Spot Capacity Orchestrator  ·  View 12 of 32  ·  3 · Structure

The Contract Is the Interface

Each field of the interruption contract, how it is checked before it is accepted, whether the node holds it, what it decides, and what a breach looks like.

Editable source SVG draw.io All views
Checked at compile Held on the node Decides A breach shows as Drain budget ≤ 115 s, or advisory drain Yes · grace per unit Eviction grace Drain overrun Checkpoint mode Final write fits budget Yes · signal to send Resume or requeue Wasted work Restart semantics Declared, never inferred Yes Output commit or retry Duplicate is a defect Tolerated interruption Above best pool rate Eligible pools Breach alarm Guaranteed floor Tier minimum · 2 signatures Floor keeper Minutes below floor Deadline Reachable at floor speed Deadline-risk fallback Missed deadline Spend authority Named approver exists Automatic spend cap Escalation, not spend The Contract Is the Interface — Each Field, Where It Acts Empty cells are deliberate: only fields the notice path needs are cached on the node, so a stale cache can never change placement or spend. v 1.0 · owner Compute Platform Architecture · date 2026-09

Decisions

  • Behaviour is a function of the contract and nothing else. To change how a workload drains, falls back or is placed, someone changes a reviewed file; the platform never infers tolerance from a workload that happened to survive.
  • Five tiers cover most workloads: T1 deadline (30% floor, checkpoints, capped automatic fallback), T2 checkpointed long-running (10% floor), T3 requeue (short units, no floor), T4 stateless service (30% floor, connection drain) and T5 opportunistic (no floor, never falls back). A bespoke contract is allowed and reviewed by the platform team.
  • Only the three fields the notice path needs are cached on the node. A stale node cache can therefore never change placement or spend.

Feasibility checks with numbers

  • A drain budget above 115 s needs advisory drain, which is Phase 2, so the MVP rejects it.
  • A requeue contract's longest unit must satisfy rate × unit ÷ 2 ≤ 3% wasted work. At the 4% hourly baseline that is 90 minutes; if the workload declares tolerance of a 12% pool, 30 minutes.
  • A declared final checkpoint must fit inside the drain budget at the measured store throughput, not the hoped-for one.

Risk

  • Owners will over-declare tolerance to get the discount. The breach alarm and, in Phase 3, contract-priced chargeback make over-declaration visible and then expensive (ADR-27).
◀  Integration Surface All views Four Data Classes  ▶
Solution Architecture v1.0 · Compute Platform Architecture · 2026-09 · 32 views · open source, fully on-premises12-contract-to-behaviour