Dependencies & blast radius
26 things · 35 edges · 12 capabilities
What breaks if something disappears, and which recovery action gives the most back soonest. Edges come from
the declared inventory, the curated catalogue and what collectors observed; the manual layer in
config/dependency-graph.json adds the ones nothing can see and the redundancy statements that
make "either of these will do" expressible. Every edge names the layer that claimed it.
Capability points are an operator ranking, compared only with each other. Machine readable at /api/v1/graph; one query at /api/v1/graph/blast/<id>.
If Tailscale daemon (VIN) disappears
0 of 162 capability points lostLosing Tailscale daemon (VIN) takes nothing else with it and costs no declared capability.
Nothing else depends on it.
Getting it back
No declared action restores this, so the ranking can only offer the contract default. That is a gap in config/dependency-graph.json, not a fact about the estate.
Ask the graph
Pick one, or pass?lose=a,b
What breaks if this disappears right now?
Single points of failure
Loss of this one thing costs a capability| Thing | Costs | Takes with it | Fastest way back |
|---|---|---|---|
|
ISP Uplink
external
critical No signal |
90
Published web, Sign-in, JarvisOS orchestration, Offsite recovery, Public name resolution, Private access to the estate |
11
8 critical-tier |
nothing declared |
|
VIN / VPS
critical No signal |
86
Published web, Sign-in, JarvisOS orchestration, JarvisAI agent surface, Private access to the estate, Knowing what is broken |
12
5 critical-tier |
Reboot VIN 10m · disruptive |
|
Home1
critical No signal |
60
Sign-in, JarvisOS orchestration, Data writes, Internal name resolution |
6
3 critical-tier |
Restore power and boot Home1 30m · disruptive |
|
Public DNS
external
critical No signal |
36
Published web, Public name resolution |
1
1 critical-tier |
Re-point the public DNS records 30m · disruptive |
|
Google OAuth
external
critical No signal |
34
Sign-in, JarvisOS orchestration |
3
2 critical-tier |
nothing declared |
|
Redis (cache / queue)
important No signal |
34
Sign-in, JarvisOS orchestration |
3
2 critical-tier |
Restart Redis on Home1 2m · disruptive |
|
JarvisOS Auth (SSO)
critical No signal |
34
Sign-in, JarvisOS orchestration |
2
1 critical-tier |
Restart JarvisOS Auth on VIN 3m · disruptive |
|
NAS
critical No signal |
22
On-site backups, Offsite recovery |
3
2 critical-tier |
Bring the NAS back 1h · disruptive |
|
NAS backup dataset
critical No signal |
22
On-site backups, Offsite recovery |
1
1 critical-tier |
Bring the backup dataset back online 15m · disruptive |
|
Caddy (reverse proxy)
critical No signal |
22
Published web |
0 |
Restart Caddy on VIN 2m · disruptive |
|
Postgres (primary)
critical No signal |
20
Data writes |
0 |
Promote the Postgres replica on VIN 15m · destructive |
|
JarvisOS Control Plane
critical No signal |
16
JarvisOS orchestration |
1 |
Bring up the standby control plane on VIN 15m · disruptive |
|
JarvisMCP node agent
undeclared
standard No signal |
12
JarvisAI agent surface |
0 |
Restart the JarvisMCP agent on VIN 1m · safe |
|
GWSCLI / S3
external
important No signal |
10
Offsite recovery |
1
1 critical-tier |
nothing declared |
|
Offsite backup replica
critical No signal |
10
Offsite recovery |
0 |
Re-run the offsite sync 40m · safe |
|
JarvisOS Web PWA
undeclared
standard No signal |
8
Knowing what is broken |
0 |
Restart the JarvisOS console on VIN 1m · safe |
|
Internal DNS
important No signal |
6
Internal name resolution |
0 |
Restart the internal resolver on Home1 2m · safe |
Critical path per capability
Nearest first — the things with no alternativePublished web 22 points
Every hostname this estate answers on, from outside the house. — Noticed within seconds by anyone using anything. This is what 'the estate is down' means to a human.
Sign-in 18 points
Issuing and validating sessions for everything behind SSO. — An auth outage looks like a total outage: the services are up and nobody can reach them.
JarvisOS orchestration 16 points
Accepting, scheduling and dispatching work across the fleet. — Running work continues; nothing new starts. Noticed at the next dispatch rather than immediately.
JarvisAI agent surface 12 points
The MCP agent on VIN and the tunnel that publishes it. — Assistant-driven work stops. Nothing else notices.
Data writes 20 points
The Postgres role that accepts writes. — Immediate and total for anything stateful. Recoverable only by promotion, which is one-way.
Data reads 14 points
Reading the system of record, from either the primary or the streaming replica. — Survives the loss of the home rack, which is the whole reason the replica exists.
Survives losing any one of: postgres-primary / postgres-replica.
On-site backups 12 points
The NAS dataset every backup lands in. — Nothing breaks today; the estate silently stops being recoverable. The worst failure mode here.
Offsite recovery 10 points
The offsite copy that survives losing the home rack entirely. — Invisible until the day the house is the incident.
Public name resolution 14 points
Cloudflare DNS: turning published hostnames into an address. — Looks exactly like a total outage from outside, and clients cache the failure.
Internal name resolution 6 points
Resolving estate names on the LAN. — Home1 clients lose names; the secondary resolver on VIN answers automatically.
Private access to the estate 10 points
Reaching nodes without going through anything published — the tailnet, or the WireGuard link. — Losing both is what turns a service incident into 'nobody can get in to fix it'.
Survives losing any one of: tailscaled / wireguard-tunnel.
Knowing what is broken 8 points
This console: status, incidents, recovery tasks and the catalogue. — Everything still works and nobody can see it. Recovery becomes guesswork.
Where the edges come from
5 override(s) · 0 suppression(s) · 1 redundancy group(s)Every edge is backed by something current: a file this process read, a collector inside its budget, or a manual override inside its review window.
What the graph disagrees with
0 critical · 4 to look at-
Look at this
JarvisMCP node agent holds up 1 capability/capabilities and is not in the inventory
It is in the catalogue only, so it has no tier, no availability class and no runbook. Anything a declared capability depends on should be declared. -
Look at this
JarvisOS Web PWA holds up 1 capability/capabilities and is not in the inventory
It is in the catalogue only, so it has no tier, no availability class and no runbook. Anything a declared capability depends on should be declared. -
Look at this
Tailscale daemon (VIN) holds up 2 capability/capabilities and is not in the inventory
It is in the catalogue only, so it has no tier, no availability class and no runbook. Anything a declared capability depends on should be declared. -
Look at this
Secure MCP tunnel holds up 1 capability/capabilities and is not in the inventory
It is in the catalogue only, so it has no tier, no availability class and no runbook. Anything a declared capability depends on should be declared.