{ "available": true, "status": "proposed", "note": "The JarvisAI/JarvisOS control plane, expressed as the functions that must keep working rather than the processes that provide them. Every survival claim on this page is derived from the topology below, never declared: see src/controlplane.js. Nothing here moves anything — this is a design artefact, like config/placement.json.", "policy": { "leaseRenewalsPerLease": 3, "clockSkewSec": 5, "requireBreakGlassFor": [ "fleet-fatal" ], "quorumMinDomains": 3, "notes": [ "A plane \"survives\" a scenario only if it keeps working from the operator's side of the break with nobody typing anything. A documented manual promotion is a recovery, not a survival.", "This estate has two compute domains. A majority quorum needs three, so no durable state promotes itself. Every lease here is held inside the store it guards, which is the only election that stays correct without a third voter: whoever can write the lease is by definition the side that can write the data.", "The matrix is derived twice. \"Today\" counts only instances that are actually running; \"by design\" counts the plan as written. The gap between the two columns is the honest measure of how much of this design is still on paper.", "Routing is deliberately not part of the survival derivation. A caller inside a partition can always reach a local instance directly; whether the *published* route follows the leader is a separate question, checked by the routing rules instead." ] }, "summary": { "planes": 9, "proposed": 4, "scenarios": 5, "gaps": 1, "accepted": 0, "notes": 7, "cellsSurvivingTarget": 43, "cellsSurvivingCurrent": 20, "cellsTotal": 45, "breakGlassPaths": 9 }, "scenarios": [ { "id": "lose-home1", "name": "Home1 is gone", "description": "The home server is down or unreachable: hardware, power, or a failed upgrade. The operator works from VIN over SSH. The NAS is still powered but has no compute of interest.", "lostNodes": [ "home1" ], "operatorPartition": "vps", "partitions": [ { "id": "vps", "nodes": [ "vin", "vps1" ], "operator": true, "vendorReachable": true }, { "id": "home-lan", "nodes": [ "nas" ], "operator": false, "vendorReachable": true } ], "surviving": 7, "survivingToday": 4, "total": 9 }, { "id": "lose-vin", "name": "VIN (the VPS) is gone", "description": "The VPS is destroyed, suspended or unreachable. Home1 and the NAS are healthy and the home uplink works. Everything published to the internet goes with it.", "lostNodes": [ "vin" ], "operatorPartition": "home", "partitions": [ { "id": "home", "nodes": [ "home1", "nas", "vps1" ], "operator": true, "vendorReachable": true } ], "surviving": 9, "survivingToday": 3, "total": 9 }, { "id": "lose-uplink", "name": "Home internet is down", "description": "The ISP uplink is dead. Home1 and the NAS are healthy but cut off from every vendor and from VIN. VIN is healthy and still on the internet, but nobody at home can reach it. The operator is at home.", "lostNodes": [], "operatorPartition": "home", "partitions": [ { "id": "home", "nodes": [ "home1", "nas" ], "operator": true, "vendorReachable": false }, { "id": "vps", "nodes": [ "vin", "vps1" ], "operator": false, "vendorReachable": true } ], "surviving": 9, "survivingToday": 3, "total": 9 }, { "id": "partition-mesh", "name": "The mesh is partitioned", "description": "Both sites are healthy and both have internet, but the WireGuard tunnel between them is down. This is the scenario that punishes automatic promotion: each side can see the world and neither can see the other.", "lostNodes": [], "operatorPartition": "home", "partitions": [ { "id": "home", "nodes": [ "home1", "nas" ], "operator": true, "vendorReachable": true }, { "id": "vps", "nodes": [ "vin", "vps1" ], "operator": false, "vendorReachable": true } ], "surviving": 9, "survivingToday": 3, "total": 9 }, { "id": "lose-nas", "name": "The NAS is gone", "description": "Bulk storage and the local backup tier are unavailable. Compute is untouched; recovery capability is not.", "lostNodes": [ "nas" ], "operatorPartition": "estate", "partitions": [ { "id": "estate", "nodes": [ "home1", "vin", "vps1" ], "operator": true, "vendorReachable": true } ], "surviving": 9, "survivingToday": 7, "total": 9 } ], "planes": [ { "id": "cp-identity", "name": "Identity — session issue and verification", "purpose": "Decide whether a request is allowed. Every published route and every CLI call goes through this answer.", "criticality": "fleet-fatal", "entityId": "jarvisos-auth", "proposed": false, "status": "unknown", "stateClass": "rebuildable", "state": { "store": "redis", "replicas": [], "note": "Sessions are cached in Redis on home1. Verification does not read it: tokens are signed and verified with a public key held on every node, so a lost session store costs new logins, not live ones." }, "leadership": { "model": "stateless", "currentModel": "static-primary", "candidates": [ "vin", "home1" ], "note": "Target: any instance can verify, because verification is a signature check. Today there is one process on VIN and losing it is losing identity." }, "instances": [ { "node": "vin", "role": "active", "status": "running", "note": "Next to the ingress it authorises." }, { "node": "home1", "role": "active", "status": "planned", "note": "Second verifier, same signing key, so home-side services authorise without crossing the mesh." } ], "domains": [ "fd-vps", "fd-home-rack" ], "routing": { "mode": "health-checked", "entry": "caddy", "healthPath": "/healthz", "intervalSec": 5, "unhealthyAfter": 3, "drainSec": 10, "note": "Forward-auth fails closed. An unhealthy verifier must be routed away from, never routed around." }, "failover": { "trigger": "automatic", "detectSec": 15, "decideSec": 0, "actSec": 5, "verifySec": 10, "steps": [ "The router marks the instance unhealthy after 3 failed 5s probes.", "Traffic moves to the other verifier; no state moves, because there is none to move.", "A verified login is attempted against the surviving instance." ], "verify": "A real login completes end to end, not just a 200 from /healthz.", "dataLoss": "None. Verification is stateless; only new-login capability depends on the store.", "note": "Safe to automate for the same reason internal DNS is: nothing durable can split." }, "failoverBudgetSec": 30, "degradedMode": "Existing sessions keep verifying. New logins fail while Google or the session store is unreachable, and the break-glass token is the way in.", "config": { "source": "jarvisos-config (auth policy, route ACLs, signing public keys)", "distribution": "pull-replicated", "replicas": [ "home1", "vin" ], "staleServeSec": null, "note": "Each node keeps its last-good copy and serves from it indefinitely. Policy that cannot be refreshed is not policy that stops working." }, "telemetry": { "source": "jarvisai-telemetry", "sink": "jarvisos-status-console" }, "breakGlass": { "command": "jarvisctl auth mint --offline --role operator --ttl 15m", "nodes": [ "home1", "vin" ], "requires": [ "shell on the node", "the offline signing key held in the operator's password manager (name only; never on a node with public ingress)" ], "requiresPlanes": [], "provides": "A short-lived operator token accepted by every service, minted without Google, without Redis and without the auth process.", "excludes": "It cannot create users or change policy — only get one operator in.", "verifiedBy": "Quarterly game day: mint offline, use it, watch it expire." }, "survives": [ "lose-home1", "lose-vin", "lose-uplink", "partition-mesh", "lose-nas" ], "worst": "degraded", "worstToday": "break-glass" }, { "id": "cp-scheduling", "name": "Scheduling — task dispatch and leases", "purpose": "Decide which worker runs which task, and make sure exactly one scheduler is deciding.", "criticality": "fleet-fatal", "entityId": "jarvisos-control-plane", "proposed": false, "status": "unknown", "stateClass": "durable", "state": { "store": "postgres-primary", "replicas": [ "postgres-replica" ], "rpoMinutes": 15, "note": "The queue, the leases and the task history are one database. Workers hold nothing: a worker is a process that can be shot at any time." }, "leadership": { "model": "store-lease", "currentModel": "static-primary", "leaseStore": "postgres-primary", "leaseSec": 30, "renewSec": 10, "takeoverSec": 45, "fencingToken": true, "candidates": [ "home1", "vin" ], "note": "The lease is a row in the same database the scheduler writes to, so leadership and writability cannot land on different sides of a partition. Every dispatch carries the monotonic fencing token from that row; the database rejects a write carrying a token older than the current lease, so a scheduler that was paused for a minute cannot dispatch when it wakes." }, "instances": [ { "node": "home1", "role": "leader", "status": "running", "note": "Holds the lease today by being the only one." }, { "node": "vin", "role": "candidate", "status": "planned", "note": "Runs continuously, holds no lease, takes over by winning the row." } ], "domains": [ "fd-home-rack", "fd-vps" ], "routing": { "mode": "health-checked", "entry": "internal-dns", "healthPath": "/api/v1/healthz", "intervalSec": 5, "unhealthyAfter": 3, "drainSec": 15, "note": "Workers resolve control-plane.jarvis.internal, which only ever answers with an instance that currently holds the lease." }, "failover": { "trigger": "automatic", "detectSec": 45, "decideSec": 0, "actSec": 10, "verifySec": 20, "steps": [ "The leader stops renewing (crash, host loss, or a partition from the database).", "The lease row expires after 30s; no candidate may touch it before 45s, which covers 5s of clock skew.", "The surviving candidate takes the row in one transaction and receives fencing token N+1.", "It replays unacknowledged dispatches; handlers are idempotent, so at-least-once is safe.", "Any write from the old leader carrying token N is rejected by the database, whether or not that leader knows it lost." ], "verify": "A canary task is dispatched and observed to complete under the new token.", "dataLoss": "None of the scheduler's own. In-flight tasks are at-least-once and re-run.", "fencing": "The monotonic lease token, enforced in the database rather than by agreement.", "note": "This buys automatic recovery from the common failure — the leader process or its host dying while the database lives. It cannot buy site failover: if the database itself is on the far side, a human promotes it first. One human decision, not two." }, "failoverBudgetSec": 75, "degradedMode": "Nothing new is dispatched. Running worker tasks continue and report on their own; the queue is durable, so work is delayed rather than lost.", "config": { "source": "jarvisos-config (task definitions, worker pools, schedules)", "distribution": "pull-replicated", "replicas": [ "home1", "vin" ], "staleServeSec": null, "note": "The local cache is what makes the break-glass path below possible: a task definition must be readable with the control plane down." }, "telemetry": { "source": "jarvisai-telemetry", "sink": "jarvisos-status-console" }, "breakGlass": { "command": "jarvisctl task run --local --fence-off", "nodes": [ "home1", "vin" ], "requires": [ "shell on the node", "the replicated task definition cache" ], "requiresPlanes": [ "cp-config" ], "provides": "Runs one task in the foreground, from the local definition, with output on the terminal. No queue, no leader, no database.", "excludes": "It does not record the run and it takes no lease — never use it while a scheduler still holds one.", "verifiedBy": "Quarterly game day: stop both schedulers, run a real task by hand." }, "survives": [ "lose-vin", "lose-uplink", "partition-mesh", "lose-nas" ], "worst": "manual", "worstToday": "break-glass" }, { "id": "cp-task-state", "name": "Durable state — the one database", "purpose": "Hold everything that cannot be recomputed: tasks, leases, workspaces, audit.", "criticality": "fleet-fatal", "entityId": "postgres-primary", "proposed": false, "status": "unknown", "stateClass": "durable", "state": { "store": "postgres-primary", "replicas": [ "postgres-replica" ], "rpoMinutes": 15, "note": "Streaming replication to VIN over the mesh, plus a backup tier that reaches offsite. The replica is a recovery source, not a second primary." }, "leadership": { "model": "static-primary", "candidates": [ "home1" ], "note": "Deliberately not an election. With two compute domains any automatic promotion is a partition away from two primaries, and one logical database with two writers is unrecoverable here." }, "instances": [ { "node": "home1", "role": "leader", "status": "running" }, { "node": "vin", "role": "standby", "status": "running", "note": "Read-only replica. Promotion is a human act, preceded by fencing." } ], "domains": [ "fd-home-rack", "fd-vps" ], "routing": { "mode": "dns", "entry": "internal-dns", "note": "Clients connect to db-primary.jarvis.internal. Flipping that record is a step in the promotion runbook, so no client holds a hard-coded primary address." }, "failover": { "trigger": "manual", "detectSec": 60, "decideSec": 300, "actSec": 600, "verifySec": 300, "steps": [ "Confirm the primary is genuinely gone, not merely unreachable from here.", "Fence it: stop the service and block its port, so it cannot return as a second writer.", "Read the replication lag. That number is the data-loss decision, and it is taken by a human, on purpose.", "Promote the replica.", "Flip db-primary.jarvis.internal to the new primary.", "Restart the scheduler candidates so they re-take the lease against the promoted store." ], "verify": "A write succeeds against the promoted primary and the scheduler dispatches a canary task.", "dataLoss": "Everything inside the replication lag at the moment of promotion.", "fencing": "By hand, before promotion. There is no third domain to arbitrate this.", "note": "The decide budget is five minutes because the decision is the expensive part, and rushing it is how an estate loses data it still had." }, "failoverBudgetSec": 1260, "degradedMode": "Reads continue from the replica. Writes stop until a promotion decision is taken.", "config": null, "telemetry": { "source": "node-agent", "sink": "jarvisos-status-console" }, "breakGlass": { "command": "psql -h 127.0.0.1 -U jarvis jarvis # on the node holding the data", "nodes": [ "home1", "vin" ], "requires": [ "shell on the node", "the database password in /etc/jarvisos/config.env (name only)" ], "requiresPlanes": [], "provides": "Direct SQL against whichever copy is reachable, including read-only inspection of the replica while deciding whether to promote.", "excludes": "It does not promote anything. Promotion is the runbook above, in order.", "verifiedBy": "Quarterly restore drill from the offsite copy." }, "survives": [ "lose-vin", "lose-uplink", "partition-mesh", "lose-nas" ], "worst": "manual", "worstToday": "manual" }, { "id": "cp-discovery", "name": "Service discovery and internal names", "purpose": "Answer 'where is this service right now?' — including after a leader has moved.", "criticality": "estate-critical", "entityId": "internal-dns", "proposed": false, "status": "unknown", "stateClass": "rebuildable", "state": { "store": null, "replicas": [], "note": "The zone is generated from the config repo. Both resolvers hold a complete copy; there is nothing to replicate at runtime and nothing to lose." }, "leadership": { "model": "stateless", "candidates": [ "home1", "vin" ], "note": "Both resolvers answer authoritatively for the same generated zone. No election, because two identical answers are not a conflict." }, "instances": [ { "node": "home1", "role": "active", "status": "running" }, { "node": "vin", "role": "active", "status": "planned", "note": "Secondary resolver, same zone, so a home-side loss does not take name resolution with it." } ], "domains": [ "fd-home-rack", "fd-vps" ], "routing": { "mode": "dns", "entry": "internal-dns", "note": "Every node lists both resolvers. Records for elected services carry a 30s TTL so a leader move is visible inside one takeover window." }, "failover": { "trigger": "automatic", "detectSec": 10, "decideSec": 0, "actSec": 5, "verifySec": 15, "steps": [ "The resolver stops answering.", "Clients fall through to the second resolver already in their resolv.conf.", "The zone is unchanged, because it was replicated before the fault." ], "verify": "A known name resolves to the expected address from a node in each partition.", "dataLoss": "None: the zone is configuration, not state.", "note": "The one automatic failover in this estate that is safe without a lease, precisely because it has no durable state to split." }, "failoverBudgetSec": 30, "degradedMode": "Cached names keep resolving. New or moved names do not, which is why the TTL on elected records is short and everything else is long.", "config": { "source": "jarvisos-config (zone source)", "distribution": "pull-replicated", "replicas": [ "home1", "vin" ], "staleServeSec": null }, "telemetry": { "source": "node-agent", "sink": "jarvisos-status-console" }, "breakGlass": { "command": "jarvisctl discovery dump --hosts | sudo tee /etc/hosts.d/jarvis", "nodes": [ "home1", "vin", "nas" ], "requires": [ "shell on the node", "the replicated zone source" ], "requiresPlanes": [ "cp-config" ], "provides": "Freezes the current name→address map into /etc/hosts on one node, so a machine keeps working with no resolver at all.", "excludes": "It is a snapshot. Anything that moves afterwards must be re-dumped by hand.", "verifiedBy": "Quarterly game day: stop both resolvers, dump, keep working." }, "survives": [ "lose-home1", "lose-vin", "lose-uplink", "partition-mesh", "lose-nas" ], "worst": "serving", "worstToday": "break-glass" }, { "id": "cp-config", "name": "Configuration distribution", "purpose": "Get the same declared configuration onto every node, and keep it there when its source is gone.", "criticality": "estate-critical", "entityId": null, "proposed": true, "status": null, "stateClass": "rebuildable", "state": { "store": null, "replicas": [], "note": "The source of truth is a git repository mirrored on home1 and included in the backup tier. Every node holds a full working copy, so the source is a convenience, not a dependency." }, "leadership": { "model": "stateless", "candidates": [ "home1", "vin" ], "note": "Nothing to elect: each node pulls for itself and applies to itself. A push-based distributor would be a control plane needing its own control plane." }, "instances": [ { "node": "home1", "role": "active", "status": "planned" }, { "node": "vin", "role": "active", "status": "planned" } ], "domains": [ "fd-home-rack", "fd-vps" ], "routing": { "mode": "node-local", "entry": null, "note": "Consumers read the local checkout. Nothing is fetched at request time, so a slow or missing source can never appear as a slow service." }, "failover": { "trigger": "none", "note": "There is nothing to fail over to: a node that cannot pull keeps running the last version it successfully applied." }, "failoverBudgetSec": null, "degradedMode": "Every node serves its last-good configuration indefinitely and says so. Changes wait; nothing stops.", "config": { "source": "jarvisos-config git repository (mirrored on home1, backed up offsite)", "distribution": "pull-replicated", "replicas": [ "home1", "vin", "nas" ], "staleServeSec": null, "note": "Pull, verify, apply, and only then swap the last-good symlink. A config that fails verification is never applied, so a bad commit cannot take the estate down at 3am." }, "telemetry": { "source": "node-agent", "sink": "jarvisos-status-console" }, "breakGlass": { "command": "jarvisctl config apply --from /var/lib/jarvisos/config/last-good", "nodes": [ "home1", "vin", "nas" ], "requires": [ "shell on the node" ], "requiresPlanes": [], "provides": "Re-applies the last known-good configuration from local disk with no network at all.", "verifiedBy": "Every boot: the same path is what a node uses when it cannot reach the source." }, "survives": [ "lose-home1", "lose-vin", "lose-uplink", "partition-mesh", "lose-nas" ], "worst": "serving", "worstToday": "break-glass" }, { "id": "cp-ingress", "name": "Ingress and health-based routing", "purpose": "Get an outside request to a healthy instance of the right service, and away from an unhealthy one.", "criticality": "fleet-fatal", "entityId": "caddy", "proposed": false, "status": "unknown", "stateClass": "rebuildable", "state": { "store": null, "replicas": [], "note": "TLS material is re-issuable by ACME. Nothing here is unique enough to be worth replicating." }, "leadership": { "model": "stateless", "candidates": [ "vin", "home1" ], "note": "Two independent proxies, same route table from the config repo. Which one serves is a DNS answer, not an election." }, "instances": [ { "node": "vin", "role": "active", "status": "running", "note": "The only public ingress today." }, { "node": "home1", "role": "active", "status": "planned", "note": "Second origin behind the same names, reachable through the tunnel from Cloudflare." } ], "domains": [ "fd-vps", "fd-home-rack" ], "routing": { "mode": "health-checked", "entry": "cloudflare-dns", "healthSignal": "HTTPS GET /healthz at each origin, expecting 200 and a matching build id", "intervalSec": 60, "unhealthyAfter": 2, "drainSec": 30, "note": "Origin health decides which origin receives traffic. The check asks a route to answer, not a port to accept — an accept-only check reports a wedged proxy as healthy." }, "failover": { "trigger": "automatic", "detectSec": 120, "decideSec": 0, "actSec": 60, "verifySec": 60, "steps": [ "Two consecutive origin health checks fail.", "The edge stops sending that origin traffic; in-flight requests drain for 30s.", "The surviving origin serves the same routes from the same replicated route table." ], "verify": "A published route returns 200 through the edge, from a network outside the estate.", "dataLoss": "None.", "note": "Detection is slow because the edge is a vendor and its check interval is not ours to set. That is the price of not running our own anycast." }, "failoverBudgetSec": 240, "degradedMode": "Published names stop resolving to a working origin. Loopback and LAN access continue, and the SSH tunnel below is the way in.", "config": { "source": "jarvisos-config (route table, forward-auth policy)", "distribution": "pull-replicated", "replicas": [ "home1", "vin" ], "staleServeSec": null, "note": "Both origins must be able to serve every route from local config, or the second origin is decoration." }, "telemetry": { "source": "jarvisai-telemetry", "sink": "jarvisos-status-console" }, "breakGlass": { "command": "ssh -N -L 8787:127.0.0.1:8787 operator@", "nodes": [ "home1", "vin" ], "requires": [ "shell on the node", "the operator SSH key" ], "requiresPlanes": [], "provides": "Direct loopback access to every service on a node without the proxy, without DNS and without forward-auth.", "excludes": "One node at a time, one operator at a time. It is not a way to keep serving users.", "verifiedBy": "Used routinely — this is how the recovery console is reached at all." }, "survives": [ "lose-home1", "lose-vin", "lose-uplink", "partition-mesh", "lose-nas" ], "worst": "degraded", "worstToday": "break-glass" }, { "id": "cp-ai-routing", "name": "JarvisAI Proxy — model request routing", "purpose": "Take a model request, choose a healthy provider, enforce budget and policy, and return an answer or a typed failure — never a hang.", "criticality": "fleet-fatal", "entityId": null, "proposed": true, "status": null, "stateClass": "ephemeral", "state": { "store": null, "replicas": [], "note": "Rate-limit counters, circuit-breaker state and in-flight requests are node-local and best-effort. Sharing them would make every model call depend on a database; losing them costs a slightly generous rate limit for one interval, which is the right trade." }, "leadership": { "model": "stateless", "candidates": [ "vin", "home1" ], "note": "Every instance is equivalent and holds nothing. This is the whole reason the proxy can be the front door: it is the one control-plane function with nothing to elect." }, "instances": [ { "node": "vin", "role": "active", "status": "planned", "note": "Serves published clients next to the ingress." }, { "node": "home1", "role": "active", "status": "planned", "note": "Serves home-side workers without crossing the mesh." } ], "domains": [ "fd-vps", "fd-home-rack" ], "routing": { "mode": "health-checked", "entry": "caddy", "healthPath": "/healthz", "intervalSec": 5, "unhealthyAfter": 3, "drainSec": 20, "note": "Two levels of health: the estate routes away from an unhealthy proxy, and each proxy routes away from an unhealthy provider. The second is what makes a provider outage look like a slower answer instead of an incident." }, "failover": { "trigger": "automatic", "detectSec": 15, "decideSec": 0, "actSec": 5, "verifySec": 10, "steps": [ "An instance fails three consecutive 5s health checks.", "The router drains it over 20s and sends new requests to the other instance.", "Provider-level circuit breakers are rebuilt locally within one interval; nothing is transferred." ], "verify": "A real completion round-trips through the surviving instance.", "dataLoss": "In-flight requests only, and those are retried by the caller with the same idempotency key.", "note": "Provider failover is separate and continuous: each request is tried against the healthiest provider that satisfies its policy, with a hard timeout and a typed error rather than a hang." }, "failoverBudgetSec": 30, "degradedMode": "Cached and locally-servable responses continue. Every hosted provider call fails fast with a typed, logged error instead of hanging, so callers degrade rather than pile up.", "config": { "source": "jarvisos-config (provider routing table, budgets, model policy)", "distribution": "pull-replicated", "replicas": [ "home1", "vin" ], "staleServeSec": 86400, "note": "Provider keys are read from /etc/jarvisos/config.env on each node (names only in this file). The routing table is config; the credentials are not, and they never travel together." }, "telemetry": { "source": "jarvisai-telemetry", "sink": "jarvisos-status-console", "note": "The proxy emits structured per-request telemetry — provider, model, latency, tokens, outcome, budget. This is the interface the dashboard consumes; no consumer parses a provider's logs." }, "breakGlass": { "command": "jarvisctl ai call --direct --provider --model -", "nodes": [ "home1", "vin" ], "requires": [ "shell on the node", "a provider key named in /etc/jarvisos/config.env (name only; the value never appears in config or telemetry)" ], "requiresPlanes": [], "provides": "One request straight to one provider, bypassing the proxy, its policy and its budget entirely.", "excludes": "No budget enforcement, no telemetry, no fallback. It is for proving a provider works, not for doing work.", "verifiedBy": "Quarterly game day, and any time a provider is suspected." }, "survives": [ "lose-home1", "lose-vin", "lose-uplink", "partition-mesh", "lose-nas" ], "worst": "degraded", "worstToday": "break-glass" }, { "id": "cp-telemetry", "name": "Telemetry ingest and dashboard data", "purpose": "Turn what actually happened into something the dashboard and the incident log can read.", "criticality": "degraded-tolerable", "entityId": null, "proposed": true, "status": null, "stateClass": "ephemeral", "state": { "store": null, "replicas": [], "note": "Observations are in-memory per console and rebuilt from heartbeats within one interval. Only incidents are written to disk, and only locally." }, "leadership": { "model": "stateless", "candidates": [ "home1", "vin" ], "note": "Every node runs its own consumer. There is no aggregation tier to lose." }, "instances": [ { "node": "vin", "role": "active", "status": "running" }, { "node": "home1", "role": "active", "status": "planned" } ], "domains": [ "fd-vps", "fd-home-rack" ], "routing": { "mode": "node-local", "entry": null, "note": "Producers POST to the console on their own node over loopback. Nothing is published, and no new listener is opened." }, "failover": { "trigger": "none", "note": "Each consumer is independent; losing one costs that node's view, not the estate's." }, "failoverBudgetSec": null, "degradedMode": "The dashboard shows the last snapshot each console holds, labelled stale. Judgement moves to the node's own logs.", "config": null, "telemetry": { "source": "provider-log-parsing", "target": "jarvisai-telemetry", "migrateBy": "2026-10-31", "sink": "jarvisos-status-console", "note": "Today the dashboard's model-usage numbers come from parsing provider logs. That is a format nobody promised us, it stops existing the moment the provider is unreachable, and it cannot report a request the provider never received. The target is the proxy's own telemetry stream, consumed through the existing heartbeat ingest." }, "breakGlass": { "command": "jarvisctl telemetry tail --local", "nodes": [ "home1", "vin" ], "requires": [ "shell on the node" ], "requiresPlanes": [], "provides": "The raw local telemetry stream on a terminal, with no console, no dashboard and no ingest token.", "verifiedBy": "Quarterly game day." }, "survives": [ "lose-home1", "lose-vin", "lose-uplink", "partition-mesh", "lose-nas" ], "worst": "serving", "worstToday": "break-glass" }, { "id": "cp-console", "name": "Operator console and runbooks", "purpose": "Tell the operator what is broken and what to do about it — especially when everything else is broken.", "criticality": "estate-critical", "entityId": null, "proposed": true, "status": null, "stateClass": "none", "state": null, "leadership": { "model": "stateless", "candidates": [ "home1", "vin", "nas" ], "note": "One console per node, each independent, each loopback-only. Deliberately not an inventory entity: the console must never be something it monitors." }, "instances": [ { "node": "vin", "role": "active", "status": "running" }, { "node": "home1", "role": "active", "status": "planned" }, { "node": "nas", "role": "active", "status": "planned" } ], "domains": [ "fd-vps", "fd-home-rack" ], "routing": { "mode": "node-local", "entry": null, "note": "Reached over an SSH tunnel to 127.0.0.1. No public listener, ever." }, "failover": { "trigger": "none", "note": "Nothing to fail over: every node has one, and they do not depend on each other." }, "failoverBudgetSec": null, "degradedMode": "The PWA serves its offline shell with the last cached snapshot, labelled stale, from the operator's phone.", "config": null, "telemetry": { "source": "node-agent", "sink": "jarvisos-status-console" }, "breakGlass": { "command": "less docs/RECOVERY.md", "nodes": [ "home1", "vin", "nas" ], "requires": [ "shell on the node, or the printed copy" ], "requiresPlanes": [], "provides": "Every runbook in plain text, readable with no console, no browser and no network.", "verifiedBy": "Reviewed whenever a runbook changes; printed copy refreshed quarterly." }, "survives": [ "lose-home1", "lose-vin", "lose-uplink", "partition-mesh", "lose-nas" ], "worst": "serving", "worstToday": "break-glass" } ], "matrix": [ { "posture": "target", "planeId": "cp-identity", "scenarioId": "lose-home1", "outcome": "degraded", "seconds": null, "notes": [ "redis is on the other side of the break.", "Existing sessions keep verifying. New logins fail while Google or the session store is unreachable, and the break-glass token is the way in." ], "concurrentWriters": 0, "partitions": [ { "id": "vps", "operator": true, "outcome": "degraded", "writable": false }, { "id": "home-lan", "operator": false, "outcome": "lost", "writable": false } ] }, { "posture": "target", "planeId": "cp-identity", "scenarioId": "lose-vin", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": true } ] }, { "posture": "target", "planeId": "cp-identity", "scenarioId": "lose-uplink", "outcome": "degraded", "seconds": null, "notes": [ "google-oauth is unreachable from here: Existing sessions keep verifying. New logins fail while Google or the session store is unreachable, and the break-glass token is the way in." ], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "degraded", "writable": false }, { "id": "vps", "operator": false, "outcome": "degraded", "writable": false } ] }, { "posture": "target", "planeId": "cp-identity", "scenarioId": "partition-mesh", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": true }, { "id": "vps", "operator": false, "outcome": "degraded", "writable": false } ] }, { "posture": "target", "planeId": "cp-identity", "scenarioId": "lose-nas", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "estate", "operator": true, "outcome": "serving", "writable": true } ] }, { "posture": "target", "planeId": "cp-scheduling", "scenarioId": "lose-home1", "outcome": "manual", "seconds": 75, "notes": [ "postgres-primary is on the other side of the break.", "A replica is reachable, so reads continue; writes resume once postgres-replica is promoted." ], "concurrentWriters": 0, "partitions": [ { "id": "vps", "operator": true, "outcome": "manual", "writable": false }, { "id": "home-lan", "operator": false, "outcome": "lost", "writable": false } ] }, { "posture": "target", "planeId": "cp-scheduling", "scenarioId": "lose-vin", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 1, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": true } ] }, { "posture": "target", "planeId": "cp-scheduling", "scenarioId": "lose-uplink", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 1, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": true }, { "id": "vps", "operator": false, "outcome": "manual", "writable": false } ] }, { "posture": "target", "planeId": "cp-scheduling", "scenarioId": "partition-mesh", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 1, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": true }, { "id": "vps", "operator": false, "outcome": "manual", "writable": false } ] }, { "posture": "target", "planeId": "cp-scheduling", "scenarioId": "lose-nas", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 1, "partitions": [ { "id": "estate", "operator": true, "outcome": "serving", "writable": true } ] }, { "posture": "target", "planeId": "cp-task-state", "scenarioId": "lose-home1", "outcome": "manual", "seconds": 1260, "notes": [ "postgres-primary is on the other side of the break.", "A replica is reachable, so reads continue; writes resume once postgres-replica is promoted." ], "concurrentWriters": 0, "partitions": [ { "id": "vps", "operator": true, "outcome": "manual", "writable": false }, { "id": "home-lan", "operator": false, "outcome": "lost", "writable": false } ] }, { "posture": "target", "planeId": "cp-task-state", "scenarioId": "lose-vin", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 1, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": true } ] }, { "posture": "target", "planeId": "cp-task-state", "scenarioId": "lose-uplink", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 1, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": true }, { "id": "vps", "operator": false, "outcome": "manual", "writable": false } ] }, { "posture": "target", "planeId": "cp-task-state", "scenarioId": "partition-mesh", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 1, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": true }, { "id": "vps", "operator": false, "outcome": "manual", "writable": false } ] }, { "posture": "target", "planeId": "cp-task-state", "scenarioId": "lose-nas", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 1, "partitions": [ { "id": "estate", "operator": true, "outcome": "serving", "writable": true } ] }, { "posture": "target", "planeId": "cp-discovery", "scenarioId": "lose-home1", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "vps", "operator": true, "outcome": "serving", "writable": false }, { "id": "home-lan", "operator": false, "outcome": "break-glass", "writable": false } ] }, { "posture": "target", "planeId": "cp-discovery", "scenarioId": "lose-vin", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": false } ] }, { "posture": "target", "planeId": "cp-discovery", "scenarioId": "lose-uplink", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": false }, { "id": "vps", "operator": false, "outcome": "serving", "writable": false } ] }, { "posture": "target", "planeId": "cp-discovery", "scenarioId": "partition-mesh", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": false }, { "id": "vps", "operator": false, "outcome": "serving", "writable": false } ] }, { "posture": "target", "planeId": "cp-discovery", "scenarioId": "lose-nas", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "estate", "operator": true, "outcome": "serving", "writable": false } ] }, { "posture": "target", "planeId": "cp-config", "scenarioId": "lose-home1", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "vps", "operator": true, "outcome": "serving", "writable": false }, { "id": "home-lan", "operator": false, "outcome": "break-glass", "writable": false } ] }, { "posture": "target", "planeId": "cp-config", "scenarioId": "lose-vin", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": false } ] }, { "posture": "target", "planeId": "cp-config", "scenarioId": "lose-uplink", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": false }, { "id": "vps", "operator": false, "outcome": "serving", "writable": false } ] }, { "posture": "target", "planeId": "cp-config", "scenarioId": "partition-mesh", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": false }, { "id": "vps", "operator": false, "outcome": "serving", "writable": false } ] }, { "posture": "target", "planeId": "cp-config", "scenarioId": "lose-nas", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "estate", "operator": true, "outcome": "serving", "writable": false } ] }, { "posture": "target", "planeId": "cp-ingress", "scenarioId": "lose-home1", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "vps", "operator": true, "outcome": "serving", "writable": false }, { "id": "home-lan", "operator": false, "outcome": "lost", "writable": false } ] }, { "posture": "target", "planeId": "cp-ingress", "scenarioId": "lose-vin", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": false } ] }, { "posture": "target", "planeId": "cp-ingress", "scenarioId": "lose-uplink", "outcome": "degraded", "seconds": null, "notes": [ "cloudflare-dns is unreachable from here: Published names stop resolving to a working origin. Loopback and LAN access continue, and the SSH tunnel below is the way in." ], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "degraded", "writable": false }, { "id": "vps", "operator": false, "outcome": "serving", "writable": false } ] }, { "posture": "target", "planeId": "cp-ingress", "scenarioId": "partition-mesh", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": false }, { "id": "vps", "operator": false, "outcome": "serving", "writable": false } ] }, { "posture": "target", "planeId": "cp-ingress", "scenarioId": "lose-nas", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "estate", "operator": true, "outcome": "serving", "writable": false } ] }, { "posture": "target", "planeId": "cp-ai-routing", "scenarioId": "lose-home1", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "vps", "operator": true, "outcome": "serving", "writable": false }, { "id": "home-lan", "operator": false, "outcome": "lost", "writable": false } ] }, { "posture": "target", "planeId": "cp-ai-routing", "scenarioId": "lose-vin", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": false } ] }, { "posture": "target", "planeId": "cp-ai-routing", "scenarioId": "lose-uplink", "outcome": "degraded", "seconds": null, "notes": [ "isp-uplink is unreachable from here: Cached and locally-servable responses continue. Every hosted provider call fails fast with a typed, logged error instead of hanging, so callers degrade rather than pile up." ], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "degraded", "writable": false }, { "id": "vps", "operator": false, "outcome": "serving", "writable": false } ] }, { "posture": "target", "planeId": "cp-ai-routing", "scenarioId": "partition-mesh", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": false }, { "id": "vps", "operator": false, "outcome": "serving", "writable": false } ] }, { "posture": "target", "planeId": "cp-ai-routing", "scenarioId": "lose-nas", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "estate", "operator": true, "outcome": "serving", "writable": false } ] }, { "posture": "target", "planeId": "cp-telemetry", "scenarioId": "lose-home1", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "vps", "operator": true, "outcome": "serving", "writable": false }, { "id": "home-lan", "operator": false, "outcome": "lost", "writable": false } ] }, { "posture": "target", "planeId": "cp-telemetry", "scenarioId": "lose-vin", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": false } ] }, { "posture": "target", "planeId": "cp-telemetry", "scenarioId": "lose-uplink", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": false }, { "id": "vps", "operator": false, "outcome": "serving", "writable": false } ] }, { "posture": "target", "planeId": "cp-telemetry", "scenarioId": "partition-mesh", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": false }, { "id": "vps", "operator": false, "outcome": "serving", "writable": false } ] }, { "posture": "target", "planeId": "cp-telemetry", "scenarioId": "lose-nas", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "estate", "operator": true, "outcome": "serving", "writable": false } ] }, { "posture": "target", "planeId": "cp-console", "scenarioId": "lose-home1", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "vps", "operator": true, "outcome": "serving", "writable": false }, { "id": "home-lan", "operator": false, "outcome": "serving", "writable": false } ] }, { "posture": "target", "planeId": "cp-console", "scenarioId": "lose-vin", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": false } ] }, { "posture": "target", "planeId": "cp-console", "scenarioId": "lose-uplink", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": false }, { "id": "vps", "operator": false, "outcome": "serving", "writable": false } ] }, { "posture": "target", "planeId": "cp-console", "scenarioId": "partition-mesh", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": false }, { "id": "vps", "operator": false, "outcome": "serving", "writable": false } ] }, { "posture": "target", "planeId": "cp-console", "scenarioId": "lose-nas", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "estate", "operator": true, "outcome": "serving", "writable": false } ] }, { "posture": "current", "planeId": "cp-identity", "scenarioId": "lose-home1", "outcome": "degraded", "seconds": null, "notes": [ "redis is on the other side of the break.", "Existing sessions keep verifying. New logins fail while Google or the session store is unreachable, and the break-glass token is the way in." ], "concurrentWriters": 0, "partitions": [ { "id": "vps", "operator": true, "outcome": "degraded", "writable": false }, { "id": "home-lan", "operator": false, "outcome": "lost", "writable": false } ] }, { "posture": "current", "planeId": "cp-identity", "scenarioId": "lose-vin", "outcome": "break-glass", "seconds": null, "notes": [ "No instance of this plane runs on this side of the break.", "Only the native path works here: jarvisctl auth mint --offline --role operator --ttl 15m" ], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "break-glass", "writable": false } ] }, { "posture": "current", "planeId": "cp-identity", "scenarioId": "lose-uplink", "outcome": "break-glass", "seconds": null, "notes": [ "No instance of this plane runs on this side of the break.", "Only the native path works here: jarvisctl auth mint --offline --role operator --ttl 15m" ], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "break-glass", "writable": false }, { "id": "vps", "operator": false, "outcome": "degraded", "writable": false } ] }, { "posture": "current", "planeId": "cp-identity", "scenarioId": "partition-mesh", "outcome": "break-glass", "seconds": null, "notes": [ "No instance of this plane runs on this side of the break.", "Only the native path works here: jarvisctl auth mint --offline --role operator --ttl 15m" ], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "break-glass", "writable": false }, { "id": "vps", "operator": false, "outcome": "degraded", "writable": false } ] }, { "posture": "current", "planeId": "cp-identity", "scenarioId": "lose-nas", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "estate", "operator": true, "outcome": "serving", "writable": true } ] }, { "posture": "current", "planeId": "cp-scheduling", "scenarioId": "lose-home1", "outcome": "break-glass", "seconds": null, "notes": [ "No instance of this plane runs on this side of the break.", "Only the native path works here: jarvisctl task run --local --fence-off" ], "concurrentWriters": 0, "partitions": [ { "id": "vps", "operator": true, "outcome": "break-glass", "writable": false }, { "id": "home-lan", "operator": false, "outcome": "lost", "writable": false } ] }, { "posture": "current", "planeId": "cp-scheduling", "scenarioId": "lose-vin", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 1, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": true } ] }, { "posture": "current", "planeId": "cp-scheduling", "scenarioId": "lose-uplink", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 1, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": true }, { "id": "vps", "operator": false, "outcome": "break-glass", "writable": false } ] }, { "posture": "current", "planeId": "cp-scheduling", "scenarioId": "partition-mesh", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 1, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": true }, { "id": "vps", "operator": false, "outcome": "break-glass", "writable": false } ] }, { "posture": "current", "planeId": "cp-scheduling", "scenarioId": "lose-nas", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 1, "partitions": [ { "id": "estate", "operator": true, "outcome": "serving", "writable": true } ] }, { "posture": "current", "planeId": "cp-task-state", "scenarioId": "lose-home1", "outcome": "manual", "seconds": 1260, "notes": [ "postgres-primary is on the other side of the break.", "A replica is reachable, so reads continue; writes resume once postgres-replica is promoted." ], "concurrentWriters": 0, "partitions": [ { "id": "vps", "operator": true, "outcome": "manual", "writable": false }, { "id": "home-lan", "operator": false, "outcome": "lost", "writable": false } ] }, { "posture": "current", "planeId": "cp-task-state", "scenarioId": "lose-vin", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 1, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": true } ] }, { "posture": "current", "planeId": "cp-task-state", "scenarioId": "lose-uplink", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 1, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": true }, { "id": "vps", "operator": false, "outcome": "manual", "writable": false } ] }, { "posture": "current", "planeId": "cp-task-state", "scenarioId": "partition-mesh", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 1, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": true }, { "id": "vps", "operator": false, "outcome": "manual", "writable": false } ] }, { "posture": "current", "planeId": "cp-task-state", "scenarioId": "lose-nas", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 1, "partitions": [ { "id": "estate", "operator": true, "outcome": "serving", "writable": true } ] }, { "posture": "current", "planeId": "cp-discovery", "scenarioId": "lose-home1", "outcome": "break-glass", "seconds": null, "notes": [ "No instance of this plane runs on this side of the break.", "Only the native path works here: jarvisctl discovery dump --hosts | sudo tee /etc/hosts.d/jarvis" ], "concurrentWriters": 0, "partitions": [ { "id": "vps", "operator": true, "outcome": "break-glass", "writable": false }, { "id": "home-lan", "operator": false, "outcome": "break-glass", "writable": false } ] }, { "posture": "current", "planeId": "cp-discovery", "scenarioId": "lose-vin", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": false } ] }, { "posture": "current", "planeId": "cp-discovery", "scenarioId": "lose-uplink", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": false }, { "id": "vps", "operator": false, "outcome": "break-glass", "writable": false } ] }, { "posture": "current", "planeId": "cp-discovery", "scenarioId": "partition-mesh", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "serving", "writable": false }, { "id": "vps", "operator": false, "outcome": "break-glass", "writable": false } ] }, { "posture": "current", "planeId": "cp-discovery", "scenarioId": "lose-nas", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "estate", "operator": true, "outcome": "serving", "writable": false } ] }, { "posture": "current", "planeId": "cp-config", "scenarioId": "lose-home1", "outcome": "break-glass", "seconds": null, "notes": [ "No instance of this plane runs on this side of the break.", "Only the native path works here: jarvisctl config apply --from /var/lib/jarvisos/config/last-good" ], "concurrentWriters": 0, "partitions": [ { "id": "vps", "operator": true, "outcome": "break-glass", "writable": false }, { "id": "home-lan", "operator": false, "outcome": "break-glass", "writable": false } ] }, { "posture": "current", "planeId": "cp-config", "scenarioId": "lose-vin", "outcome": "break-glass", "seconds": null, "notes": [ "No instance of this plane runs on this side of the break.", "Only the native path works here: jarvisctl config apply --from /var/lib/jarvisos/config/last-good" ], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "break-glass", "writable": false } ] }, { "posture": "current", "planeId": "cp-config", "scenarioId": "lose-uplink", "outcome": "break-glass", "seconds": null, "notes": [ "No instance of this plane runs on this side of the break.", "Only the native path works here: jarvisctl config apply --from /var/lib/jarvisos/config/last-good" ], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "break-glass", "writable": false }, { "id": "vps", "operator": false, "outcome": "break-glass", "writable": false } ] }, { "posture": "current", "planeId": "cp-config", "scenarioId": "partition-mesh", "outcome": "break-glass", "seconds": null, "notes": [ "No instance of this plane runs on this side of the break.", "Only the native path works here: jarvisctl config apply --from /var/lib/jarvisos/config/last-good" ], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "break-glass", "writable": false }, { "id": "vps", "operator": false, "outcome": "break-glass", "writable": false } ] }, { "posture": "current", "planeId": "cp-config", "scenarioId": "lose-nas", "outcome": "break-glass", "seconds": null, "notes": [ "No instance of this plane runs on this side of the break.", "Only the native path works here: jarvisctl config apply --from /var/lib/jarvisos/config/last-good" ], "concurrentWriters": 0, "partitions": [ { "id": "estate", "operator": true, "outcome": "break-glass", "writable": false } ] }, { "posture": "current", "planeId": "cp-ingress", "scenarioId": "lose-home1", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "vps", "operator": true, "outcome": "serving", "writable": false }, { "id": "home-lan", "operator": false, "outcome": "lost", "writable": false } ] }, { "posture": "current", "planeId": "cp-ingress", "scenarioId": "lose-vin", "outcome": "break-glass", "seconds": null, "notes": [ "No instance of this plane runs on this side of the break.", "Only the native path works here: ssh -N -L 8787:127.0.0.1:8787 operator@" ], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "break-glass", "writable": false } ] }, { "posture": "current", "planeId": "cp-ingress", "scenarioId": "lose-uplink", "outcome": "break-glass", "seconds": null, "notes": [ "No instance of this plane runs on this side of the break.", "Only the native path works here: ssh -N -L 8787:127.0.0.1:8787 operator@" ], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "break-glass", "writable": false }, { "id": "vps", "operator": false, "outcome": "serving", "writable": false } ] }, { "posture": "current", "planeId": "cp-ingress", "scenarioId": "partition-mesh", "outcome": "break-glass", "seconds": null, "notes": [ "No instance of this plane runs on this side of the break.", "Only the native path works here: ssh -N -L 8787:127.0.0.1:8787 operator@" ], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "break-glass", "writable": false }, { "id": "vps", "operator": false, "outcome": "serving", "writable": false } ] }, { "posture": "current", "planeId": "cp-ingress", "scenarioId": "lose-nas", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "estate", "operator": true, "outcome": "serving", "writable": false } ] }, { "posture": "current", "planeId": "cp-ai-routing", "scenarioId": "lose-home1", "outcome": "break-glass", "seconds": null, "notes": [ "No instance of this plane runs on this side of the break.", "Only the native path works here: jarvisctl ai call --direct --provider --model -" ], "concurrentWriters": 0, "partitions": [ { "id": "vps", "operator": true, "outcome": "break-glass", "writable": false }, { "id": "home-lan", "operator": false, "outcome": "lost", "writable": false } ] }, { "posture": "current", "planeId": "cp-ai-routing", "scenarioId": "lose-vin", "outcome": "break-glass", "seconds": null, "notes": [ "No instance of this plane runs on this side of the break.", "Only the native path works here: jarvisctl ai call --direct --provider --model -" ], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "break-glass", "writable": false } ] }, { "posture": "current", "planeId": "cp-ai-routing", "scenarioId": "lose-uplink", "outcome": "break-glass", "seconds": null, "notes": [ "No instance of this plane runs on this side of the break.", "Only the native path works here: jarvisctl ai call --direct --provider --model -" ], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "break-glass", "writable": false }, { "id": "vps", "operator": false, "outcome": "break-glass", "writable": false } ] }, { "posture": "current", "planeId": "cp-ai-routing", "scenarioId": "partition-mesh", "outcome": "break-glass", "seconds": null, "notes": [ "No instance of this plane runs on this side of the break.", "Only the native path works here: jarvisctl ai call --direct --provider --model -" ], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "break-glass", "writable": false }, { "id": "vps", "operator": false, "outcome": "break-glass", "writable": false } ] }, { "posture": "current", "planeId": "cp-ai-routing", "scenarioId": "lose-nas", "outcome": "break-glass", "seconds": null, "notes": [ "No instance of this plane runs on this side of the break.", "Only the native path works here: jarvisctl ai call --direct --provider --model -" ], "concurrentWriters": 0, "partitions": [ { "id": "estate", "operator": true, "outcome": "break-glass", "writable": false } ] }, { "posture": "current", "planeId": "cp-telemetry", "scenarioId": "lose-home1", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "vps", "operator": true, "outcome": "serving", "writable": false }, { "id": "home-lan", "operator": false, "outcome": "lost", "writable": false } ] }, { "posture": "current", "planeId": "cp-telemetry", "scenarioId": "lose-vin", "outcome": "break-glass", "seconds": null, "notes": [ "No instance of this plane runs on this side of the break.", "Only the native path works here: jarvisctl telemetry tail --local" ], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "break-glass", "writable": false } ] }, { "posture": "current", "planeId": "cp-telemetry", "scenarioId": "lose-uplink", "outcome": "break-glass", "seconds": null, "notes": [ "No instance of this plane runs on this side of the break.", "Only the native path works here: jarvisctl telemetry tail --local" ], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "break-glass", "writable": false }, { "id": "vps", "operator": false, "outcome": "serving", "writable": false } ] }, { "posture": "current", "planeId": "cp-telemetry", "scenarioId": "partition-mesh", "outcome": "break-glass", "seconds": null, "notes": [ "No instance of this plane runs on this side of the break.", "Only the native path works here: jarvisctl telemetry tail --local" ], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "break-glass", "writable": false }, { "id": "vps", "operator": false, "outcome": "serving", "writable": false } ] }, { "posture": "current", "planeId": "cp-telemetry", "scenarioId": "lose-nas", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "estate", "operator": true, "outcome": "serving", "writable": false } ] }, { "posture": "current", "planeId": "cp-console", "scenarioId": "lose-home1", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "vps", "operator": true, "outcome": "serving", "writable": false }, { "id": "home-lan", "operator": false, "outcome": "break-glass", "writable": false } ] }, { "posture": "current", "planeId": "cp-console", "scenarioId": "lose-vin", "outcome": "break-glass", "seconds": null, "notes": [ "No instance of this plane runs on this side of the break.", "Only the native path works here: less docs/RECOVERY.md" ], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "break-glass", "writable": false } ] }, { "posture": "current", "planeId": "cp-console", "scenarioId": "lose-uplink", "outcome": "break-glass", "seconds": null, "notes": [ "No instance of this plane runs on this side of the break.", "Only the native path works here: less docs/RECOVERY.md" ], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "break-glass", "writable": false }, { "id": "vps", "operator": false, "outcome": "serving", "writable": false } ] }, { "posture": "current", "planeId": "cp-console", "scenarioId": "partition-mesh", "outcome": "break-glass", "seconds": null, "notes": [ "No instance of this plane runs on this side of the break.", "Only the native path works here: less docs/RECOVERY.md" ], "concurrentWriters": 0, "partitions": [ { "id": "home", "operator": true, "outcome": "break-glass", "writable": false }, { "id": "vps", "operator": false, "outcome": "serving", "writable": false } ] }, { "posture": "current", "planeId": "cp-console", "scenarioId": "lose-nas", "outcome": "serving", "seconds": null, "notes": [], "concurrentWriters": 0, "partitions": [ { "id": "estate", "operator": true, "outcome": "serving", "writable": false } ] } ], "findings": [ { "code": "telemetry-source-transitional", "severity": "gap", "title": "The dashboard reads a transitional telemetry source.", "planeId": "cp-telemetry", "scenarioId": null, "detail": "Telemetry ingest and dashboard data is measured by parsing provider logs. The dashboard should consume JarvisAI telemetry: a log format is not an interface, and it stops existing the moment the provider is unreachable.", "acceptance": null }, { "code": "design-not-adopted", "severity": "note", "title": "The design survives only because of instances that are not running yet.", "planeId": "cp-identity", "scenarioId": null, "detail": "Identity — session issue and verification survives \"VIN (the VPS) is gone\", \"Home internet is down\", \"The mesh is partitioned\" only once the planned instance on home1 is actually running. Today that path is break-glass.", "acceptance": null }, { "code": "design-not-adopted", "severity": "note", "title": "The design survives only because of instances that are not running yet.", "planeId": "cp-discovery", "scenarioId": null, "detail": "Service discovery and internal names survives \"Home1 is gone\" only once the planned instance on vin is actually running. Today that path is break-glass.", "acceptance": null }, { "code": "design-not-adopted", "severity": "note", "title": "The design survives only because of instances that are not running yet.", "planeId": "cp-config", "scenarioId": null, "detail": "Configuration distribution survives \"Home1 is gone\", \"VIN (the VPS) is gone\", \"Home internet is down\", \"The mesh is partitioned\", \"The NAS is gone\" only once the planned instances on home1, vin are actually running. Today that path is break-glass.", "acceptance": null }, { "code": "design-not-adopted", "severity": "note", "title": "The design survives only because of instances that are not running yet.", "planeId": "cp-ingress", "scenarioId": null, "detail": "Ingress and health-based routing survives \"VIN (the VPS) is gone\", \"Home internet is down\", \"The mesh is partitioned\" only once the planned instance on home1 is actually running. Today that path is break-glass.", "acceptance": null }, { "code": "design-not-adopted", "severity": "note", "title": "The design survives only because of instances that are not running yet.", "planeId": "cp-ai-routing", "scenarioId": null, "detail": "JarvisAI Proxy — model request routing survives \"Home1 is gone\", \"VIN (the VPS) is gone\", \"Home internet is down\", \"The mesh is partitioned\", \"The NAS is gone\" only once the planned instances on vin, home1 are actually running. Today that path is break-glass.", "acceptance": null }, { "code": "design-not-adopted", "severity": "note", "title": "The design survives only because of instances that are not running yet.", "planeId": "cp-telemetry", "scenarioId": null, "detail": "Telemetry ingest and dashboard data survives \"VIN (the VPS) is gone\", \"Home internet is down\", \"The mesh is partitioned\" only once the planned instance on home1 is actually running. Today that path is break-glass.", "acceptance": null }, { "code": "design-not-adopted", "severity": "note", "title": "The design survives only because of instances that are not running yet.", "planeId": "cp-console", "scenarioId": null, "detail": "Operator console and runbooks survives \"VIN (the VPS) is gone\", \"Home internet is down\", \"The mesh is partitioned\" only once the planned instances on home1, nas are actually running. Today that path is break-glass.", "acceptance": null } ] }