SLO and Error Budget Service  ·  View 10 of 21  ·  Data

Data Flow — Cube to Verdict

How a pair of counters becomes a signed claim, and where the only irreversible step is.

Editable source SVG draw.io All views
Emit Recording rules status × latency bucket Probe results journey checks Transport Indicator stream Event Hubs, partitioned Normalise Lateness gate 10 min horizon Event-time bucketer idempotent per bucket Quarantine typed reason Measured truth Minute buckets good, valid, coverage Derive Window reduce counters summed Exclusion overlay annotation, not deletion Burn rate spend per window Derived state Budget projection watermarked Publish Signed verdict with coverage Window snapshot immutable at close Data Flow — Outcome Cube to Published Verdict Security / platform External / third party Queue / topic Decision point Application we own Risk / gap Data store Interface / broker Good and valid counts stay separate the whole way across; no ratio is stored anywhere. The only irreversible step is the window close, and the only lossy one is a bucket that arrives past the horizon — which becomes a coverage deficit rather than a dropped event. v 1.0 · owner Reliability Architecture · date 2026-10

Decisions

  • Good and valid counts stay separate the whole way across. No ratio is stored anywhere, because a stored ratio cannot be re-aggregated across windows and destroys the information a recompute needs (ADR-01).
  • The source emits a low-cardinality outcome cube — status class by latency bucket — rather than a single good/valid pair, so a predicate change over the declared dimensions is still recomputable at pre-aggregation cost (ADR-03).
  • Exclusions are an overlay applied at derivation, not an edit to the buckets. The unexcluded figure stays retrievable forever (ADR-11).

Targets

  • Lateness horizon 10 minutes, after which a bucket closes and later data becomes a coverage deficit rather than a dropped event — assumed.
  • 1.73 million minute buckets written per day at launch (1,200 SLOs × 1,440 minutes) — assumed.
  • Recompute determinism: identical inputs and definition version reproduce identical figures.

Risks

  • The cube's dimensions are chosen once, upstream, by a team that does not own this platform. A dimension nobody thought to emit cannot be recovered by any amount of recompute (ADR-03).
  • The window close is the only irreversible step in the flow. A definition error discovered after a close produces a corrected current figure and a sealed wrong one, which is the honest outcome but needs explaining.
◀  Integration Surface All views Storage Zones  ▶
Solution Architecture v1.0 · Microsoft Azure · Reliability Architecture · 2026-10 · 21 views · 17 architecture decision records10-indicator-to-verdict-data-flow