Spot Capacity Orchestrator  ·  View 13 of 32  ·  4 · Data

Four Data Classes

Contracts, fleet state, lifecycle events and checkpoints are stored apart because losing each costs something different.

Editable source SVG draw.io All views
Held by the orchestrator, or deliberately not Contracts and policy · RPO 0 Contract repository Forgejo · mirrored Compiled bundles signed · versioned Fleet and pool state · rebuildable Instance tags provider · authoritative Fleet state PostgreSQL · Patroni Lifecycle events · 400 days Event stream Kafka · RF 3 Event history ClickHouse · 400 d Cost archive Ceph Object Lock · 7 y Checkpoints · owned by the workload Workload key OpenBao transit Checkpoint bucket 3 gen or 7 d on merge rebuild ≤ 5 min ≤ 30 s monthly SSE-KMS Four Data Classes — Separated by What Losing Each Costs Data store Security / platform External / third party Queue / topic synchronous batch The orchestrator's identity has no read permission on any checkpoint bucket. It sees object counts and bytes from RGW usage statistics, never contents. v 1.0 · owner Compute Platform Architecture · date 2026-09

Recovery obligations

  • Contracts: RPO 0, because Git is the system of record and is mirrored to a second region.
  • Fleet and pool state: rebuilt from provider tags within 5 minutes with no operator input. PostgreSQL holds it for speed, not for truth.
  • Lifecycle events: RPO ≤ 30 s for the stream, 400 days queryable, cost attribution kept 7 years in Object Lock for finance.
  • Checkpoints: RPO 0 for committed generations, RTO ≤ 15 min, 3 generations or 7 days. Unavailability degrades to work returning to the queue, never to silent loss.

Why tags are authoritative

  • Every instance carries sco:workload, sco:pool, sco:partition and sco:plan-gen. Losing the database therefore loses history and speed, never the knowledge of what the orchestrator owns, and a termination is only ever issued for an instance whose tags and database row agree.

What the platform cannot see

  • Checkpoint contents. Each bucket is encrypted with the workload's own transit key and the orchestrator's identity has no read grant. It sees bytes and object counts from RGW usage statistics, which is all the ledger needs.
◀  The Contract Is the Interface All views Data Model  ▶
Solution Architecture v1.0 · Compute Platform Architecture · 2026-09 · 32 views · open source, fully on-premises13-four-data-classes