
      },
      {
        "id": "x-gate",
        "label": "Gate Engine",
        "kind": "decision"
      },
      {
        "id": "x-aud",
        "label": "Audit Log",
        "kind": "store"
      }
    ],
    "messages": [
      {
        "from": "x-eng",
        "to": "x-git",
        "label": "propose gate change",
        "kind": "call"
      },
      {
        "from": "x-git",
        "to": "x-git",
        "label": "author ≠ approver",
        "kind": "self"
      },
      {
        "from": "x-git",
        "to": "x-rev",
        "label": "request review",
        "kind": "async"
      },
      {
        "from": "x-rev",
        "to": "x-git",
        "label": "approve",
        "kind": "return"
      },
      {
        "from": "x-git",
        "to": "x-ci",
        "label": "merged",
        "kind": "async"
      },
      {
        "from": "x-ci",
        "to": "x-wif",
        "label": "assert identity",
        "kind": "call"
      },
      {
        "from": "x-wif",
        "to": "x-ci",
        "label": "short-lived token",
        "kind": "return"
      },
      {
        "from": "x-ci",
        "to": "x-gate",
        "label": "publish policy version",
        "kind": "call"
      },
      {
        "from": "x-gate",
        "to": "x-aud",
        "label": "who · what · when",
        "kind": "async"
      },
      {
        "from": "x-eng",
        "to": "x-gate",
        "label": "waive a safety gate",
        "kind": "call"
      },
      {
        "from": "x-gate",
        "to": "x-eng",
        "label": "refused — never waivable",
        "kind": "error"
      }
    ],
    "note": "There are no long-lived credentials anywhere in this path, and no identity that can both author a gate and approve it. The last exchange is a requirement, not an error case: a safety guardrail has no waiver path to misuse.",
    "meta": {
      "v": "1.0",
      "owner": "Data & AI Global Practice",
      "date": "2026-09"
    }
  }
]