[
  {
    "id": "01-system-context",
    "title": "Webhook Delivery Service — System Context",
    "layout": "context",
    "canvas": {
      "width": 1700
    },
    "system": {
      "label": "Webhook Delivery Service",
      "sub": "Product events → customer endpoints"
    },
    "groups": [
      {
        "side": "left",
        "title": "Inside the product",
        "nodes": [
          {
            "id": "prod",
            "label": "Product Services",
            "sub": "transactional outbox",
            "kind": "app",
            "rel": "domain events",
            "dir": "in"
          },
          {
            "id": "papi",
            "label": "Product Public API",
            "sub": "callback fetches",
            "kind": "integration",
            "rel": "thin-event lookups",
            "dir": "out"
          }
        ]
      },
      {
        "side": "top",
        "title": "People",
        "nodes": [
          {
            "id": "dev",
            "label": "Integration Developer",
            "sub": "customer side",
            "kind": "actor",
            "rel": "registers endpoints",
            "dir": "in"
          },
          {
            "id": "sre",
            "label": "Platform SRE",
            "kind": "actor",
            "rel": "operates",
            "dir": "in"
          }
        ]
      },
      {
        "side": "right",
        "title": "Customer side",
        "nodes": [
          {
            "id": "ep",
            "label": "Customer Endpoint",
            "sub": "40,000 registered",
            "kind": "external",
            "rel": "signed HTTPS POST",
            "dir": "out"
          },
          {
            "id": "mon",
            "label": "Customer Monitoring",
            "kind": "external",
            "rel": "delivery health API",
            "dir": "out"
          }
        ]
      },
      {
        "side": "bottom",
        "title": "Platform dependencies",
        "nodes": [
          {
            "id": "kms",
            "label": "AWS KMS",
            "sub": "signing material",
            "kind": "security",
            "rel": "wrap / unwrap",
            "dir": "out"
          },
          {
            "id": "idp",
            "label": "Tenant Identity",
            "sub": "SSO",
            "kind": "external",
            "rel": "console auth",
            "dir": "in"
          },
          {
            "id": "obs",
            "label": "Observability Platform",
            "kind": "platform",
            "rel": "metrics, traces",
            "dir": "out",
            "kind2": "async"
          }
        ]
      }
    ],
    "note": "Out of scope: event production, what a consumer does after 200 OK, and the customer's own secret storage.",
    "meta": {
      "v": "1.0",
      "owner": "Integration Platform Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "02-high-level-architecture",
    "title": "Webhook Delivery Service — High-Level Architecture",
    "layout": "flow",
    "canvas": {
      "width": 1780
    },
    "chain": true,
    "align": "middle",
    "stages": [
      {
        "title": "Emit",
        "nodes": [
          {
            "id": "prod",
            "label": "Product Service",
            "sub": "outbox publisher",
            "kind": "app"
          }
        ]
      },
      {
        "title": "Accept",
        "nodes": [
          {
            "id": "intake",
            "label": "Intake API",
            "sub": "ack ≤ 15 ms p99",
            "kind": "integration"
          },
          {
            "id": "estore",
            "label": "Event Store",
            "sub": "DynamoDB + S3, 30 d",
            "kind": "store"
          }
        ]
      },
      {
        "title": "Fan out",
        "nodes": [
          {
            "id": "match",
            "label": "Subscription Matcher",
            "sub": "type + entitlement",
            "kind": "app"
          },
          {
            "id": "plan",
            "label": "Delivery Planner",
            "sub": "idempotency key",
            "kind": "app"
          }
        ]
      },
      {
        "title": "Isolate",
        "nodes": [
          {
            "id": "queues",
            "label": "Per-Endpoint Queues",
            "sub": "SQS FIFO, 1 group/endpoint",
            "kind": "queue"
          },
          {
            "id": "dlq",
            "label": "Dead-Letter Store",
            "sub": "redrive, 30 d",
            "kind": "queue"
          }
        ]
      },
      {
        "title": "Deliver",
        "nodes": [
          {
            "id": "worker",
            "label": "Delivery Workers",
            "sub": "Fargate",
            "kind": "app"
          },
          {
            "id": "signer",
            "label": "Signer",
            "sub": "HMAC under KMS",
            "kind": "security",
            "icon": "fa5_signature"
          },
          {
            "id": "nat",
            "label": "Egress NAT",
            "sub": "published /28",
            "kind": "platform"
          }
        ]
      },
      {
        "title": "Receive",
        "nodes": [
          {
            "id": "ep",
            "label": "Customer Endpoint",
            "sub": "HTTPS, allowlisted",
            "kind": "external"
          }
        ]
      },
      {
        "title": "Account",
        "nodes": [
          {
            "id": "alog",
            "label": "Attempt Log",
            "sub": "90 d, per endpoint",
            "kind": "store"
          },
          {
            "id": "console",
            "label": "Console & API",
            "sub": "replay, health",
            "kind": "integration"
          }
        ]
      }
    ],
    "edges": [
      {
        "from": "worker",
        "to": "dlq",
        "label": "exhausted",
        "kind": "error",
        "route": "gutter"
      },
      {
        "from": "console",
        "to": "queues",
        "label": "replay",
        "kind": "async",
        "route": "gutter"
      }
    ],
    "note": "Nothing after the intake acknowledgement is on the product's write path.",
    "meta": {
      "v": "1.0",
      "owner": "Integration Platform Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "03-actors-and-journeys",
    "title": "Who This Is For, and What They Get To Do",
    "layout": "actors",
    "canvas": {
      "width": 1740
    },
    "groups": [
      {
        "title": "The customer's people",
        "kind": "boundary",
        "actors": [
          {
            "id": "dev",
            "label": "Integration Developer",
            "sub": "8,000 tenants",
            "kind": "actor",
            "goal": "Get my first webhook working in an afternoon, and see exactly why it failed when it doesn't.",
            "journeys": [
              {
                "id": "j-integrate",
                "label": "Integrate a new endpoint"
              },
              {
                "label": "Inspect a failed delivery"
              },
              {
                "label": "Rotate a signing secret"
              }
            ]
          },
          {
            "id": "oncall",
            "label": "Customer On-Call",
            "sub": "owns the receiver",
            "kind": "actor",
            "goal": "Know my integration is broken before my users tell me, and catch up without losing anything.",
            "journeys": [
              {
                "id": "j-outage",
                "label": "Recover from an outage"
              },
              {
                "label": "Replay a backlog"
              },
              {
                "label": "Alert on delivery health"
              }
            ]
          }
        ]
      },
      {
        "title": "Inside the product",
        "kind": "boundary",
        "actors": [
          {
            "id": "pe",
            "label": "Product Engineer",
            "sub": "emits events",
            "kind": "actor",
            "goal": "Publish a new event type without having to learn how delivery works.",
            "journeys": [
              {
                "label": "Register an event type"
              },
              {
                "label": "Emit from the outbox"
              }
            ]
          },
          {
            "id": "sre",
            "label": "Platform SRE",
            "sub": "on call for delivery",
            "kind": "actor",
            "goal": "Tell in one screen whether a delivery-rate drop is ours or a customer's.",
            "journeys": [
              {
                "label": "Triage a rate drop"
              },
              {
                "label": "Drain a region"
              },
              {
                "label": "Change the egress IP set"
              }
            ]
          },
          {
            "id": "sec",
            "label": "Security Engineer",
            "sub": "reviews the egress path",
            "kind": "actor",
            "goal": "Be certain a delivery worker can never reach anything inside the estate.",
            "journeys": [
              {
                "label": "Review SSRF controls"
              },
              {
                "label": "Audit a secret rotation"
              }
            ]
          }
        ]
      },
      {
        "title": "Machines and partners",
        "kind": "cloud",
        "actors": [
          {
            "id": "ep",
            "label": "Customer Endpoint",
            "sub": "40,000 registered",
            "kind": "external",
            "goal": "Receive a request I can verify, and not be flooded the moment I come back up.",
            "journeys": [
              {
                "label": "Verify a signature"
              },
              {
                "label": "Return 2xx or 429"
              }
            ]
          },
          {
            "id": "mon",
            "label": "Customer Monitoring",
            "sub": "their dashboard",
            "kind": "external",
            "goal": "Alert my own team on delivery failure without asking support.",
            "journeys": [
              {
                "label": "Poll delivery health"
              }
            ]
          }
        ]
      }
    ],
    "note": "Two journeys carry the value: the first integration, and the outage the platform has to survive on the customer's behalf.",
    "meta": {
      "v": "1.0",
      "owner": "Integration Platform Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "04-journey-integrate-endpoint",
    "title": "Journey — Integration Developer, First Webhook",
    "layout": "journey",
    "canvas": {
      "width": 1620
    },
    "actor": {
      "label": "Integration Developer",
      "sub": "first integration",
      "goal": "Get a signed event arriving in my staging service this afternoon",
      "trigger": "A feature needs to react to payments in near-real time",
      "success": "Events arriving, verified, and a page that proves it"
    },
    "phases": [
      {
        "title": "Register",
        "sub": "console or API"
      },
      {
        "title": "Verify",
        "moment": true
      },
      {
        "title": "First event"
      },
      {
        "title": "First failure",
        "moment": true
      },
      {
        "title": "Go live"
      }
    ],
    "lanes": [
      {
        "title": "What they do",
        "kind": "step",
        "cells": [
          [
            {
              "label": "Creates an endpoint"
            },
            {
              "label": "Picks event types"
            }
          ],
          [
            {
              "label": "Copies the secret"
            },
            {
              "label": "Writes verification"
            }
          ],
          [
            {
              "label": "Fires a test event"
            }
          ],
          [
            {
              "label": "Opens the attempt log"
            }
          ],
          [
            {
              "label": "Enables in production"
            }
          ]
        ]
      },
      {
        "title": "How it feels",
        "kind": "emotion",
        "levels": [
          "Confident",
          "Fine",
          "Stuck"
        ],
        "points": [
          1,
          0,
          2,
          1,
          2
        ]
      },
      {
        "title": "Where it hurts",
        "kind": "pain",
        "cells": [
          [],
          [
            {
              "label": "Signature will not match"
            },
            {
              "label": "No reason given"
            }
          ],
          [],
          [
            {
              "label": "Their 4xx looks like ours"
            }
          ],
          []
        ]
      },
      {
        "title": "What the platform gives",
        "kind": "system",
        "cells": [
          [
            {
              "label": "Validation challenge"
            }
          ],
          [
            {
              "label": "Canonical string, published"
            },
            {
              "label": "Verify examples"
            }
          ],
          [
            {
              "label": "Request inspector"
            }
          ],
          [
            {
              "label": "Outcome class + reason"
            }
          ],
          [
            {
              "label": "Delivery health API"
            }
          ]
        ]
      }
    ],
    "chain": true,
    "note": "The trough is verification. It is the one phase where the platform's documentation is the product.",
    "meta": {
      "v": "1.0",
      "owner": "Integration Platform Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "05-journey-endpoint-outage",
    "title": "Journey — Customer On-Call, Endpoint Outage",
    "layout": "journey",
    "canvas": {
      "width": 1620
    },
    "actor": {
      "label": "Customer On-Call",
      "sub": "owns the receiving service",
      "goal": "Lose nothing while my service is down, and catch up safely",
      "trigger": "Their own 02:00 deploy takes the receiver offline",
      "success": "Every event delivered once, nothing written to their ledger twice"
    },
    "phases": [
      {
        "title": "Outage begins"
      },
      {
        "title": "Retries accrue"
      },
      {
        "title": "Notified",
        "moment": true
      },
      {
        "title": "Recover"
      },
      {
        "title": "Catch up",
        "moment": true
      }
    ],
    "lanes": [
      {
        "title": "What they do",
        "kind": "step",
        "cells": [
          [
            {
              "label": "Deploys a bad build"
            }
          ],
          [
            {
              "label": "Asleep"
            }
          ],
          [
            {
              "label": "Reads the alert"
            }
          ],
          [
            {
              "label": "Rolls back"
            }
          ],
          [
            {
              "label": "Watches the backlog"
            }
          ]
        ]
      },
      {
        "title": "How it feels",
        "kind": "emotion",
        "levels": [
          "Calm",
          "Fine",
          "Alarmed"
        ],
        "points": [
          2,
          1,
          0,
          1,
          2
        ]
      },
      {
        "title": "Where it hurts",
        "kind": "pain",
        "cells": [
          [],
          [
            {
              "label": "No idea events queued"
            }
          ],
          [
            {
              "label": "Woken at 02:00"
            }
          ],
          [],
          [
            {
              "label": "Replay could re-flood"
            }
          ]
        ]
      },
      {
        "title": "What the platform does",
        "kind": "system",
        "cells": [
          [
            {
              "label": "Classifies as retryable"
            }
          ],
          [
            {
              "label": "Backoff, backlog held"
            },
            {
              "label": "Circuit opens at 20"
            }
          ],
          [
            {
              "label": "Alert on first dead letter"
            }
          ],
          [
            {
              "label": "Single probe succeeds"
            }
          ],
          [
            {
              "label": "Ramp 10% → 100%"
            },
            {
              "label": "Same idempotency key"
            }
          ]
        ]
      }
    ],
    "chain": true,
    "note": "The platform gives up loudly at the first dead letter, not at the hundredth.",
    "meta": {
      "v": "1.0",
      "owner": "Integration Platform Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "06-layered-architecture",
    "title": "Layered Architecture",
    "layout": "bands",
    "canvas": {
      "width": 1700
    },
    "layerHeaderWidth": 170,
    "bands": [
      {
        "name": "Consumer surface",
        "nodes": [
          {
            "id": "console",
            "label": "Developer Console",
            "kind": "integration",
            "icon": "aws_aws-management-console"
          },
          {
            "id": "mgmtapi",
            "label": "Management API",
            "sub": "subscriptions, secrets",
            "kind": "integration",
            "icon": "aws_amazon-api-gateway"
          },
          {
            "id": "histapi",
            "label": "Delivery History API",
            "sub": "attempts, health",
            "kind": "integration",
            "icon": "aws_amazon-api-gateway"
          },
          {
            "id": "docs",
            "label": "Verification Examples",
            "sub": "6 languages",
            "kind": "app"
          }
        ]
      },
      {
        "name": "Control plane",
        "nodes": [
          {
            "id": "subsvc",
            "label": "Subscription Service",
            "sub": "strongly consistent",
            "kind": "app"
          },
          {
            "id": "secsvc",
            "label": "Secret Service",
            "sub": "2 active per endpoint",
            "kind": "security"
          },
          {
            "id": "health",
            "label": "Endpoint Health",
            "sub": "circuits, auto-disable",
            "kind": "app"
          },
          {
            "id": "replay",
            "label": "Replay Service",
            "sub": "rate-limited",
            "kind": "app"
          }
        ]
      },
      {
        "name": "Capture plane",
        "nodes": [
          {
            "id": "intake",
            "label": "Intake API",
            "sub": "ack on durability",
            "kind": "integration"
          },
          {
            "id": "estore",
            "label": "Event Store",
            "kind": "store"
          }
        ]
      },
      {
        "name": "Fan-out plane",
        "nodes": [
          {
            "id": "match",
            "label": "Subscription Matcher",
            "kind": "app"
          },
          {
            "id": "ent",
            "label": "Entitlement Filter",
            "sub": "evaluated at fan-out",
            "kind": "security"
          },
          {
            "id": "plan",
            "label": "Delivery Planner",
            "sub": "fair scheduling",
            "kind": "app"
          }
        ]
      },
      {
        "name": "Delivery plane",
        "nodes": [
          {
            "id": "queues",
            "label": "Per-Endpoint Queues",
            "kind": "queue"
          },
          {
            "id": "worker",
            "label": "Delivery Workers",
            "kind": "app"
          },
          {
            "id": "signer",
            "label": "Signer",
            "kind": "security",
            "icon": "fa5_signature"
          },
          {
            "id": "guard",
            "label": "SSRF Guard",
            "kind": "security"
          },
          {
            "id": "egress",
            "label": "Egress NAT",
            "kind": "platform"
          }
        ]
      },
      {
        "name": "Evidence",
        "nodes": [
          {
            "id": "alog",
            "label": "Attempt Log",
            "kind": "store"
          },
          {
            "id": "dlq",
            "label": "Dead-Letter Store",
            "kind": "store"
          },
          {
            "id": "audit",
            "label": "Audit Log",
            "sub": "400 d",
            "kind": "store"
          }
        ]
      },
      {
        "name": "Platform",
        "nodes": [
          {
            "id": "iam",
            "label": "Identity & Access",
            "kind": "security"
          },
          {
            "id": "obs",
            "label": "Observability",
            "kind": "platform"
          },
          {
            "id": "cicd",
            "label": "CI/CD",
            "kind": "platform"
          }
        ]
      }
    ],
    "edges": [
      {
        "from": "intake",
        "to": "match",
        "label": "committed events",
        "kind": "async"
      },
      {
        "from": "plan",
        "to": "queues",
        "label": "one per endpoint",
        "kind": "async"
      },
      {
        "from": "worker",
        "to": "alog",
        "label": "every attempt",
        "kind": "async"
      }
    ],
    "note": "The capture plane knows nothing about subscriptions; the delivery plane knows nothing about the product.",
    "meta": {
      "v": "1.0",
      "owner": "Integration Platform Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "07-delivery-plane-components",
    "title": "Container View — Capture, Fan-out and Delivery",
    "layout": "nested",
    "canvas": {
      "width": 1720
    },
    "boxes": [
      {
        "title": "Capture and fan-out — private subnets",
        "kind": "boundary",
        "dir": "row",
        "children": [
          {
            "title": "Capture",
            "kind": "plain",
            "nodes": [
              {
                "id": "intake",
                "label": "Intake API",
                "sub": "ALB + Fargate",
                "kind": "integration"
              },
              {
                "id": "estore",
                "label": "Event Store",
                "sub": "DynamoDB + S3",
                "kind": "store"
              }
            ]
          },
          {
            "title": "Fan-out",
            "kind": "plain",
            "nodes": [
              {
                "id": "match",
                "label": "Subscription Matcher",
                "sub": "type + prefix",
                "kind": "app"
              },
              {
                "id": "ent",
                "label": "Entitlement Filter",
                "kind": "security"
              },
              {
                "id": "plan",
                "label": "Delivery Planner",
                "sub": "tenant budget",
                "kind": "app"
              }
            ]
          }
        ]
      },
      {
        "title": "Delivery plane — egress subnets, no inward route",
        "kind": "boundary",
        "dir": "row",
        "children": [
          {
            "title": "Queueing",
            "kind": "plain",
            "nodes": [
              {
                "id": "queues",
                "label": "Per-Endpoint Queues",
                "sub": "SQS FIFO",
                "kind": "queue"
              },
              {
                "id": "dlq",
                "label": "Dead-Letter Queues",
                "sub": "redrive",
                "kind": "queue"
              }
            ]
          },
          {
            "title": "Worker",
            "kind": "plain",
            "nodes": [
              {
                "id": "worker",
                "label": "Delivery Worker",
                "sub": "Fargate",
                "kind": "app"
              },
              {
                "id": "breaker",
                "label": "Circuit Breaker",
                "sub": "per endpoint",
                "kind": "app"
              },
              {
                "id": "guard",
                "label": "SSRF Guard",
                "sub": "re-resolve on connect",
                "kind": "security"
              },
              {
                "id": "signer",
                "label": "Signer",
                "sub": "HMAC, 2 secrets",
                "kind": "security",
                "icon": "fa5_signature"
              }
            ]
          }
        ]
      },
      {
        "title": "Control plane and consumer surface",
        "kind": "boundary",
        "dir": "row",
        "children": [
          {
            "title": "Configuration",
            "kind": "plain",
            "nodes": [
              {
                "id": "subsvc",
                "label": "Subscription Service",
                "kind": "app"
              },
              {
                "id": "secrets",
                "label": "Secret Store",
                "sub": "KMS-wrapped",
                "kind": "store"
              }
            ]
          },
          {
            "title": "Surface",
            "kind": "plain",
            "nodes": [
              {
                "id": "console",
                "label": "Console",
                "kind": "integration"
              },
              {
                "id": "mgmtapi",
                "label": "Management API",
                "kind": "integration",
                "icon": "aws_amazon-api-gateway"
              },
              {
                "id": "replay",
                "label": "Replay Service",
                "sub": "rate-limited",
                "kind": "app"
              },
              {
                "id": "alog",
                "label": "Attempt Log",
                "sub": "DynamoDB",
                "kind": "store"
              }
            ]
          }
        ]
      }
    ],
    "outside": [
      {
        "id": "prod",
        "label": "Product Services",
        "kind": "external"
      },
      {
        "id": "ep",
        "label": "Customer Endpoints",
        "kind": "external"
      }
    ],
    "edges": [
      {
        "from": "prod",
        "to": "intake",
        "label": "events"
      },
      {
        "from": "plan",
        "to": "queues",
        "label": "per endpoint",
        "kind": "async",
        "route": "tb"
      },
      {
        "from": "worker",
        "to": "ep",
        "label": "signed POST"
      },
      {
        "from": "worker",
        "to": "dlq",
        "label": "exhausted",
        "kind": "error"
      }
    ],
    "note": "Omitted for legibility: replay re-enqueue, the notification path, the audit writer and every observability edge.",
    "meta": {
      "v": "1.0",
      "owner": "Integration Platform Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "08-integration-surface",
    "title": "Integration Surface",
    "layout": "hub",
    "canvas": {
      "width": 1780
    },
    "left": {
      "title": "Inbound",
      "nodes": [
        {
          "id": "prod",
          "label": "Product Services",
          "sub": "transactional outbox",
          "kind": "app",
          "rel": "events"
        },
        {
          "id": "dev",
          "label": "Integration Developer",
          "kind": "actor",
          "rel": "console",
          "sub": "console + API"
        },
        {
          "id": "idp",
          "label": "Tenant Identity",
          "sub": "OIDC / SAML",
          "kind": "external",
          "rel": "OIDC"
        }
      ]
    },
    "centre": {
      "title": "Platform",
      "nodes": [
        {
          "id": "core",
          "label": "Webhook Delivery Service",
          "sub": "40,000 endpoints",
          "kind": "app"
        }
      ]
    },
    "right": {
      "title": "Outbound",
      "nodes": [
        {
          "id": "ep",
          "label": "Customer Endpoints",
          "sub": "HTTPS only",
          "kind": "external",
          "rel": "signed POST",
          "dir": "out"
        },
        {
          "id": "kms",
          "label": "AWS KMS",
          "kind": "security",
          "rel": "KMS",
          "dir": "out",
          "sub": "signing material"
        },
        {
          "id": "notif",
          "label": "Notification Service",
          "sub": "email, in-app",
          "kind": "external",
          "rel": "alerts",
          "dir": "out",
          "kind2": "async"
        }
      ]
    },
    "note": "Omitted: the replay API (view 14), audit export to a tenant SIEM (view 20) and the observability path (view 17). Failure alerts leave by a channel that does not depend on the endpoint.",
    "meta": {
      "v": "1.0",
      "owner": "Integration Platform Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "09-storage-zones",
    "title": "Storage Zones — By Ownership and Rebuildability",
    "layout": "nested",
    "canvas": {
      "width": 1700
    },
    "boxes": [
      {
        "title": "System of record — what we were asked to send",
        "kind": "trust",
        "dir": "row",
        "children": [
          {
            "title": "Event metadata",
            "kind": "plain",
            "nodes": [
              {
                "id": "emeta",
                "label": "Event Index",
                "sub": "DynamoDB, 30 d TTL",
                "kind": "store"
              }
            ]
          },
          {
            "title": "Event content",
            "kind": "plain",
            "nodes": [
              {
                "id": "epay",
                "label": "Event Payloads",
                "sub": "S3 SSE-KMS, 30 d",
                "kind": "store"
              },
              {
                "id": "onecopy",
                "label": "One copy per event",
                "sub": "not per delivery",
                "kind": "app"
              }
            ]
          }
        ]
      },
      {
        "title": "System of record — what we actually did",
        "kind": "trust",
        "dir": "row",
        "children": [
          {
            "title": "Delivery evidence",
            "kind": "plain",
            "nodes": [
              {
                "id": "alog",
                "label": "Attempt Log",
                "sub": "90 d, by endpoint",
                "kind": "store"
              },
              {
                "id": "dlq",
                "label": "Dead-Letter Index",
                "sub": "30 d from last attempt",
                "kind": "store"
              }
            ]
          },
          {
            "title": "Governance",
            "kind": "plain",
            "nodes": [
              {
                "id": "audit",
                "label": "Audit Log",
                "sub": "400 d, append-only",
                "kind": "store"
              },
              {
                "id": "agg",
                "label": "Aggregates",
                "sub": "13 months",
                "kind": "store"
              }
            ]
          }
        ]
      },
      {
        "title": "Configuration — small, versioned, security-critical",
        "kind": "trust",
        "dir": "row",
        "children": [
          {
            "title": "Subscriptions",
            "kind": "plain",
            "nodes": [
              {
                "id": "subs",
                "label": "Endpoints & Subscriptions",
                "sub": "strongly consistent reads",
                "kind": "store"
              }
            ]
          },
          {
            "title": "Secrets",
            "kind": "plain",
            "nodes": [
              {
                "id": "sec",
                "label": "Signing Secrets",
                "sub": "KMS-wrapped, 2 active",
                "kind": "store"
              }
            ]
          }
        ]
      },
      {
        "title": "Derived — rebuildable, no recovery objective of its own",
        "kind": "boundary",
        "dir": "row",
        "children": [
          {
            "title": "Work in flight",
            "kind": "plain",
            "nodes": [
              {
                "id": "queues",
                "label": "Per-Endpoint Queues",
                "sub": "rebuilt from the attempt log",
                "kind": "queue"
              }
            ]
          },
          {
            "title": "Derived state",
            "kind": "plain",
            "nodes": [
              {
                "id": "health",
                "label": "Endpoint Health",
                "sub": "recomputed from attempts",
                "kind": "store"
              }
            ]
          }
        ]
      }
    ],
    "edges": [
      {
        "from": "alog",
        "to": "queues",
        "label": "reconstructs",
        "kind": "batch"
      },
      {
        "from": "emeta",
        "to": "epay",
        "label": "payload_ref"
      }
    ],
    "note": "Nothing already recorded as delivered is re-sent when the queues are rebuilt.",
    "meta": {
      "v": "1.0",
      "owner": "Integration Platform Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "10-data-model",
    "title": "Data Model",
    "layout": "er",
    "canvas": {
      "width": 1700,
      "cols": 4
    },
    "rowGap": 260,
    "entities": [
      {
        "id": "tenant",
        "name": "tenant",
        "kind": "store",
        "row": 0,
        "col": 0,
        "attrs": [
          "tenant_id  PK",
          "plan",
          "status",
          "endpoint_quota"
        ]
      },
      {
        "id": "endpoint",
        "name": "endpoint",
        "kind": "store",
        "row": 0,
        "col": 1,
        "attrs": [
          "endpoint_id  PK",
          "tenant_id  FK -> tenant",
          "url",
          "state",
          "concurrency_cap",
          "ordering_mode"
        ]
      },
      {
        "id": "secret",
        "name": "signing_secret",
        "kind": "store",
        "row": 0,
        "col": 2,
        "attrs": [
          "secret_id  PK",
          "endpoint_id  FK -> endpoint",
          "wrapped_key",
          "active_from",
          "active_until"
        ]
      },
      {
        "id": "sub",
        "name": "subscription",
        "kind": "store",
        "row": 0,
        "col": 3,
        "attrs": [
          "subscription_id  PK",
          "endpoint_id  FK -> endpoint",
          "event_type_pattern",
          "entitlement_scope"
        ]
      },
      {
        "id": "event",
        "name": "event",
        "kind": "store",
        "row": 1,
        "col": 0,
        "attrs": [
          "event_id  PK",
          "tenant_id  FK -> tenant",
          "type",
          "occurred_at",
          "payload_ref",
          "expires_at"
        ]
      },
      {
        "id": "delivery",
        "name": "delivery",
        "kind": "store",
        "row": 1,
        "col": 1,
        "attrs": [
          "delivery_id  PK",
          "event_id  FK -> event",
          "endpoint_id  FK -> endpoint",
          "idempotency_key",
          "state",
          "next_attempt_at"
        ]
      },
      {
        "id": "attempt",
        "name": "attempt",
        "kind": "store",
        "row": 1,
        "col": 2,
        "attrs": [
          "attempt_id  PK",
          "delivery_id  FK -> delivery",
          "attempt_no",
          "outcome_class",
          "status_code",
          "duration_ms"
        ]
      },
      {
        "id": "dead",
        "name": "dead_letter",
        "kind": "store",
        "row": 2,
        "col": 1,
        "attrs": [
          "delivery_id  PK, FK -> delivery",
          "final_outcome",
          "dead_at",
          "expires_at",
          "replayed_as"
        ]
      }
    ],
    "relations": [
      {
        "from": "tenant",
        "to": "endpoint",
        "label": "1 : N",
        "from_side": "e",
        "to_side": "w"
      },
      {
        "from": "endpoint",
        "to": "secret",
        "label": "1 : 2",
        "from_side": "e",
        "to_side": "w"
      },
      {
        "from": "endpoint",
        "to": "sub",
        "label": "1 : N",
        "from_side": "n3",
        "to_side": "n"
      },
      {
        "from": "tenant",
        "to": "event",
        "label": "1 : N",
        "from_side": "s",
        "to_side": "n"
      },
      {
        "from": "endpoint",
        "to": "delivery",
        "label": "1 : N",
        "from_side": "s",
        "to_side": "n"
      },
      {
        "from": "event",
        "to": "delivery",
        "label": "1 : N",
        "from_side": "e",
        "to_side": "w"
      },
      {
        "from": "delivery",
        "to": "attempt",
        "label": "1 : N",
        "from_side": "e",
        "to_side": "w"
      },
      {
        "from": "delivery",
        "to": "dead",
        "label": "1 : 0..1",
        "from_side": "s",
        "to_side": "n",
        "kind": "optional"
      }
    ],
    "note": "The idempotency key is stable across every attempt and every replay of a delivery.",
    "meta": {
      "v": "1.0",
      "owner": "Integration Platform Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "11-event-to-first-attempt",
    "title": "Critical Flow — Event Committed to First Attempt",
    "layout": "sequence",
    "canvas": {
      "width": 1700
    },
    "lifelines": [
      {
        "id": "prod",
        "label": "Product Service",
        "kind": "app"
      },
      {
        "id": "intake",
        "label": "Intake API",
        "kind": "integration"
      },
      {
        "id": "store",
        "label": "Event & Attempt Store",
        "kind": "store"
      },
      {
        "id": "fanout",
        "label": "Fan-out Service",
        "kind": "app"
      },
      {
        "id": "queue",
        "label": "Endpoint Queue",
        "kind": "queue"
      },
      {
        "id": "worker",
        "label": "Delivery Worker",
        "kind": "app"
      },
      {
        "id": "ep",
        "label": "Customer Endpoint",
        "kind": "external"
      }
    ],
    "messages": [
      {
        "from": "prod",
        "to": "intake",
        "label": "POST /v1/events",
        "kind": "call"
      },
      {
        "from": "intake",
        "to": "intake",
        "label": "size cap, event id",
        "kind": "self"
      },
      {
        "from": "intake",
        "to": "store",
        "label": "persist payload",
        "kind": "call"
      },
      {
        "from": "store",
        "to": "intake",
        "label": "durable",
        "kind": "return"
      },
      {
        "from": "intake",
        "to": "prod",
        "label": "202 + event_id  (≤ 15 ms p99)",
        "kind": "return"
      },
      {
        "from": "intake",
        "to": "fanout",
        "label": "event committed",
        "kind": "async"
      },
      {
        "from": "fanout",
        "to": "fanout",
        "label": "match type + entitlement",
        "kind": "self"
      },
      {
        "from": "fanout",
        "to": "fanout",
        "label": "mint idempotency key",
        "kind": "self"
      },
      {
        "from": "fanout",
        "to": "queue",
        "label": "one message per endpoint",
        "kind": "async"
      },
      {
        "from": "queue",
        "to": "worker",
        "label": "lease, group = endpoint",
        "kind": "call"
      },
      {
        "from": "worker",
        "to": "worker",
        "label": "health + circuit check",
        "kind": "self"
      },
      {
        "from": "worker",
        "to": "worker",
        "label": "resolve + address check",
        "kind": "self"
      },
      {
        "from": "worker",
        "to": "worker",
        "label": "sign timestamp + body",
        "kind": "self"
      },
      {
        "from": "worker",
        "to": "ep",
        "label": "POST, signed",
        "kind": "call"
      },
      {
        "from": "ep",
        "to": "worker",
        "label": "200 OK",
        "kind": "return"
      },
      {
        "from": "worker",
        "to": "queue",
        "label": "delete message",
        "kind": "call"
      },
      {
        "from": "worker",
        "to": "store",
        "label": "record attempt",
        "kind": "async"
      }
    ],
    "note": "The product's write path ends at message 5. Everything after it happens on the platform's schedule.",
    "meta": {
      "v": "1.0",
      "owner": "Integration Platform Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "12-retry-and-dead-letter",
    "title": "Retry, Circuit Breaking and Dead Letter",
    "layout": "flow",
    "canvas": {
      "width": 1760
    },
    "chain": true,
    "align": "middle",
    "stages": [
      {
        "title": "Attempt",
        "nodes": [
          {
            "id": "worker",
            "label": "Delivery Worker",
            "sub": "5 s / 10 s / 15 s",
            "kind": "app"
          }
        ]
      },
      {
        "title": "Classify outcome",
        "nodes": [
          {
            "id": "ok",
            "label": "Success",
            "sub": "2xx",
            "kind": "opportunity"
          },
          {
            "id": "retryable",
            "label": "Retryable",
            "sub": "5xx, 408, 429, timeout",
            "kind": "decision"
          },
          {
            "id": "perm",
            "label": "Permanent",
            "sub": "other 4xx",
            "kind": "risk"
          },
          {
            "id": "rej",
            "label": "Rejected",
            "sub": "address check, disabled",
            "kind": "risk"
          }
        ]
      },
      {
        "title": "Schedule",
        "nodes": [
          {
            "id": "backoff",
            "label": "Backoff Scheduler",
            "sub": "full jitter, 5 s → 6 h",
            "kind": "app"
          },
          {
            "id": "retryafter",
            "label": "Retry-After",
            "sub": "honoured to 1 h",
            "kind": "app"
          },
          {
            "id": "breaker",
            "label": "Circuit Breaker",
            "sub": "opens at 20 failures",
            "kind": "app"
          }
        ]
      },
      {
        "title": "Exhaust",
        "nodes": [
          {
            "id": "limit",
            "label": "12 attempts or 72 h",
            "sub": "whichever first",
            "kind": "decision"
          },
          {
            "id": "disable",
            "label": "Auto-disable",
            "sub": "72 h, zero success",
            "kind": "risk"
          }
        ]
      },
      {
        "title": "Account and recover",
        "nodes": [
          {
            "id": "dlq",
            "label": "Dead-Letter Store",
            "sub": "30 d, backlog held",
            "kind": "store"
          },
          {
            "id": "notify",
            "label": "Owner Notification",
            "sub": "on the first dead letter",
            "kind": "integration"
          },
          {
            "id": "replay",
            "label": "Replay",
            "sub": "single, filtered or bulk",
            "kind": "integration"
          }
        ]
      }
    ],
    "edges": [
      {
        "from": "backoff",
        "to": "worker",
        "label": "next attempt",
        "kind": "async",
        "route": "gutter"
      },
      {
        "from": "replay",
        "to": "worker",
        "label": "re-deliver",
        "kind": "async",
        "route": "gutter"
      }
    ],
    "note": "A permanent failure is never retried, and never silent: its owner is told, because a quietly dead integration is the worst outcome here.",
    "meta": {
      "v": "1.0",
      "owner": "Integration Platform Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "13-signing-and-verification",
    "title": "Signing, Rotation and Consumer Verification",
    "layout": "sequence",
    "canvas": {
      "width": 1660
    },
    "lifelines": [
      {
        "id": "subsvc",
        "label": "Subscription Service",
        "kind": "app"
      },
      {
        "id": "kms",
        "label": "AWS KMS",
        "kind": "security"
      },
      {
        "id": "store",
        "label": "Secret Store",
        "kind": "store"
      },
      {
        "id": "worker",
        "label": "Delivery Worker",
        "kind": "app"
      },
      {
        "id": "verify",
        "label": "Consumer Verifier",
        "kind": "external"
      },
      {
        "id": "handler",
        "label": "Consumer Handler",
        "kind": "external"
      }
    ],
    "messages": [
      {
        "from": "subsvc",
        "to": "kms",
        "label": "generate data key",
        "kind": "call"
      },
      {
        "from": "kms",
        "to": "subsvc",
        "label": "plaintext + wrapped",
        "kind": "return"
      },
      {
        "from": "subsvc",
        "to": "store",
        "label": "persist wrapped only",
        "kind": "call"
      },
      {
        "from": "subsvc",
        "to": "subsvc",
        "label": "show once, never again",
        "kind": "self"
      },
      {
        "from": "worker",
        "to": "store",
        "label": "read active secrets",
        "kind": "call"
      },
      {
        "from": "worker",
        "to": "kms",
        "label": "decrypt, cached 5 min",
        "kind": "call"
      },
      {
        "from": "worker",
        "to": "worker",
        "label": "HMAC over ts + raw body",
        "kind": "self"
      },
      {
        "from": "worker",
        "to": "verify",
        "label": "POST + signature headers",
        "kind": "call"
      },
      {
        "from": "verify",
        "to": "verify",
        "label": "recompute over raw bytes",
        "kind": "self"
      },
      {
        "from": "verify",
        "to": "verify",
        "label": "reject if ts outside window",
        "kind": "self"
      },
      {
        "from": "verify",
        "to": "handler",
        "label": "dispatch event",
        "kind": "call"
      },
      {
        "from": "handler",
        "to": "worker",
        "label": "200 OK",
        "kind": "return"
      },
      {
        "from": "subsvc",
        "to": "store",
        "label": "rotate: second secret active",
        "kind": "async"
      },
      {
        "from": "worker",
        "to": "verify",
        "label": "both signatures, 7 d overlap",
        "kind": "async"
      },
      {
        "from": "verify",
        "to": "worker",
        "label": "401 if neither verifies",
        "kind": "error"
      }
    ],
    "note": "A 401 from the verifier is a permanent outcome: the platform stops retrying and tells the endpoint's owner.",
    "meta": {
      "v": "1.0",
      "owner": "Integration Platform Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "14-replay-and-recovery",
    "title": "Replay and Recovery — Who Does What",
    "layout": "swimlane",
    "canvas": {
      "width": 1720
    },
    "laneHeaderWidth": 180,
    "stages": [
      "Detect",
      "Decide",
      "Authorise",
      "Re-deliver",
      "Confirm"
    ],
    "lanes": [
      {
        "title": "Customer on-call",
        "cells": [
          [
            {
              "label": "Reads failure alert",
              "kind": "actor"
            }
          ],
          [
            {
              "label": "Fixes the receiver",
              "kind": "actor"
            }
          ],
          [
            {
              "label": "Chooses the scope",
              "kind": "actor"
            }
          ],
          [],
          [
            {
              "label": "Watches it drain",
              "kind": "actor"
            }
          ]
        ]
      },
      {
        "title": "Console and API",
        "cells": [
          [
            {
              "label": "Delivery health API",
              "kind": "integration"
            }
          ],
          [
            {
              "label": "Dead-letter browser",
              "kind": "integration"
            }
          ],
          [
            {
              "label": "Confirm bulk replay",
              "kind": "decision"
            }
          ],
          [],
          [
            {
              "label": "Request inspector",
              "kind": "integration"
            }
          ]
        ]
      },
      {
        "title": "Replay service",
        "cells": [
          [],
          [
            {
              "label": "Counts the backlog",
              "kind": "app"
            }
          ],
          [
            {
              "label": "Per-endpoint rate cap",
              "kind": "app"
            }
          ],
          [
            {
              "label": "Same idempotency key",
              "kind": "app"
            }
          ],
          [
            {
              "label": "Marks replayed_as",
              "kind": "store"
            }
          ]
        ]
      },
      {
        "title": "Delivery plane",
        "cells": [
          [
            {
              "label": "Circuit open",
              "kind": "risk"
            }
          ],
          [
            {
              "label": "Single probe succeeds",
              "kind": "app"
            }
          ],
          [],
          [
            {
              "label": "Ramp 10% → 100%",
              "kind": "app"
            }
          ],
          [
            {
              "label": "Endpoint healthy",
              "kind": "opportunity"
            }
          ]
        ]
      },
      {
        "title": "Consumer's system",
        "cells": [
          [
            {
              "label": "Receiver down",
              "kind": "risk"
            }
          ],
          [
            {
              "label": "Receiver restored",
              "kind": "external"
            }
          ],
          [],
          [
            {
              "label": "Dedups on the key",
              "kind": "external"
            }
          ],
          [
            {
              "label": "Caught up",
              "kind": "opportunity"
            }
          ]
        ]
      }
    ],
    "note": "A bulk replay is a load test the customer is running against themselves, which is why it is rate-capped and confirmed.",
    "meta": {
      "v": "1.0",
      "owner": "Integration Platform Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "15-deployment-architecture",
    "title": "Deployment — Regions, Subnets and Egress",
    "layout": "nested",
    "canvas": {
      "width": 1740
    },
    "boxes": [
      {
        "title": "AWS eu-west-1 — active",
        "kind": "cloud",
        "dir": "col",
        "children": [
          {
            "title": "Public subnets",
            "kind": "boundary",
            "nodes": [
              {
                "id": "alb",
                "label": "Application Load Balancer",
                "sub": "intake + console",
                "kind": "integration"
              },
              {
                "id": "nat",
                "label": "NAT Gateways",
                "sub": "published /28, 3 AZ",
                "kind": "platform"
              }
            ]
          },
          {
            "title": "Private subnets — capture and control",
            "kind": "boundary",
            "nodes": [
              {
                "id": "intake",
                "label": "Intake Service",
                "sub": "Fargate, 3 AZ",
                "kind": "app"
              },
              {
                "id": "fanout",
                "label": "Fan-out Service",
                "sub": "Fargate",
                "kind": "app"
              },
              {
                "id": "ctrl",
                "label": "Control Plane",
                "sub": "subscriptions, replay",
                "kind": "app"
              }
            ]
          },
          {
            "title": "Egress subnets — delivery only, no inward route",
            "kind": "trust",
            "nodes": [
              {
                "id": "worker",
                "label": "Delivery Workers",
                "sub": "Fargate, autoscaled",
                "kind": "app"
              },
              {
                "id": "replayw",
                "label": "Replay Workers",
                "sub": "separate pool",
                "kind": "app"
              }
            ]
          },
          {
            "title": "Regional services",
            "kind": "boundary",
            "nodes": [
              {
                "id": "sqs",
                "label": "SQS FIFO",
                "sub": "per-endpoint groups",
                "kind": "queue"
              },
              {
                "id": "ddb",
                "label": "DynamoDB",
                "sub": "global tables",
                "kind": "store"
              },
              {
                "id": "s3",
                "label": "S3",
                "sub": "payloads, CRR",
                "kind": "store"
              },
              {
                "id": "kms",
                "label": "KMS",
                "sub": "multi-region key",
                "kind": "security"
              }
            ]
          }
        ]
      },
      {
        "title": "AWS eu-central-1 — warm standby",
        "kind": "cloud",
        "dir": "row",
        "children": [
          {
            "title": "Compute at floor",
            "kind": "boundary",
            "nodes": [
              {
                "id": "intake2",
                "label": "Intake Service",
                "sub": "minimum tasks",
                "kind": "app"
              },
              {
                "id": "worker2",
                "label": "Delivery Workers",
                "sub": "scaled to zero",
                "kind": "app"
              }
            ]
          },
          {
            "title": "Replicated state",
            "kind": "boundary",
            "nodes": [
              {
                "id": "ddb2",
                "label": "DynamoDB Global Tables",
                "sub": "RPO ≤ 5 s",
                "kind": "store"
              },
              {
                "id": "s32",
                "label": "S3 Replica",
                "sub": "payloads",
                "kind": "store"
              },
              {
                "id": "nat2",
                "label": "NAT Gateways",
                "sub": "second published /28",
                "kind": "platform"
              }
            ]
          }
        ]
      }
    ],
    "outside": [
      {
        "id": "prod",
        "label": "Product Services",
        "kind": "external"
      },
      {
        "id": "ep",
        "label": "Customer Endpoints",
        "kind": "external"
      }
    ],
    "edges": [
      {
        "from": "nat",
        "to": "ep",
        "label": "signed POST",
        "route": "gutter"
      },
      {
        "from": "ddb",
        "to": "ddb2",
        "label": "replicates",
        "kind": "async"
      }
    ],
    "note": "Both regions' egress ranges are published from day one, so a failover is not also an allowlist change for 40,000 consumers.",
    "meta": {
      "v": "1.0",
      "owner": "Integration Platform Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "16-release-pipeline",
    "title": "Release Pipeline and the Egress Contract",
    "layout": "flow",
    "canvas": {
      "width": 1760
    },
    "chain": true,
    "align": "middle",
    "stages": [
      {
        "title": "Source",
        "nodes": [
          {
            "id": "repo",
            "label": "Service and IaC Repo",
            "sub": "Terraform + code",
            "kind": "app"
          }
        ]
      },
      {
        "title": "Build",
        "nodes": [
          {
            "id": "ci",
            "label": "CI Build",
            "sub": "image + SBOM",
            "kind": "platform"
          },
          {
            "id": "unit",
            "label": "Unit and Contract Tests",
            "kind": "platform"
          }
        ]
      },
      {
        "title": "Gate",
        "nodes": [
          {
            "id": "sig",
            "label": "Signature Contract",
            "sub": "canonical string frozen",
            "kind": "decision"
          },
          {
            "id": "ssrf",
            "label": "Address Guard Suite",
            "sub": "rebinding, redirects",
            "kind": "decision"
          },
          {
            "id": "ipchg",
            "label": "Egress Range Review",
            "sub": "published interface",
            "kind": "decision"
          }
        ]
      },
      {
        "title": "Stage",
        "nodes": [
          {
            "id": "stg",
            "label": "Staging Delivery Plane",
            "sub": "synthetic endpoints",
            "kind": "app"
          },
          {
            "id": "chaos",
            "label": "Slow and Dead Endpoints",
            "sub": "injected every run",
            "kind": "platform"
          }
        ]
      },
      {
        "title": "Canary",
        "nodes": [
          {
            "id": "canary",
            "label": "5% of Workers",
            "sub": "30 min soak",
            "kind": "app"
          },
          {
            "id": "watch",
            "label": "Success-Rate Watch",
            "sub": "auto-rollback",
            "kind": "platform"
          }
        ]
      },
      {
        "title": "Production",
        "nodes": [
          {
            "id": "roll",
            "label": "Rolling Workers",
            "sub": "drain in-flight, 20 s",
            "kind": "app"
          },
          {
            "id": "cfg",
            "label": "Queue and Policy Config",
            "sub": "versioned, staged",
            "kind": "platform"
          }
        ]
      }
    ],
    "edges": [
      {
        "from": "watch",
        "to": "roll",
        "label": "promote or roll back",
        "kind": "error",
        "route": "gutter"
      }
    ],
    "note": "A worker is drained, never killed: an in-flight attempt finishes, or its message returns on the visibility timeout.",
    "meta": {
      "v": "1.0",
      "owner": "Integration Platform Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "17-observability",
    "title": "Observability — Signal by Stage",
    "layout": "grid",
    "canvas": {
      "width": 1740
    },
    "laneHeaderWidth": 190,
    "stages": [
      "Intake",
      "Fan-out",
      "Queue",
      "Attempt",
      "Consumer"
    ],
    "lanes": [
      {
        "title": "Metrics",
        "cells": [
          [
            {
              "label": "Accept rate",
              "kind": "platform"
            },
            {
              "label": "Ack p99",
              "kind": "platform"
            }
          ],
          [
            {
              "label": "Fan-out ratio",
              "kind": "platform"
            },
            {
              "label": "Match lag",
              "kind": "platform"
            }
          ],
          [
            {
              "label": "Backlog per endpoint",
              "kind": "platform"
            }
          ],
          [
            {
              "label": "Success rate",
              "kind": "platform"
            },
            {
              "label": "Retry share",
              "kind": "platform"
            }
          ],
          [
            {
              "label": "Consumer latency p99",
              "kind": "platform"
            }
          ]
        ]
      },
      {
        "title": "Logs",
        "cells": [
          [
            {
              "label": "Rejected events",
              "kind": "store"
            }
          ],
          [
            {
              "label": "Entitlement misses",
              "kind": "store"
            }
          ],
          [
            {
              "label": "Redrive events",
              "kind": "store"
            }
          ],
          [
            {
              "label": "Attempt records, 90 d",
              "kind": "store"
            }
          ],
          [
            {
              "label": "Response prefix, 1 KB",
              "kind": "store"
            }
          ]
        ]
      },
      {
        "title": "Traces",
        "cells": [
          [
            {
              "label": "Producer to ack",
              "kind": "platform"
            }
          ],
          [
            {
              "label": "Event to N deliveries",
              "kind": "platform"
            }
          ],
          [
            {
              "label": "Enqueue to lease",
              "kind": "platform"
            }
          ],
          [
            {
              "label": "Sign, POST, classify",
              "kind": "platform"
            }
          ],
          []
        ]
      },
      {
        "title": "Alerts",
        "cells": [
          [
            {
              "label": "Intake error rate",
              "kind": "risk"
            }
          ],
          [
            {
              "label": "Fan-out lag > 60 s",
              "kind": "risk"
            }
          ],
          [
            {
              "label": "Backlog older than 1 h",
              "kind": "risk"
            }
          ],
          [
            {
              "label": "Retries above 25%",
              "kind": "risk"
            }
          ],
          [
            {
              "label": "Endpoint auto-disabled",
              "kind": "risk"
            }
          ]
        ]
      },
      {
        "title": "Shown to the customer",
        "cells": [
          [],
          [],
          [
            {
              "label": "Backlog depth",
              "kind": "integration"
            }
          ],
          [
            {
              "label": "Delivery health API",
              "kind": "integration"
            }
          ],
          [
            {
              "label": "Request inspector",
              "kind": "integration"
            }
          ]
        ]
      }
    ],
    "note": "Platform time and consumer time are measured separately, so a slow integration has an owner rather than an argument.",
    "meta": {
      "v": "1.0",
      "owner": "Integration Platform Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "18-endpoint-health-lifecycle",
    "title": "Endpoint Health Lifecycle",
    "layout": "cycle",
    "canvas": {
      "width": 1520
    },
    "centre": {
      "label": "Endpoint health"
    },
    "nodes": [
      {
        "id": "reg",
        "label": "Registered",
        "sub": "challenge pending",
        "kind": "app"
      },
      {
        "id": "healthy",
        "label": "Healthy",
        "sub": "delivering",
        "kind": "opportunity"
      },
      {
        "id": "degraded",
        "label": "Degraded",
        "sub": "failures rising",
        "kind": "decision"
      },
      {
        "id": "open",
        "label": "Circuit open",
        "sub": "20 consecutive failures",
        "kind": "risk"
      },
      {
        "id": "disabled",
        "label": "Auto-disabled",
        "sub": "72 h, backlog held",
        "kind": "risk"
      },
      {
        "id": "reenabled",
        "label": "Re-enabled",
        "sub": "owner chooses the backlog",
        "kind": "app"
      }
    ],
    "ringLabels": [
      "challenge passes",
      "errors accumulate",
      "threshold crossed",
      "probes keep failing",
      "owner fixes it",
      "ramped resumption"
    ],
    "rx": 440,
    "ry": 215,
    "note": "An endpoint that has never once succeeded is never enabled, so the cycle cannot start in the failing half.",
    "meta": {
      "v": "1.0",
      "owner": "Integration Platform Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "19-security-trust-zones",
    "title": "Trust Zones and the Egress Path",
    "layout": "zones",
    "canvas": {
      "width": 1700
    },
    "zones": [
      {
        "title": "Internet — untrusted, attacker-chosen",
        "kind": "trust",
        "nodes": [
          {
            "id": "ep",
            "label": "Customer Endpoint",
            "sub": "a URL a stranger set",
            "kind": "external"
          },
          {
            "id": "redir",
            "label": "Redirect Target",
            "sub": "re-validated, max 3",
            "kind": "risk"
          },
          {
            "id": "dns",
            "label": "Public DNS",
            "sub": "may rebind",
            "kind": "external"
          }
        ]
      },
      {
        "title": "Egress perimeter",
        "kind": "trust",
        "nodes": [
          {
            "id": "guard",
            "label": "Address Guard",
            "sub": "re-resolve on connect",
            "kind": "security"
          },
          {
            "id": "nat",
            "label": "NAT Gateway",
            "sub": "published /28",
            "kind": "platform"
          },
          {
            "id": "fw",
            "label": "Egress Firewall",
            "sub": "no route inward",
            "kind": "security"
          }
        ]
      },
      {
        "title": "Delivery plane",
        "kind": "trust",
        "nodes": [
          {
            "id": "worker",
            "label": "Delivery Workers",
            "sub": "no path to the product",
            "kind": "app"
          },
          {
            "id": "queues",
            "label": "Per-Endpoint Queues",
            "kind": "queue"
          }
        ]
      },
      {
        "title": "Control plane",
        "kind": "trust",
        "nodes": [
          {
            "id": "intake",
            "label": "Intake API",
            "kind": "integration"
          },
          {
            "id": "subsvc",
            "label": "Subscription Service",
            "sub": "step-up on URL change",
            "kind": "app"
          },
          {
            "id": "replay",
            "label": "Replay Service",
            "kind": "app"
          }
        ]
      },
      {
        "title": "Data and keys",
        "kind": "trust",
        "nodes": [
          {
            "id": "secrets",
            "label": "Signing Secrets",
            "sub": "KMS-wrapped",
            "kind": "store"
          },
          {
            "id": "pay",
            "label": "Event Payloads",
            "sub": "SSE-KMS",
            "kind": "store"
          },
          {
            "id": "audit",
            "label": "Audit Log",
            "sub": "append-only",
            "kind": "store"
          }
        ]
      }
    ],
    "edges": [
      {
        "from": "worker",
        "to": "guard",
        "label": "resolve and validate"
      },
      {
        "from": "guard",
        "to": "nat",
        "label": ""
      },
      {
        "from": "nat",
        "to": "ep",
        "label": "signed POST"
      },
      {
        "from": "ep",
        "to": "redir",
        "label": "3xx, re-checked",
        "kind": "error"
      },
      {
        "from": "subsvc",
        "to": "secrets",
        "label": "wrapped write"
      }
    ],
    "note": "The delivery worker is a request-forgery engine aimed at a URL a stranger chose. The network path is the control the guard is allowed to fail behind.",
    "meta": {
      "v": "1.0",
      "owner": "Integration Platform Architecture",
      "date": "2026-09"
    }
  },
  {
    "id": "20-identity-and-access",
    "title": "Identity and Access — Changing an Endpoint URL",
    "layout": "sequence",
    "canvas": {
      "width": 1700
    },
    "lifelines": [
      {
        "id": "dev",
        "label": "Integration Developer",
        "kind": "actor"
      },
      {
        "id": "idp",
        "label": "Tenant Identity",
        "kind": "external"
      },
      {
        "id": "console",
        "label": "Console",
        "kind": "integration"
      },
      {
        "id": "api",
        "label": "Management API",
        "kind": "integration",
        "icon": "aws_amazon-api-gateway"
      },
      {
        "id": "authz",
        "label": "Authorisation",
        "kind": "security"
      },
      {
        "id": "store",
        "label": "Subscription Store",
        "kind": "store"
      },
      {
        "id": "audit",
        "label": "Audit Log",
        "kind": "store"
      }
    ],
    "messages": [
      {
        "from": "dev",
        "to": "idp",
        "label": "SSO with MFA",
        "kind": "call"
      },
      {
        "from": "idp",
        "to": "console",
        "label": "assertion, tenant scope",
        "kind": "return"
      },
      {
        "from": "console",
        "to": "api",
        "label": "PATCH endpoint url",
        "kind": "call"
      },
      {
        "from": "api",
        "to": "authz",
        "label": "tenant, actor, action",
        "kind": "call"
      },
      {
        "from": "authz",
        "to": "authz",
        "label": "URL change is elevated",
        "kind": "self"
      },
      {
        "from": "authz",
        "to": "api",
        "label": "step-up required",
        "kind": "error"
      },
      {
        "from": "api",
        "to": "console",
        "label": "403 + step_up_required",
        "kind": "return"
      },
      {
        "from": "dev",
        "to": "idp",
        "label": "re-authenticate",
        "kind": "call"
      },
      {
        "from": "console",
        "to": "api",
        "label": "PATCH with fresh assertion",
        "kind": "call"
      },
      {
        "from": "api",
        "to": "store",
        "label": "write, versioned",
        "kind": "call"
      },
      {
        "from": "api",
        "to": "audit",
        "label": "actor, before, after",
        "kind": "async"
      },
      {
        "from": "api",
        "to": "console",
        "label": "202, effective ≤ 30 s",
        "kind": "return"
      },
      {
        "from": "store",
        "to": "audit",
        "label": "export to tenant SIEM",
        "kind": "batch"
      }
    ],
    "note": "Changing a URL redirects the tenant's data, so it needs a higher authority than changing which event types are sent.",
    "meta": {
      "v": "1.0",
      "owner": "Integration Platform Architecture",
      "date": "2026-09"
    }
  }
]