Prompt & Configuration Registry  ·  View 14 of 21  ·  Runtime

Propagation and Convergence

Two resolvers, one of which never hears the notice — and converges anyway.

Editable source SVG draw.io All views
Pointer controller etcd NATS JetStream Resolver A Resolver B (partitioned) Artefact store Convergence metric 1. compare-and-set pointer 2. committed, rev 4812 3. publish notice 4. key K → digest d9f 5. pull by digest 6. verify signature 7. serving d9f (t+3 s) 9. poll backstop, 30 s 10. pull by digest 11. serving d9f (t+41 s) 12. 99% at 8 s, 100% at 41 s Propagation — How a Change Reaches a Fleet, and How Anyone Knows The poll is what guarantees convergence; the notice only makes it fast. Losing the bus costs latency, never correctness. v 1.0 · owner Platform Architecture · d 2026-09

The decision this view exists to defend

  • The poll is what guarantees convergence; the notice only makes it fast. Losing the bus costs latency, never correctness (ADR-05).
  • Resolver B is drawn partitioned on purpose. A propagation design that only shows the happy path has not been designed, it has been described.
  • Convergence is a published number — 99% within 10 s, 100% within 60 s — because a propagation SLO nobody measures is a sentence in a document.

Assumptions

  • Poll interval 30 s in production, tunable per environment; 100% convergence within 60 s follows from it with margin (stated assumption).
  • Every resolver reports the digest it is serving, which is what makes coverage measurable rather than inferred from the bus's own delivery counts.

Risks

  • Version skew is normal and is drawn as such, but it means two users can get different behaviour within the same minute. For an A/B test that is fine; for a safety fix it is a window, and the rollback SLO is what bounds it.
  • A resolver that reports a digest it is not actually serving — because verification failed after reporting — would make the coverage metric lie. Report-after-verify is a conformance requirement on the SDK.