Prompt & Configuration Registry  ·  View 16 of 21  ·  Runtime

Degradation Paths

Seven dependencies, and what each one costs when it goes. Only one costs availability.

Editable source SVG draw.io All views
Healthy Degraded Failed Recovery Control plane authoring, gates, promotion read-only authoring no new releases resumes, no restart Pointer store (etcd) linearisable pointer writes poll backstop stale fleet frozen on last digest converges on next poll Change bus (NATS) notice in ≤ 3 s propagation falls to 30 s poll is the only path no replay needed Artefact store pull by digest new pods use baked default running pods unaffected pull on next notice Signature / trust verified on load FAIL CLOSED: reject bundle keep previous, page someone Exposure pipeline 500 M events/day sampled down dropped, count kept readout declares loss rate Resolution path p99 ≤ 3 ms in-process staleness metric rising never fails: serves stale alert at 15 min stale Degradation — What Each Dependency Costs When It Goes Every row gives up freshness, fidelity or the ability to change. Only the trust row gives up availability, and it does so deliberately. v 1.0 · owner Platform Architecture · d 2026-09

The rule this view enforces

  • Every row gives up freshness, fidelity or the ability to change. Only the trust row gives up availability, and it does so deliberately: an unverified bundle is refused however unavailable that makes things.
  • The resolution row never reaches Failed. "Serves stale indefinitely" is the designed behaviour, and staleness is exported so that indefinite does not mean invisible.
  • When a new dependency is proposed for the resolution path, the question this view asks is: which dimension will its outage cost? If the answer is availability, it does not belong there.

Assumptions

  • A resolver may serve a bundle up to 24 h stale before it is marked degraded; an alert fires at 15 minutes of staleness (stated assumptions).
  • Exposure loss is acceptable and counted. The audit ledger is not on this table because it has no degraded mode: it is written before the promotion is acknowledged.

Risks

  • Indefinite fail-static is a real posture with a real cost: a key revoked for a safety reason keeps serving on a partitioned resolver until it reconnects. The 15-minute staleness alert is what bounds it in practice.
  • A signing-key rotation mishandled turns the fail-closed row into a fleet-wide outage. Trust-bundle distribution must lead key rotation, with the old key trusted throughout the overlap (ADR-12).
◀  Experiment Assignment and Exposure All views Deployment Architecture  ▶
Solution Architecture v1.0 · open source, self-hosted on Kubernetes · Platform Architecture · 2026-09 · 21 views · 17 architecture decision records16-degradation-paths