Search Indexing Service · View 08 of 21 · Structure
Decisions
- Control, write, search and assurance are separate planes: the admin console cannot take the indexing path down, and the query path does not depend on the registry being writable.
- Only the capture tier faces the sources and only the query service faces callers. Assembly, writers and the cluster have no public surface.
- Assembly state — applied source versions, join partners, parent→children mapping, enrichment cache — is a strongly consistent key-value store, separate from both the log and the index.
- The reconciler is its own component with its own schedule, not a mode of the assembly workers it is checking.
Assumptions
- One OpenSearch domain across three availability zones, 220 GB primary with two replicas, sized for a second copy of the largest index during a rebuild.
- ECS Fargate for every tier, chosen so that reindex capacity can be rented for four hours rather than owned.
Omitted
- Twelve internal edges, carried by views 10, 13, 14 and 19.
- VPC endpoints, subnet layout and the bastion path, which view 16 and view 19 cover between them.
