{ "schemaVersion": "eve-sota-reliability-slo.v1", "taskId": "13.1", "generatedOn": "2026-09-14", "status": "defined-uninstrumented", "sources": { "ledger": { "path": "EVE_SOTA_GAP_CLOSURE_TODOS_2026-09-01.md", "sha256": "7dabaf53a1ff4d4388c16559c4789000d60c7bf3325eff9b8dcff11ee16aee21" }, "threatModel": { "path": "docs/audits/eve-sota-threat-model/2026-09-05.json", "sha256": "4c75080d7b22ae12fbc5d231720f9b21c84d64288b5a7a0cf43fc65f85a13eda" }, "outcomeScorecard": { "path": "docs/audits/eve-sota-outcome-scorecard/2026-09-05.v2.json", "sha256": "f8bd820e7bdceefc151ef619a33669ed87fd0e22620a6caec783886c7bc27a5d" }, "existingServiceSlos": { "path": "docs/operations/slos.md", "sha256": "3b02c75fb8bd0aef8f2ee24232f3de94591464a55e034218c1e95ee0f3e042e2" }, "alertOwnership": { "path": "libs/oshun/analytics/src/incident-ownership-manifest.ts", "sha256": "6fb4dc2975c1c626f1b242595d4918bf2edf73d20930755d9bcd7ec182a51427" }, "governanceDecision": { "path": "docs/adr/ADR-0086-eve-per-plane-reliability-objectives.md", "sha256": "79c57a53a1a945c0024a043ae0b19108caea1f48fe2bb264720d1bf126fb6551" } }, "policy": { "window": "rolling-30-days", "budgetCalculation": "For fractional objectives, bad = eligible - good and allowed bad = floor((1 - target ratio) * eligible). Hard-zero objectives and named hard locks allow no events.", "missingData": "Missing, late, unreconciled, or below-minimum telemetry is UNKNOWN and cannot satisfy an SLO, release gate, or recovery claim.", "denominatorIntegrity": "Failures, retries, timeouts, cancellations, partial outcomes, failed-attempt cost, and fallback attempts remain attributable and cannot be dropped.", "budgetActions": [ "fast burn: page SEV-2 and enter the alert safe degraded mode", "slow burn: open SEV-3 incident ownership and halt discretionary rollout on the plane", "more than 50% of budget consumed in 7 days: freeze non-critical changes on the plane", "budget exhausted: freeze changes except incident mitigation until the rolling window recovers and readback verifies", "hard-lock event: SEV-1, fence the affected plane immediately, preserve evidence, and require independent recovery verification" ], "amendment": "Any threshold, applicability, exclusion, owner, or degraded-mode change requires a new version, rationale, SRE plus domain-owner approval, and commit before affected observations are viewed." }, "metricCatalog": [ { "id": "availability", "sli": "eligible successful operations / all eligible operations; 4xx policy refusals are successful only when the refusal is the specified outcome", "goodEvent": "terminal status is correct, truthful, and available before its deadline", "target": { "operator": ">=", "value": 0.999, "unit": "ratio" }, "budget": 0.001 }, { "id": "ttft", "sli": "eligible interactive turns whose first meaningful semantic token or truthful refusal arrives within 2.5 seconds / all eligible interactive turns", "goodEvent": "first meaningful response arrives within 2500 ms; keepalive and empty deltas do not count", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "distributionGuard": "p50 <= 1000 ms", "budget": 0.01 }, { "id": "total-latency", "sli": "eligible operations whose verified terminal result or truthful terminal failure arrives within 20 seconds / all eligible operations", "goodEvent": "request-to-verified-terminal-outcome is at most 20000 ms; timeout/error rows stay in the denominator at their deadline", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "distributionGuard": "p50 <= 6000 ms", "budget": 0.01 }, { "id": "tool-completion", "sli": "tool attempts with schema-valid, independently checked terminal outcomes / all accepted tool attempts", "goodEvent": "the tool returns its specified result or truthful failure and any effect is independently read back", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "budget": 0.01 }, { "id": "task-completion", "sli": "accepted tasks with independently verified terminal outcomes / all accepted tasks", "goodEvent": "the exact requested outcome is verified or a preregistered safe refusal is correctly returned", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "budget": 0.01 }, { "id": "cancel-latency", "sli": "accepted cancellations that reach quiescence within one second / all accepted cancellations", "goodEvent": "no active work remains within 1000 ms and no unapproved effect occurs after acceptance", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "budget": 0.01, "hardZeroConditions": ["post-cancel-unapproved-effect"] }, { "id": "kill-latency", "sli": "accepted emergency kills that fence new work and reach quiescence within two seconds / all accepted kills", "goodEvent": "new starts are fenced immediately and all cancellable work is quiescent within 2000 ms", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "budget": 0.01, "hardZeroConditions": ["post-kill-unapproved-effect"] }, { "id": "duplicate-action", "sli": "count of independently observed duplicate durable or external effects for one idempotency identity", "goodEvent": "no duplicate effect is observed", "target": { "operator": "=", "value": 0, "unit": "events" }, "budget": 0, "hardZeroConditions": ["duplicate-durable-or-external-effect"] }, { "id": "late-action", "sli": "count of durable or external effects committed after deadline, cancellation, kill, lease loss, or authority expiry", "goodEvent": "no effect occurs after its authority or execution window closes", "target": { "operator": "=", "value": 0, "unit": "events" }, "budget": 0, "hardZeroConditions": ["late-or-expired-authority-effect"] }, { "id": "queue-age", "sli": "eligible queued items that start or truthfully expire within the fixed queue-age deadline / all eligible enqueued items", "goodEvent": "workbench items start or expire within 300 seconds; audit items persist or fail visibly within 300 seconds", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "budget": 0.01 }, { "id": "recovery", "sli": "faulted operations restored to a verified safe state within the plane RTO / all injected and production fault episodes", "goodEvent": "read/interactive recovers within 30 s, queued/mutation within 300 s, long external work within 1800 s, and restore/disaster within 14400 s", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "budget": 0.01, "hardZeroConditions": ["recovery-falsely-reported-success"] }, { "id": "grounding", "sli": "grounded factual claims supported by an existing cited source region / all factual claims requiring grounding", "goodEvent": "support precision is at least 98% and factual-claim coverage is at least 95% in the rolling window", "target": { "operator": ">=", "value": 0.98, "unit": "precision" }, "distributionGuard": "factual-claim coverage >= 0.95", "budget": 0.02, "hardZeroConditions": ["fabricated-citation"] }, { "id": "provider-errors", "sli": "provider attempts without provider, transport, protocol, malformed-stream, or capacity failure / all provider attempts including retries", "goodEvent": "the attempt returns a schema-valid response before deadline without hidden retry omission", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "budget": 0.01 }, { "id": "cost", "sli": "verified outcomes at or below the preregistered plane/family budget / all verified outcomes including failed-attempt spend", "goodEvent": "p95 priced cost ratio is <= 0.80 and the individual outcome remains <= 1.00x its locked budget", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "distributionGuard": "p95 priced cost-to-budget ratio <= 0.80", "budget": 0.01, "hardZeroConditions": ["unpriced-or-unreceipted-leg"] }, { "id": "data-boundary-violations", "sli": "count of cross-tenant, cross-subject, over-authority, unapproved-provider, secret, or prohibited-retention boundary violations", "goodEvent": "no boundary violation occurs in sampled or complete production evidence", "target": { "operator": "=", "value": 0, "unit": "events" }, "budget": 0, "hardZeroConditions": ["data-boundary-violation"] } ], "planes": [ { "id": "session-http", "label": "Member session HTTP surface", "owner": "assistant_product", "applicability": [ { "metricId": "availability", "disposition": "slo", "sloId": "session-http.availability" }, { "metricId": "ttft", "disposition": "slo", "sloId": "session-http.ttft" }, { "metricId": "total-latency", "disposition": "slo", "sloId": "session-http.total-latency" }, { "metricId": "tool-completion", "disposition": "not-applicable", "reason": "This plane does not execute a tool contract." }, { "metricId": "task-completion", "disposition": "slo", "sloId": "session-http.task-completion" }, { "metricId": "cancel-latency", "disposition": "slo", "sloId": "session-http.cancel-latency" }, { "metricId": "kill-latency", "disposition": "not-applicable", "reason": "This plane has no emergency kill control at this boundary." }, { "metricId": "duplicate-action", "disposition": "slo", "sloId": "session-http.duplicate-action" }, { "metricId": "late-action", "disposition": "slo", "sloId": "session-http.late-action" }, { "metricId": "queue-age", "disposition": "not-applicable", "reason": "This plane does not own a durable queue." }, { "metricId": "recovery", "disposition": "slo", "sloId": "session-http.recovery" }, { "metricId": "grounding", "disposition": "slo", "sloId": "session-http.grounding" }, { "metricId": "provider-errors", "disposition": "not-applicable", "reason": "This plane does not call an external model, speech, or media provider." }, { "metricId": "cost", "disposition": "slo", "sloId": "session-http.cost" }, { "metricId": "data-boundary-violations", "disposition": "slo", "sloId": "session-http.data-boundary-violations" } ] }, { "id": "operator-http", "label": "Operator and review HTTP surface", "owner": "reliability", "applicability": [ { "metricId": "availability", "disposition": "slo", "sloId": "operator-http.availability" }, { "metricId": "ttft", "disposition": "not-applicable", "reason": "This plane does not originate a streamed user-visible first response." }, { "metricId": "total-latency", "disposition": "slo", "sloId": "operator-http.total-latency" }, { "metricId": "tool-completion", "disposition": "not-applicable", "reason": "This plane does not execute a tool contract." }, { "metricId": "task-completion", "disposition": "slo", "sloId": "operator-http.task-completion" }, { "metricId": "cancel-latency", "disposition": "slo", "sloId": "operator-http.cancel-latency" }, { "metricId": "kill-latency", "disposition": "not-applicable", "reason": "This plane has no emergency kill control at this boundary." }, { "metricId": "duplicate-action", "disposition": "slo", "sloId": "operator-http.duplicate-action" }, { "metricId": "late-action", "disposition": "slo", "sloId": "operator-http.late-action" }, { "metricId": "queue-age", "disposition": "not-applicable", "reason": "This plane does not own a durable queue." }, { "metricId": "recovery", "disposition": "slo", "sloId": "operator-http.recovery" }, { "metricId": "grounding", "disposition": "not-applicable", "reason": "This plane neither selects evidence nor asserts grounded claim support." }, { "metricId": "provider-errors", "disposition": "not-applicable", "reason": "This plane does not call an external model, speech, or media provider." }, { "metricId": "cost", "disposition": "slo", "sloId": "operator-http.cost" }, { "metricId": "data-boundary-violations", "disposition": "slo", "sloId": "operator-http.data-boundary-violations" } ] }, { "id": "prompt-assembly", "label": "Prompt assembly", "owner": "assistant_product", "applicability": [ { "metricId": "availability", "disposition": "slo", "sloId": "prompt-assembly.availability" }, { "metricId": "ttft", "disposition": "not-applicable", "reason": "This plane does not originate a streamed user-visible first response." }, { "metricId": "total-latency", "disposition": "slo", "sloId": "prompt-assembly.total-latency" }, { "metricId": "tool-completion", "disposition": "not-applicable", "reason": "This plane does not execute a tool contract." }, { "metricId": "task-completion", "disposition": "slo", "sloId": "prompt-assembly.task-completion" }, { "metricId": "cancel-latency", "disposition": "slo", "sloId": "prompt-assembly.cancel-latency" }, { "metricId": "kill-latency", "disposition": "not-applicable", "reason": "This plane has no emergency kill control at this boundary." }, { "metricId": "duplicate-action", "disposition": "not-applicable", "reason": "This plane cannot independently commit a durable or external action." }, { "metricId": "late-action", "disposition": "not-applicable", "reason": "This plane cannot independently commit an action after authority expires." }, { "metricId": "queue-age", "disposition": "not-applicable", "reason": "This plane does not own a durable queue." }, { "metricId": "recovery", "disposition": "slo", "sloId": "prompt-assembly.recovery" }, { "metricId": "grounding", "disposition": "slo", "sloId": "prompt-assembly.grounding" }, { "metricId": "provider-errors", "disposition": "not-applicable", "reason": "This plane does not call an external model, speech, or media provider." }, { "metricId": "cost", "disposition": "slo", "sloId": "prompt-assembly.cost" }, { "metricId": "data-boundary-violations", "disposition": "slo", "sloId": "prompt-assembly.data-boundary-violations" } ] }, { "id": "member-domain-tools", "label": "Member domain tools", "owner": "platform_engineering", "applicability": [ { "metricId": "availability", "disposition": "slo", "sloId": "member-domain-tools.availability" }, { "metricId": "ttft", "disposition": "not-applicable", "reason": "This plane does not originate a streamed user-visible first response." }, { "metricId": "total-latency", "disposition": "slo", "sloId": "member-domain-tools.total-latency" }, { "metricId": "tool-completion", "disposition": "slo", "sloId": "member-domain-tools.tool-completion" }, { "metricId": "task-completion", "disposition": "not-applicable", "reason": "This plane does not own an accepted end-to-end task outcome." }, { "metricId": "cancel-latency", "disposition": "slo", "sloId": "member-domain-tools.cancel-latency" }, { "metricId": "kill-latency", "disposition": "slo", "sloId": "member-domain-tools.kill-latency" }, { "metricId": "duplicate-action", "disposition": "slo", "sloId": "member-domain-tools.duplicate-action" }, { "metricId": "late-action", "disposition": "slo", "sloId": "member-domain-tools.late-action" }, { "metricId": "queue-age", "disposition": "not-applicable", "reason": "This plane does not own a durable queue." }, { "metricId": "recovery", "disposition": "slo", "sloId": "member-domain-tools.recovery" }, { "metricId": "grounding", "disposition": "not-applicable", "reason": "This plane neither selects evidence nor asserts grounded claim support." }, { "metricId": "provider-errors", "disposition": "not-applicable", "reason": "This plane does not call an external model, speech, or media provider." }, { "metricId": "cost", "disposition": "slo", "sloId": "member-domain-tools.cost" }, { "metricId": "data-boundary-violations", "disposition": "slo", "sloId": "member-domain-tools.data-boundary-violations" } ] }, { "id": "client-tool-bridge", "label": "Client tool bridge", "owner": "reliability", "applicability": [ { "metricId": "availability", "disposition": "slo", "sloId": "client-tool-bridge.availability" }, { "metricId": "ttft", "disposition": "not-applicable", "reason": "This plane does not originate a streamed user-visible first response." }, { "metricId": "total-latency", "disposition": "slo", "sloId": "client-tool-bridge.total-latency" }, { "metricId": "tool-completion", "disposition": "slo", "sloId": "client-tool-bridge.tool-completion" }, { "metricId": "task-completion", "disposition": "not-applicable", "reason": "This plane does not own an accepted end-to-end task outcome." }, { "metricId": "cancel-latency", "disposition": "slo", "sloId": "client-tool-bridge.cancel-latency" }, { "metricId": "kill-latency", "disposition": "slo", "sloId": "client-tool-bridge.kill-latency" }, { "metricId": "duplicate-action", "disposition": "slo", "sloId": "client-tool-bridge.duplicate-action" }, { "metricId": "late-action", "disposition": "slo", "sloId": "client-tool-bridge.late-action" }, { "metricId": "queue-age", "disposition": "not-applicable", "reason": "This plane does not own a durable queue." }, { "metricId": "recovery", "disposition": "slo", "sloId": "client-tool-bridge.recovery" }, { "metricId": "grounding", "disposition": "not-applicable", "reason": "This plane neither selects evidence nor asserts grounded claim support." }, { "metricId": "provider-errors", "disposition": "not-applicable", "reason": "This plane does not call an external model, speech, or media provider." }, { "metricId": "cost", "disposition": "slo", "sloId": "client-tool-bridge.cost" }, { "metricId": "data-boundary-violations", "disposition": "slo", "sloId": "client-tool-bridge.data-boundary-violations" } ] }, { "id": "retrieval", "label": "Documentation retrieval", "owner": "platform_engineering", "applicability": [ { "metricId": "availability", "disposition": "slo", "sloId": "retrieval.availability" }, { "metricId": "ttft", "disposition": "not-applicable", "reason": "This plane does not originate a streamed user-visible first response." }, { "metricId": "total-latency", "disposition": "slo", "sloId": "retrieval.total-latency" }, { "metricId": "tool-completion", "disposition": "slo", "sloId": "retrieval.tool-completion" }, { "metricId": "task-completion", "disposition": "not-applicable", "reason": "This plane does not own an accepted end-to-end task outcome." }, { "metricId": "cancel-latency", "disposition": "slo", "sloId": "retrieval.cancel-latency" }, { "metricId": "kill-latency", "disposition": "not-applicable", "reason": "This plane has no emergency kill control at this boundary." }, { "metricId": "duplicate-action", "disposition": "not-applicable", "reason": "This plane cannot independently commit a durable or external action." }, { "metricId": "late-action", "disposition": "not-applicable", "reason": "This plane cannot independently commit an action after authority expires." }, { "metricId": "queue-age", "disposition": "not-applicable", "reason": "This plane does not own a durable queue." }, { "metricId": "recovery", "disposition": "slo", "sloId": "retrieval.recovery" }, { "metricId": "grounding", "disposition": "slo", "sloId": "retrieval.grounding" }, { "metricId": "provider-errors", "disposition": "not-applicable", "reason": "This plane does not call an external model, speech, or media provider." }, { "metricId": "cost", "disposition": "slo", "sloId": "retrieval.cost" }, { "metricId": "data-boundary-violations", "disposition": "slo", "sloId": "retrieval.data-boundary-violations" } ] }, { "id": "operator-tools", "label": "Operator tools", "owner": "assistant_product", "applicability": [ { "metricId": "availability", "disposition": "slo", "sloId": "operator-tools.availability" }, { "metricId": "ttft", "disposition": "not-applicable", "reason": "This plane does not originate a streamed user-visible first response." }, { "metricId": "total-latency", "disposition": "slo", "sloId": "operator-tools.total-latency" }, { "metricId": "tool-completion", "disposition": "slo", "sloId": "operator-tools.tool-completion" }, { "metricId": "task-completion", "disposition": "not-applicable", "reason": "This plane does not own an accepted end-to-end task outcome." }, { "metricId": "cancel-latency", "disposition": "slo", "sloId": "operator-tools.cancel-latency" }, { "metricId": "kill-latency", "disposition": "slo", "sloId": "operator-tools.kill-latency" }, { "metricId": "duplicate-action", "disposition": "slo", "sloId": "operator-tools.duplicate-action" }, { "metricId": "late-action", "disposition": "slo", "sloId": "operator-tools.late-action" }, { "metricId": "queue-age", "disposition": "not-applicable", "reason": "This plane does not own a durable queue." }, { "metricId": "recovery", "disposition": "slo", "sloId": "operator-tools.recovery" }, { "metricId": "grounding", "disposition": "not-applicable", "reason": "This plane neither selects evidence nor asserts grounded claim support." }, { "metricId": "provider-errors", "disposition": "not-applicable", "reason": "This plane does not call an external model, speech, or media provider." }, { "metricId": "cost", "disposition": "slo", "sloId": "operator-tools.cost" }, { "metricId": "data-boundary-violations", "disposition": "slo", "sloId": "operator-tools.data-boundary-violations" } ] }, { "id": "memory-and-session", "label": "Operator memory and session state", "owner": "compliance", "applicability": [ { "metricId": "availability", "disposition": "slo", "sloId": "memory-and-session.availability" }, { "metricId": "ttft", "disposition": "not-applicable", "reason": "This plane does not originate a streamed user-visible first response." }, { "metricId": "total-latency", "disposition": "slo", "sloId": "memory-and-session.total-latency" }, { "metricId": "tool-completion", "disposition": "slo", "sloId": "memory-and-session.tool-completion" }, { "metricId": "task-completion", "disposition": "not-applicable", "reason": "This plane does not own an accepted end-to-end task outcome." }, { "metricId": "cancel-latency", "disposition": "not-applicable", "reason": "This plane has no independently cancellable operation at this boundary." }, { "metricId": "kill-latency", "disposition": "not-applicable", "reason": "This plane has no emergency kill control at this boundary." }, { "metricId": "duplicate-action", "disposition": "slo", "sloId": "memory-and-session.duplicate-action" }, { "metricId": "late-action", "disposition": "slo", "sloId": "memory-and-session.late-action" }, { "metricId": "queue-age", "disposition": "not-applicable", "reason": "This plane does not own a durable queue." }, { "metricId": "recovery", "disposition": "slo", "sloId": "memory-and-session.recovery" }, { "metricId": "grounding", "disposition": "not-applicable", "reason": "This plane neither selects evidence nor asserts grounded claim support." }, { "metricId": "provider-errors", "disposition": "not-applicable", "reason": "This plane does not call an external model, speech, or media provider." }, { "metricId": "cost", "disposition": "not-applicable", "reason": "This plane does not independently incur attributable variable per-outcome spend." }, { "metricId": "data-boundary-violations", "disposition": "slo", "sloId": "memory-and-session.data-boundary-violations" } ] }, { "id": "workbench-intent", "label": "Workbench intent plane", "owner": "platform_engineering", "applicability": [ { "metricId": "availability", "disposition": "slo", "sloId": "workbench-intent.availability" }, { "metricId": "ttft", "disposition": "not-applicable", "reason": "This plane does not originate a streamed user-visible first response." }, { "metricId": "total-latency", "disposition": "slo", "sloId": "workbench-intent.total-latency" }, { "metricId": "tool-completion", "disposition": "not-applicable", "reason": "This plane does not execute a tool contract." }, { "metricId": "task-completion", "disposition": "slo", "sloId": "workbench-intent.task-completion" }, { "metricId": "cancel-latency", "disposition": "slo", "sloId": "workbench-intent.cancel-latency" }, { "metricId": "kill-latency", "disposition": "slo", "sloId": "workbench-intent.kill-latency" }, { "metricId": "duplicate-action", "disposition": "slo", "sloId": "workbench-intent.duplicate-action" }, { "metricId": "late-action", "disposition": "slo", "sloId": "workbench-intent.late-action" }, { "metricId": "queue-age", "disposition": "slo", "sloId": "workbench-intent.queue-age" }, { "metricId": "recovery", "disposition": "slo", "sloId": "workbench-intent.recovery" }, { "metricId": "grounding", "disposition": "not-applicable", "reason": "This plane neither selects evidence nor asserts grounded claim support." }, { "metricId": "provider-errors", "disposition": "not-applicable", "reason": "This plane does not call an external model, speech, or media provider." }, { "metricId": "cost", "disposition": "slo", "sloId": "workbench-intent.cost" }, { "metricId": "data-boundary-violations", "disposition": "slo", "sloId": "workbench-intent.data-boundary-violations" } ] }, { "id": "model-provider", "label": "Model provider routes", "owner": "reliability", "applicability": [ { "metricId": "availability", "disposition": "slo", "sloId": "model-provider.availability" }, { "metricId": "ttft", "disposition": "slo", "sloId": "model-provider.ttft" }, { "metricId": "total-latency", "disposition": "slo", "sloId": "model-provider.total-latency" }, { "metricId": "tool-completion", "disposition": "not-applicable", "reason": "This plane does not execute a tool contract." }, { "metricId": "task-completion", "disposition": "slo", "sloId": "model-provider.task-completion" }, { "metricId": "cancel-latency", "disposition": "slo", "sloId": "model-provider.cancel-latency" }, { "metricId": "kill-latency", "disposition": "slo", "sloId": "model-provider.kill-latency" }, { "metricId": "duplicate-action", "disposition": "slo", "sloId": "model-provider.duplicate-action" }, { "metricId": "late-action", "disposition": "slo", "sloId": "model-provider.late-action" }, { "metricId": "queue-age", "disposition": "not-applicable", "reason": "This plane does not own a durable queue." }, { "metricId": "recovery", "disposition": "slo", "sloId": "model-provider.recovery" }, { "metricId": "grounding", "disposition": "not-applicable", "reason": "This plane neither selects evidence nor asserts grounded claim support." }, { "metricId": "provider-errors", "disposition": "slo", "sloId": "model-provider.provider-errors" }, { "metricId": "cost", "disposition": "slo", "sloId": "model-provider.cost" }, { "metricId": "data-boundary-violations", "disposition": "slo", "sloId": "model-provider.data-boundary-violations" } ] }, { "id": "voice", "label": "Voice in and out", "owner": "assistant_product", "applicability": [ { "metricId": "availability", "disposition": "slo", "sloId": "voice.availability" }, { "metricId": "ttft", "disposition": "slo", "sloId": "voice.ttft" }, { "metricId": "total-latency", "disposition": "slo", "sloId": "voice.total-latency" }, { "metricId": "tool-completion", "disposition": "not-applicable", "reason": "This plane does not execute a tool contract." }, { "metricId": "task-completion", "disposition": "slo", "sloId": "voice.task-completion" }, { "metricId": "cancel-latency", "disposition": "slo", "sloId": "voice.cancel-latency" }, { "metricId": "kill-latency", "disposition": "slo", "sloId": "voice.kill-latency" }, { "metricId": "duplicate-action", "disposition": "slo", "sloId": "voice.duplicate-action" }, { "metricId": "late-action", "disposition": "slo", "sloId": "voice.late-action" }, { "metricId": "queue-age", "disposition": "not-applicable", "reason": "This plane does not own a durable queue." }, { "metricId": "recovery", "disposition": "slo", "sloId": "voice.recovery" }, { "metricId": "grounding", "disposition": "not-applicable", "reason": "This plane neither selects evidence nor asserts grounded claim support." }, { "metricId": "provider-errors", "disposition": "slo", "sloId": "voice.provider-errors" }, { "metricId": "cost", "disposition": "slo", "sloId": "voice.cost" }, { "metricId": "data-boundary-violations", "disposition": "slo", "sloId": "voice.data-boundary-violations" } ] }, { "id": "audit-and-evidence", "label": "Audit runs and evidence", "owner": "compliance", "applicability": [ { "metricId": "availability", "disposition": "slo", "sloId": "audit-and-evidence.availability" }, { "metricId": "ttft", "disposition": "not-applicable", "reason": "This plane does not originate a streamed user-visible first response." }, { "metricId": "total-latency", "disposition": "slo", "sloId": "audit-and-evidence.total-latency" }, { "metricId": "tool-completion", "disposition": "not-applicable", "reason": "This plane does not execute a tool contract." }, { "metricId": "task-completion", "disposition": "slo", "sloId": "audit-and-evidence.task-completion" }, { "metricId": "cancel-latency", "disposition": "not-applicable", "reason": "This plane has no independently cancellable operation at this boundary." }, { "metricId": "kill-latency", "disposition": "not-applicable", "reason": "This plane has no emergency kill control at this boundary." }, { "metricId": "duplicate-action", "disposition": "slo", "sloId": "audit-and-evidence.duplicate-action" }, { "metricId": "late-action", "disposition": "slo", "sloId": "audit-and-evidence.late-action" }, { "metricId": "queue-age", "disposition": "slo", "sloId": "audit-and-evidence.queue-age" }, { "metricId": "recovery", "disposition": "slo", "sloId": "audit-and-evidence.recovery" }, { "metricId": "grounding", "disposition": "not-applicable", "reason": "This plane neither selects evidence nor asserts grounded claim support." }, { "metricId": "provider-errors", "disposition": "not-applicable", "reason": "This plane does not call an external model, speech, or media provider." }, { "metricId": "cost", "disposition": "not-applicable", "reason": "This plane does not independently incur attributable variable per-outcome spend." }, { "metricId": "data-boundary-violations", "disposition": "slo", "sloId": "audit-and-evidence.data-boundary-violations" } ] } ], "slos": [ { "id": "session-http.availability", "planeId": "session-http", "metricId": "availability", "sli": "eligible successful operations / all eligible operations; 4xx policy refusals are successful only when the refusal is the specified outcome", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "terminal status is correct, truthful, and available before its deadline", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.999, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.001, "calculation": "allowed bad events = floor(0.001 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "session-http.availability.fast-burn", "session-http.availability.slow-burn", "session-http.availability.telemetry-blindness" ] }, { "id": "session-http.ttft", "planeId": "session-http", "metricId": "ttft", "sli": "eligible interactive turns whose first meaningful semantic token or truthful refusal arrives within 2.5 seconds / all eligible interactive turns", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "first meaningful response arrives within 2500 ms; keepalive and empty deltas do not count", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "p50 <= 1000 ms" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": ["session-http.ttft.fast-burn", "session-http.ttft.slow-burn"] }, { "id": "session-http.total-latency", "planeId": "session-http", "metricId": "total-latency", "sli": "eligible operations whose verified terminal result or truthful terminal failure arrives within 20 seconds / all eligible operations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "request-to-verified-terminal-outcome is at most 20000 ms; timeout/error rows stay in the denominator at their deadline", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "p50 <= 6000 ms" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": ["session-http.total-latency.fast-burn", "session-http.total-latency.slow-burn"] }, { "id": "session-http.task-completion", "planeId": "session-http", "metricId": "task-completion", "sli": "accepted tasks with independently verified terminal outcomes / all accepted tasks", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "the exact requested outcome is verified or a preregistered safe refusal is correctly returned", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "session-http.task-completion.fast-burn", "session-http.task-completion.slow-burn" ] }, { "id": "session-http.cancel-latency", "planeId": "session-http", "metricId": "cancel-latency", "sli": "accepted cancellations that reach quiescence within one second / all accepted cancellations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no active work remains within 1000 ms and no unapproved effect occurs after acceptance", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["post-cancel-unapproved-effect"] }, "exclusions": [], "alertRefs": [ "session-http.cancel-latency.fast-burn", "session-http.cancel-latency.slow-burn", "session-http.cancel-latency.post-cancel-unapproved-effect" ] }, { "id": "session-http.duplicate-action", "planeId": "session-http", "metricId": "duplicate-action", "sli": "count of independently observed duplicate durable or external effects for one idempotency identity", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no duplicate effect is observed", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["duplicate-durable-or-external-effect"] }, "exclusions": [], "alertRefs": ["session-http.duplicate-action.violation"] }, { "id": "session-http.late-action", "planeId": "session-http", "metricId": "late-action", "sli": "count of durable or external effects committed after deadline, cancellation, kill, lease loss, or authority expiry", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no effect occurs after its authority or execution window closes", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["late-or-expired-authority-effect"] }, "exclusions": [], "alertRefs": ["session-http.late-action.violation"] }, { "id": "session-http.recovery", "planeId": "session-http", "metricId": "recovery", "sli": "faulted operations restored to a verified safe state within the plane RTO / all injected and production fault episodes", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "read/interactive recovers within 30 s, queued/mutation within 300 s, long external work within 1800 s, and restore/disaster within 14400 s", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["recovery-falsely-reported-success"] }, "exclusions": [], "alertRefs": [ "session-http.recovery.fast-burn", "session-http.recovery.slow-burn", "session-http.recovery.recovery-falsely-reported-success" ] }, { "id": "session-http.grounding", "planeId": "session-http", "metricId": "grounding", "sli": "grounded factual claims supported by an existing cited source region / all factual claims requiring grounding", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "support precision is at least 98% and factual-claim coverage is at least 95% in the rolling window", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.98, "unit": "precision" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "factual-claim coverage >= 0.95" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.02, "calculation": "allowed bad events = floor(0.02 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["fabricated-citation"] }, "exclusions": [], "alertRefs": [ "session-http.grounding.fast-burn", "session-http.grounding.slow-burn", "session-http.grounding.fabricated-citation" ] }, { "id": "session-http.cost", "planeId": "session-http", "metricId": "cost", "sli": "verified outcomes at or below the preregistered plane/family budget / all verified outcomes including failed-attempt spend", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "p95 priced cost ratio is <= 0.80 and the individual outcome remains <= 1.00x its locked budget", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "p95 priced cost-to-budget ratio <= 0.80" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["unpriced-or-unreceipted-leg"] }, "exclusions": [], "alertRefs": [ "session-http.cost.fast-burn", "session-http.cost.slow-burn", "session-http.cost.unpriced-or-unreceipted-leg" ] }, { "id": "session-http.data-boundary-violations", "planeId": "session-http", "metricId": "data-boundary-violations", "sli": "count of cross-tenant, cross-subject, over-authority, unapproved-provider, secret, or prohibited-retention boundary violations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no boundary violation occurs in sampled or complete production evidence", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["data-boundary-violation"] }, "exclusions": [], "alertRefs": ["session-http.data-boundary-violations.violation"] }, { "id": "operator-http.availability", "planeId": "operator-http", "metricId": "availability", "sli": "eligible successful operations / all eligible operations; 4xx policy refusals are successful only when the refusal is the specified outcome", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "terminal status is correct, truthful, and available before its deadline", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.999, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.001, "calculation": "allowed bad events = floor(0.001 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "operator-http.availability.fast-burn", "operator-http.availability.slow-burn", "operator-http.availability.telemetry-blindness" ] }, { "id": "operator-http.total-latency", "planeId": "operator-http", "metricId": "total-latency", "sli": "eligible operations whose verified terminal result or truthful terminal failure arrives within 20 seconds / all eligible operations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "request-to-verified-terminal-outcome is at most 20000 ms; timeout/error rows stay in the denominator at their deadline", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "p50 <= 6000 ms" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "operator-http.total-latency.fast-burn", "operator-http.total-latency.slow-burn" ] }, { "id": "operator-http.task-completion", "planeId": "operator-http", "metricId": "task-completion", "sli": "accepted tasks with independently verified terminal outcomes / all accepted tasks", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "the exact requested outcome is verified or a preregistered safe refusal is correctly returned", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "operator-http.task-completion.fast-burn", "operator-http.task-completion.slow-burn" ] }, { "id": "operator-http.cancel-latency", "planeId": "operator-http", "metricId": "cancel-latency", "sli": "accepted cancellations that reach quiescence within one second / all accepted cancellations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no active work remains within 1000 ms and no unapproved effect occurs after acceptance", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["post-cancel-unapproved-effect"] }, "exclusions": [], "alertRefs": [ "operator-http.cancel-latency.fast-burn", "operator-http.cancel-latency.slow-burn", "operator-http.cancel-latency.post-cancel-unapproved-effect" ] }, { "id": "operator-http.duplicate-action", "planeId": "operator-http", "metricId": "duplicate-action", "sli": "count of independently observed duplicate durable or external effects for one idempotency identity", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no duplicate effect is observed", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["duplicate-durable-or-external-effect"] }, "exclusions": [], "alertRefs": ["operator-http.duplicate-action.violation"] }, { "id": "operator-http.late-action", "planeId": "operator-http", "metricId": "late-action", "sli": "count of durable or external effects committed after deadline, cancellation, kill, lease loss, or authority expiry", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no effect occurs after its authority or execution window closes", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["late-or-expired-authority-effect"] }, "exclusions": [], "alertRefs": ["operator-http.late-action.violation"] }, { "id": "operator-http.recovery", "planeId": "operator-http", "metricId": "recovery", "sli": "faulted operations restored to a verified safe state within the plane RTO / all injected and production fault episodes", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "read/interactive recovers within 30 s, queued/mutation within 300 s, long external work within 1800 s, and restore/disaster within 14400 s", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["recovery-falsely-reported-success"] }, "exclusions": [], "alertRefs": [ "operator-http.recovery.fast-burn", "operator-http.recovery.slow-burn", "operator-http.recovery.recovery-falsely-reported-success" ] }, { "id": "operator-http.cost", "planeId": "operator-http", "metricId": "cost", "sli": "verified outcomes at or below the preregistered plane/family budget / all verified outcomes including failed-attempt spend", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "p95 priced cost ratio is <= 0.80 and the individual outcome remains <= 1.00x its locked budget", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "p95 priced cost-to-budget ratio <= 0.80" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["unpriced-or-unreceipted-leg"] }, "exclusions": [], "alertRefs": [ "operator-http.cost.fast-burn", "operator-http.cost.slow-burn", "operator-http.cost.unpriced-or-unreceipted-leg" ] }, { "id": "operator-http.data-boundary-violations", "planeId": "operator-http", "metricId": "data-boundary-violations", "sli": "count of cross-tenant, cross-subject, over-authority, unapproved-provider, secret, or prohibited-retention boundary violations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no boundary violation occurs in sampled or complete production evidence", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["data-boundary-violation"] }, "exclusions": [], "alertRefs": ["operator-http.data-boundary-violations.violation"] }, { "id": "prompt-assembly.availability", "planeId": "prompt-assembly", "metricId": "availability", "sli": "eligible successful operations / all eligible operations; 4xx policy refusals are successful only when the refusal is the specified outcome", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "terminal status is correct, truthful, and available before its deadline", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.999, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.001, "calculation": "allowed bad events = floor(0.001 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "prompt-assembly.availability.fast-burn", "prompt-assembly.availability.slow-burn", "prompt-assembly.availability.telemetry-blindness" ] }, { "id": "prompt-assembly.total-latency", "planeId": "prompt-assembly", "metricId": "total-latency", "sli": "eligible operations whose verified terminal result or truthful terminal failure arrives within 20 seconds / all eligible operations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "request-to-verified-terminal-outcome is at most 20000 ms; timeout/error rows stay in the denominator at their deadline", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "p50 <= 6000 ms" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "prompt-assembly.total-latency.fast-burn", "prompt-assembly.total-latency.slow-burn" ] }, { "id": "prompt-assembly.task-completion", "planeId": "prompt-assembly", "metricId": "task-completion", "sli": "accepted tasks with independently verified terminal outcomes / all accepted tasks", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "the exact requested outcome is verified or a preregistered safe refusal is correctly returned", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "prompt-assembly.task-completion.fast-burn", "prompt-assembly.task-completion.slow-burn" ] }, { "id": "prompt-assembly.cancel-latency", "planeId": "prompt-assembly", "metricId": "cancel-latency", "sli": "accepted cancellations that reach quiescence within one second / all accepted cancellations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no active work remains within 1000 ms and no unapproved effect occurs after acceptance", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["post-cancel-unapproved-effect"] }, "exclusions": [], "alertRefs": [ "prompt-assembly.cancel-latency.fast-burn", "prompt-assembly.cancel-latency.slow-burn", "prompt-assembly.cancel-latency.post-cancel-unapproved-effect" ] }, { "id": "prompt-assembly.recovery", "planeId": "prompt-assembly", "metricId": "recovery", "sli": "faulted operations restored to a verified safe state within the plane RTO / all injected and production fault episodes", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "read/interactive recovers within 30 s, queued/mutation within 300 s, long external work within 1800 s, and restore/disaster within 14400 s", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["recovery-falsely-reported-success"] }, "exclusions": [], "alertRefs": [ "prompt-assembly.recovery.fast-burn", "prompt-assembly.recovery.slow-burn", "prompt-assembly.recovery.recovery-falsely-reported-success" ] }, { "id": "prompt-assembly.grounding", "planeId": "prompt-assembly", "metricId": "grounding", "sli": "grounded factual claims supported by an existing cited source region / all factual claims requiring grounding", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "support precision is at least 98% and factual-claim coverage is at least 95% in the rolling window", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.98, "unit": "precision" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "factual-claim coverage >= 0.95" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.02, "calculation": "allowed bad events = floor(0.02 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["fabricated-citation"] }, "exclusions": [], "alertRefs": [ "prompt-assembly.grounding.fast-burn", "prompt-assembly.grounding.slow-burn", "prompt-assembly.grounding.fabricated-citation" ] }, { "id": "prompt-assembly.cost", "planeId": "prompt-assembly", "metricId": "cost", "sli": "verified outcomes at or below the preregistered plane/family budget / all verified outcomes including failed-attempt spend", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "p95 priced cost ratio is <= 0.80 and the individual outcome remains <= 1.00x its locked budget", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "p95 priced cost-to-budget ratio <= 0.80" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["unpriced-or-unreceipted-leg"] }, "exclusions": [], "alertRefs": [ "prompt-assembly.cost.fast-burn", "prompt-assembly.cost.slow-burn", "prompt-assembly.cost.unpriced-or-unreceipted-leg" ] }, { "id": "prompt-assembly.data-boundary-violations", "planeId": "prompt-assembly", "metricId": "data-boundary-violations", "sli": "count of cross-tenant, cross-subject, over-authority, unapproved-provider, secret, or prohibited-retention boundary violations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no boundary violation occurs in sampled or complete production evidence", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["data-boundary-violation"] }, "exclusions": [], "alertRefs": ["prompt-assembly.data-boundary-violations.violation"] }, { "id": "member-domain-tools.availability", "planeId": "member-domain-tools", "metricId": "availability", "sli": "eligible successful operations / all eligible operations; 4xx policy refusals are successful only when the refusal is the specified outcome", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "terminal status is correct, truthful, and available before its deadline", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.999, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.001, "calculation": "allowed bad events = floor(0.001 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "member-domain-tools.availability.fast-burn", "member-domain-tools.availability.slow-burn", "member-domain-tools.availability.telemetry-blindness" ] }, { "id": "member-domain-tools.total-latency", "planeId": "member-domain-tools", "metricId": "total-latency", "sli": "eligible operations whose verified terminal result or truthful terminal failure arrives within 20 seconds / all eligible operations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "request-to-verified-terminal-outcome is at most 20000 ms; timeout/error rows stay in the denominator at their deadline", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "p50 <= 6000 ms" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "member-domain-tools.total-latency.fast-burn", "member-domain-tools.total-latency.slow-burn" ] }, { "id": "member-domain-tools.tool-completion", "planeId": "member-domain-tools", "metricId": "tool-completion", "sli": "tool attempts with schema-valid, independently checked terminal outcomes / all accepted tool attempts", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "the tool returns its specified result or truthful failure and any effect is independently read back", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "member-domain-tools.tool-completion.fast-burn", "member-domain-tools.tool-completion.slow-burn" ] }, { "id": "member-domain-tools.cancel-latency", "planeId": "member-domain-tools", "metricId": "cancel-latency", "sli": "accepted cancellations that reach quiescence within one second / all accepted cancellations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no active work remains within 1000 ms and no unapproved effect occurs after acceptance", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["post-cancel-unapproved-effect"] }, "exclusions": [], "alertRefs": [ "member-domain-tools.cancel-latency.fast-burn", "member-domain-tools.cancel-latency.slow-burn", "member-domain-tools.cancel-latency.post-cancel-unapproved-effect" ] }, { "id": "member-domain-tools.kill-latency", "planeId": "member-domain-tools", "metricId": "kill-latency", "sli": "accepted emergency kills that fence new work and reach quiescence within two seconds / all accepted kills", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "new starts are fenced immediately and all cancellable work is quiescent within 2000 ms", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["post-kill-unapproved-effect"] }, "exclusions": [], "alertRefs": [ "member-domain-tools.kill-latency.fast-burn", "member-domain-tools.kill-latency.slow-burn", "member-domain-tools.kill-latency.post-kill-unapproved-effect" ] }, { "id": "member-domain-tools.duplicate-action", "planeId": "member-domain-tools", "metricId": "duplicate-action", "sli": "count of independently observed duplicate durable or external effects for one idempotency identity", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no duplicate effect is observed", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["duplicate-durable-or-external-effect"] }, "exclusions": [], "alertRefs": ["member-domain-tools.duplicate-action.violation"] }, { "id": "member-domain-tools.late-action", "planeId": "member-domain-tools", "metricId": "late-action", "sli": "count of durable or external effects committed after deadline, cancellation, kill, lease loss, or authority expiry", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no effect occurs after its authority or execution window closes", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["late-or-expired-authority-effect"] }, "exclusions": [], "alertRefs": ["member-domain-tools.late-action.violation"] }, { "id": "member-domain-tools.recovery", "planeId": "member-domain-tools", "metricId": "recovery", "sli": "faulted operations restored to a verified safe state within the plane RTO / all injected and production fault episodes", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "read/interactive recovers within 30 s, queued/mutation within 300 s, long external work within 1800 s, and restore/disaster within 14400 s", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["recovery-falsely-reported-success"] }, "exclusions": [], "alertRefs": [ "member-domain-tools.recovery.fast-burn", "member-domain-tools.recovery.slow-burn", "member-domain-tools.recovery.recovery-falsely-reported-success" ] }, { "id": "member-domain-tools.cost", "planeId": "member-domain-tools", "metricId": "cost", "sli": "verified outcomes at or below the preregistered plane/family budget / all verified outcomes including failed-attempt spend", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "p95 priced cost ratio is <= 0.80 and the individual outcome remains <= 1.00x its locked budget", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "p95 priced cost-to-budget ratio <= 0.80" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["unpriced-or-unreceipted-leg"] }, "exclusions": [], "alertRefs": [ "member-domain-tools.cost.fast-burn", "member-domain-tools.cost.slow-burn", "member-domain-tools.cost.unpriced-or-unreceipted-leg" ] }, { "id": "member-domain-tools.data-boundary-violations", "planeId": "member-domain-tools", "metricId": "data-boundary-violations", "sli": "count of cross-tenant, cross-subject, over-authority, unapproved-provider, secret, or prohibited-retention boundary violations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no boundary violation occurs in sampled or complete production evidence", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["data-boundary-violation"] }, "exclusions": [], "alertRefs": ["member-domain-tools.data-boundary-violations.violation"] }, { "id": "client-tool-bridge.availability", "planeId": "client-tool-bridge", "metricId": "availability", "sli": "eligible successful operations / all eligible operations; 4xx policy refusals are successful only when the refusal is the specified outcome", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "terminal status is correct, truthful, and available before its deadline", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.999, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.001, "calculation": "allowed bad events = floor(0.001 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "client-tool-bridge.availability.fast-burn", "client-tool-bridge.availability.slow-burn", "client-tool-bridge.availability.telemetry-blindness" ] }, { "id": "client-tool-bridge.total-latency", "planeId": "client-tool-bridge", "metricId": "total-latency", "sli": "eligible operations whose verified terminal result or truthful terminal failure arrives within 20 seconds / all eligible operations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "request-to-verified-terminal-outcome is at most 20000 ms; timeout/error rows stay in the denominator at their deadline", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "p50 <= 6000 ms" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "client-tool-bridge.total-latency.fast-burn", "client-tool-bridge.total-latency.slow-burn" ] }, { "id": "client-tool-bridge.tool-completion", "planeId": "client-tool-bridge", "metricId": "tool-completion", "sli": "tool attempts with schema-valid, independently checked terminal outcomes / all accepted tool attempts", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "the tool returns its specified result or truthful failure and any effect is independently read back", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "client-tool-bridge.tool-completion.fast-burn", "client-tool-bridge.tool-completion.slow-burn" ] }, { "id": "client-tool-bridge.cancel-latency", "planeId": "client-tool-bridge", "metricId": "cancel-latency", "sli": "accepted cancellations that reach quiescence within one second / all accepted cancellations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no active work remains within 1000 ms and no unapproved effect occurs after acceptance", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["post-cancel-unapproved-effect"] }, "exclusions": [], "alertRefs": [ "client-tool-bridge.cancel-latency.fast-burn", "client-tool-bridge.cancel-latency.slow-burn", "client-tool-bridge.cancel-latency.post-cancel-unapproved-effect" ] }, { "id": "client-tool-bridge.kill-latency", "planeId": "client-tool-bridge", "metricId": "kill-latency", "sli": "accepted emergency kills that fence new work and reach quiescence within two seconds / all accepted kills", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "new starts are fenced immediately and all cancellable work is quiescent within 2000 ms", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["post-kill-unapproved-effect"] }, "exclusions": [], "alertRefs": [ "client-tool-bridge.kill-latency.fast-burn", "client-tool-bridge.kill-latency.slow-burn", "client-tool-bridge.kill-latency.post-kill-unapproved-effect" ] }, { "id": "client-tool-bridge.duplicate-action", "planeId": "client-tool-bridge", "metricId": "duplicate-action", "sli": "count of independently observed duplicate durable or external effects for one idempotency identity", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no duplicate effect is observed", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["duplicate-durable-or-external-effect"] }, "exclusions": [], "alertRefs": ["client-tool-bridge.duplicate-action.violation"] }, { "id": "client-tool-bridge.late-action", "planeId": "client-tool-bridge", "metricId": "late-action", "sli": "count of durable or external effects committed after deadline, cancellation, kill, lease loss, or authority expiry", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no effect occurs after its authority or execution window closes", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["late-or-expired-authority-effect"] }, "exclusions": [], "alertRefs": ["client-tool-bridge.late-action.violation"] }, { "id": "client-tool-bridge.recovery", "planeId": "client-tool-bridge", "metricId": "recovery", "sli": "faulted operations restored to a verified safe state within the plane RTO / all injected and production fault episodes", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "read/interactive recovers within 30 s, queued/mutation within 300 s, long external work within 1800 s, and restore/disaster within 14400 s", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["recovery-falsely-reported-success"] }, "exclusions": [], "alertRefs": [ "client-tool-bridge.recovery.fast-burn", "client-tool-bridge.recovery.slow-burn", "client-tool-bridge.recovery.recovery-falsely-reported-success" ] }, { "id": "client-tool-bridge.cost", "planeId": "client-tool-bridge", "metricId": "cost", "sli": "verified outcomes at or below the preregistered plane/family budget / all verified outcomes including failed-attempt spend", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "p95 priced cost ratio is <= 0.80 and the individual outcome remains <= 1.00x its locked budget", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "p95 priced cost-to-budget ratio <= 0.80" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["unpriced-or-unreceipted-leg"] }, "exclusions": [], "alertRefs": [ "client-tool-bridge.cost.fast-burn", "client-tool-bridge.cost.slow-burn", "client-tool-bridge.cost.unpriced-or-unreceipted-leg" ] }, { "id": "client-tool-bridge.data-boundary-violations", "planeId": "client-tool-bridge", "metricId": "data-boundary-violations", "sli": "count of cross-tenant, cross-subject, over-authority, unapproved-provider, secret, or prohibited-retention boundary violations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no boundary violation occurs in sampled or complete production evidence", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["data-boundary-violation"] }, "exclusions": [], "alertRefs": ["client-tool-bridge.data-boundary-violations.violation"] }, { "id": "retrieval.availability", "planeId": "retrieval", "metricId": "availability", "sli": "eligible successful operations / all eligible operations; 4xx policy refusals are successful only when the refusal is the specified outcome", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "terminal status is correct, truthful, and available before its deadline", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.999, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.001, "calculation": "allowed bad events = floor(0.001 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "retrieval.availability.fast-burn", "retrieval.availability.slow-burn", "retrieval.availability.telemetry-blindness" ] }, { "id": "retrieval.total-latency", "planeId": "retrieval", "metricId": "total-latency", "sli": "eligible operations whose verified terminal result or truthful terminal failure arrives within 20 seconds / all eligible operations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "request-to-verified-terminal-outcome is at most 20000 ms; timeout/error rows stay in the denominator at their deadline", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "p50 <= 6000 ms" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": ["retrieval.total-latency.fast-burn", "retrieval.total-latency.slow-burn"] }, { "id": "retrieval.tool-completion", "planeId": "retrieval", "metricId": "tool-completion", "sli": "tool attempts with schema-valid, independently checked terminal outcomes / all accepted tool attempts", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "the tool returns its specified result or truthful failure and any effect is independently read back", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": ["retrieval.tool-completion.fast-burn", "retrieval.tool-completion.slow-burn"] }, { "id": "retrieval.cancel-latency", "planeId": "retrieval", "metricId": "cancel-latency", "sli": "accepted cancellations that reach quiescence within one second / all accepted cancellations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no active work remains within 1000 ms and no unapproved effect occurs after acceptance", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["post-cancel-unapproved-effect"] }, "exclusions": [], "alertRefs": [ "retrieval.cancel-latency.fast-burn", "retrieval.cancel-latency.slow-burn", "retrieval.cancel-latency.post-cancel-unapproved-effect" ] }, { "id": "retrieval.recovery", "planeId": "retrieval", "metricId": "recovery", "sli": "faulted operations restored to a verified safe state within the plane RTO / all injected and production fault episodes", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "read/interactive recovers within 30 s, queued/mutation within 300 s, long external work within 1800 s, and restore/disaster within 14400 s", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["recovery-falsely-reported-success"] }, "exclusions": [], "alertRefs": [ "retrieval.recovery.fast-burn", "retrieval.recovery.slow-burn", "retrieval.recovery.recovery-falsely-reported-success" ] }, { "id": "retrieval.grounding", "planeId": "retrieval", "metricId": "grounding", "sli": "grounded factual claims supported by an existing cited source region / all factual claims requiring grounding", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "support precision is at least 98% and factual-claim coverage is at least 95% in the rolling window", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.98, "unit": "precision" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "factual-claim coverage >= 0.95" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.02, "calculation": "allowed bad events = floor(0.02 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["fabricated-citation"] }, "exclusions": [], "alertRefs": [ "retrieval.grounding.fast-burn", "retrieval.grounding.slow-burn", "retrieval.grounding.fabricated-citation" ] }, { "id": "retrieval.cost", "planeId": "retrieval", "metricId": "cost", "sli": "verified outcomes at or below the preregistered plane/family budget / all verified outcomes including failed-attempt spend", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "p95 priced cost ratio is <= 0.80 and the individual outcome remains <= 1.00x its locked budget", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "p95 priced cost-to-budget ratio <= 0.80" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["unpriced-or-unreceipted-leg"] }, "exclusions": [], "alertRefs": [ "retrieval.cost.fast-burn", "retrieval.cost.slow-burn", "retrieval.cost.unpriced-or-unreceipted-leg" ] }, { "id": "retrieval.data-boundary-violations", "planeId": "retrieval", "metricId": "data-boundary-violations", "sli": "count of cross-tenant, cross-subject, over-authority, unapproved-provider, secret, or prohibited-retention boundary violations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no boundary violation occurs in sampled or complete production evidence", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["data-boundary-violation"] }, "exclusions": [], "alertRefs": ["retrieval.data-boundary-violations.violation"] }, { "id": "operator-tools.availability", "planeId": "operator-tools", "metricId": "availability", "sli": "eligible successful operations / all eligible operations; 4xx policy refusals are successful only when the refusal is the specified outcome", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "terminal status is correct, truthful, and available before its deadline", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.999, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.001, "calculation": "allowed bad events = floor(0.001 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "operator-tools.availability.fast-burn", "operator-tools.availability.slow-burn", "operator-tools.availability.telemetry-blindness" ] }, { "id": "operator-tools.total-latency", "planeId": "operator-tools", "metricId": "total-latency", "sli": "eligible operations whose verified terminal result or truthful terminal failure arrives within 20 seconds / all eligible operations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "request-to-verified-terminal-outcome is at most 20000 ms; timeout/error rows stay in the denominator at their deadline", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "p50 <= 6000 ms" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "operator-tools.total-latency.fast-burn", "operator-tools.total-latency.slow-burn" ] }, { "id": "operator-tools.tool-completion", "planeId": "operator-tools", "metricId": "tool-completion", "sli": "tool attempts with schema-valid, independently checked terminal outcomes / all accepted tool attempts", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "the tool returns its specified result or truthful failure and any effect is independently read back", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "operator-tools.tool-completion.fast-burn", "operator-tools.tool-completion.slow-burn" ] }, { "id": "operator-tools.cancel-latency", "planeId": "operator-tools", "metricId": "cancel-latency", "sli": "accepted cancellations that reach quiescence within one second / all accepted cancellations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no active work remains within 1000 ms and no unapproved effect occurs after acceptance", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["post-cancel-unapproved-effect"] }, "exclusions": [], "alertRefs": [ "operator-tools.cancel-latency.fast-burn", "operator-tools.cancel-latency.slow-burn", "operator-tools.cancel-latency.post-cancel-unapproved-effect" ] }, { "id": "operator-tools.kill-latency", "planeId": "operator-tools", "metricId": "kill-latency", "sli": "accepted emergency kills that fence new work and reach quiescence within two seconds / all accepted kills", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "new starts are fenced immediately and all cancellable work is quiescent within 2000 ms", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["post-kill-unapproved-effect"] }, "exclusions": [], "alertRefs": [ "operator-tools.kill-latency.fast-burn", "operator-tools.kill-latency.slow-burn", "operator-tools.kill-latency.post-kill-unapproved-effect" ] }, { "id": "operator-tools.duplicate-action", "planeId": "operator-tools", "metricId": "duplicate-action", "sli": "count of independently observed duplicate durable or external effects for one idempotency identity", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no duplicate effect is observed", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["duplicate-durable-or-external-effect"] }, "exclusions": [], "alertRefs": ["operator-tools.duplicate-action.violation"] }, { "id": "operator-tools.late-action", "planeId": "operator-tools", "metricId": "late-action", "sli": "count of durable or external effects committed after deadline, cancellation, kill, lease loss, or authority expiry", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no effect occurs after its authority or execution window closes", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["late-or-expired-authority-effect"] }, "exclusions": [], "alertRefs": ["operator-tools.late-action.violation"] }, { "id": "operator-tools.recovery", "planeId": "operator-tools", "metricId": "recovery", "sli": "faulted operations restored to a verified safe state within the plane RTO / all injected and production fault episodes", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "read/interactive recovers within 30 s, queued/mutation within 300 s, long external work within 1800 s, and restore/disaster within 14400 s", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["recovery-falsely-reported-success"] }, "exclusions": [], "alertRefs": [ "operator-tools.recovery.fast-burn", "operator-tools.recovery.slow-burn", "operator-tools.recovery.recovery-falsely-reported-success" ] }, { "id": "operator-tools.cost", "planeId": "operator-tools", "metricId": "cost", "sli": "verified outcomes at or below the preregistered plane/family budget / all verified outcomes including failed-attempt spend", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "p95 priced cost ratio is <= 0.80 and the individual outcome remains <= 1.00x its locked budget", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "p95 priced cost-to-budget ratio <= 0.80" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["unpriced-or-unreceipted-leg"] }, "exclusions": [], "alertRefs": [ "operator-tools.cost.fast-burn", "operator-tools.cost.slow-burn", "operator-tools.cost.unpriced-or-unreceipted-leg" ] }, { "id": "operator-tools.data-boundary-violations", "planeId": "operator-tools", "metricId": "data-boundary-violations", "sli": "count of cross-tenant, cross-subject, over-authority, unapproved-provider, secret, or prohibited-retention boundary violations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no boundary violation occurs in sampled or complete production evidence", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["data-boundary-violation"] }, "exclusions": [], "alertRefs": ["operator-tools.data-boundary-violations.violation"] }, { "id": "memory-and-session.availability", "planeId": "memory-and-session", "metricId": "availability", "sli": "eligible successful operations / all eligible operations; 4xx policy refusals are successful only when the refusal is the specified outcome", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "terminal status is correct, truthful, and available before its deadline", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.999, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.001, "calculation": "allowed bad events = floor(0.001 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "memory-and-session.availability.fast-burn", "memory-and-session.availability.slow-burn", "memory-and-session.availability.telemetry-blindness" ] }, { "id": "memory-and-session.total-latency", "planeId": "memory-and-session", "metricId": "total-latency", "sli": "eligible operations whose verified terminal result or truthful terminal failure arrives within 20 seconds / all eligible operations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "request-to-verified-terminal-outcome is at most 20000 ms; timeout/error rows stay in the denominator at their deadline", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "p50 <= 6000 ms" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "memory-and-session.total-latency.fast-burn", "memory-and-session.total-latency.slow-burn" ] }, { "id": "memory-and-session.tool-completion", "planeId": "memory-and-session", "metricId": "tool-completion", "sli": "tool attempts with schema-valid, independently checked terminal outcomes / all accepted tool attempts", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "the tool returns its specified result or truthful failure and any effect is independently read back", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "memory-and-session.tool-completion.fast-burn", "memory-and-session.tool-completion.slow-burn" ] }, { "id": "memory-and-session.duplicate-action", "planeId": "memory-and-session", "metricId": "duplicate-action", "sli": "count of independently observed duplicate durable or external effects for one idempotency identity", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no duplicate effect is observed", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["duplicate-durable-or-external-effect"] }, "exclusions": [], "alertRefs": ["memory-and-session.duplicate-action.violation"] }, { "id": "memory-and-session.late-action", "planeId": "memory-and-session", "metricId": "late-action", "sli": "count of durable or external effects committed after deadline, cancellation, kill, lease loss, or authority expiry", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no effect occurs after its authority or execution window closes", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["late-or-expired-authority-effect"] }, "exclusions": [], "alertRefs": ["memory-and-session.late-action.violation"] }, { "id": "memory-and-session.recovery", "planeId": "memory-and-session", "metricId": "recovery", "sli": "faulted operations restored to a verified safe state within the plane RTO / all injected and production fault episodes", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "read/interactive recovers within 30 s, queued/mutation within 300 s, long external work within 1800 s, and restore/disaster within 14400 s", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["recovery-falsely-reported-success"] }, "exclusions": [], "alertRefs": [ "memory-and-session.recovery.fast-burn", "memory-and-session.recovery.slow-burn", "memory-and-session.recovery.recovery-falsely-reported-success" ] }, { "id": "memory-and-session.data-boundary-violations", "planeId": "memory-and-session", "metricId": "data-boundary-violations", "sli": "count of cross-tenant, cross-subject, over-authority, unapproved-provider, secret, or prohibited-retention boundary violations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no boundary violation occurs in sampled or complete production evidence", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["data-boundary-violation"] }, "exclusions": [], "alertRefs": ["memory-and-session.data-boundary-violations.violation"] }, { "id": "workbench-intent.availability", "planeId": "workbench-intent", "metricId": "availability", "sli": "eligible successful operations / all eligible operations; 4xx policy refusals are successful only when the refusal is the specified outcome", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "terminal status is correct, truthful, and available before its deadline", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.999, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.001, "calculation": "allowed bad events = floor(0.001 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "workbench-intent.availability.fast-burn", "workbench-intent.availability.slow-burn", "workbench-intent.availability.telemetry-blindness" ] }, { "id": "workbench-intent.total-latency", "planeId": "workbench-intent", "metricId": "total-latency", "sli": "eligible operations whose verified terminal result or truthful terminal failure arrives within 20 seconds / all eligible operations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "request-to-verified-terminal-outcome is at most 20000 ms; timeout/error rows stay in the denominator at their deadline", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "p50 <= 6000 ms" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "workbench-intent.total-latency.fast-burn", "workbench-intent.total-latency.slow-burn" ] }, { "id": "workbench-intent.task-completion", "planeId": "workbench-intent", "metricId": "task-completion", "sli": "accepted tasks with independently verified terminal outcomes / all accepted tasks", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "the exact requested outcome is verified or a preregistered safe refusal is correctly returned", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "workbench-intent.task-completion.fast-burn", "workbench-intent.task-completion.slow-burn" ] }, { "id": "workbench-intent.cancel-latency", "planeId": "workbench-intent", "metricId": "cancel-latency", "sli": "accepted cancellations that reach quiescence within one second / all accepted cancellations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no active work remains within 1000 ms and no unapproved effect occurs after acceptance", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["post-cancel-unapproved-effect"] }, "exclusions": [], "alertRefs": [ "workbench-intent.cancel-latency.fast-burn", "workbench-intent.cancel-latency.slow-burn", "workbench-intent.cancel-latency.post-cancel-unapproved-effect" ] }, { "id": "workbench-intent.kill-latency", "planeId": "workbench-intent", "metricId": "kill-latency", "sli": "accepted emergency kills that fence new work and reach quiescence within two seconds / all accepted kills", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "new starts are fenced immediately and all cancellable work is quiescent within 2000 ms", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["post-kill-unapproved-effect"] }, "exclusions": [], "alertRefs": [ "workbench-intent.kill-latency.fast-burn", "workbench-intent.kill-latency.slow-burn", "workbench-intent.kill-latency.post-kill-unapproved-effect" ] }, { "id": "workbench-intent.duplicate-action", "planeId": "workbench-intent", "metricId": "duplicate-action", "sli": "count of independently observed duplicate durable or external effects for one idempotency identity", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no duplicate effect is observed", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["duplicate-durable-or-external-effect"] }, "exclusions": [], "alertRefs": ["workbench-intent.duplicate-action.violation"] }, { "id": "workbench-intent.late-action", "planeId": "workbench-intent", "metricId": "late-action", "sli": "count of durable or external effects committed after deadline, cancellation, kill, lease loss, or authority expiry", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no effect occurs after its authority or execution window closes", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["late-or-expired-authority-effect"] }, "exclusions": [], "alertRefs": ["workbench-intent.late-action.violation"] }, { "id": "workbench-intent.queue-age", "planeId": "workbench-intent", "metricId": "queue-age", "sli": "eligible queued items that start or truthfully expire within the fixed queue-age deadline / all eligible enqueued items", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "workbench items start or expire within 300 seconds; audit items persist or fail visibly within 300 seconds", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": ["workbench-intent.queue-age.fast-burn", "workbench-intent.queue-age.slow-burn"] }, { "id": "workbench-intent.recovery", "planeId": "workbench-intent", "metricId": "recovery", "sli": "faulted operations restored to a verified safe state within the plane RTO / all injected and production fault episodes", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "read/interactive recovers within 30 s, queued/mutation within 300 s, long external work within 1800 s, and restore/disaster within 14400 s", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["recovery-falsely-reported-success"] }, "exclusions": [], "alertRefs": [ "workbench-intent.recovery.fast-burn", "workbench-intent.recovery.slow-burn", "workbench-intent.recovery.recovery-falsely-reported-success" ] }, { "id": "workbench-intent.cost", "planeId": "workbench-intent", "metricId": "cost", "sli": "verified outcomes at or below the preregistered plane/family budget / all verified outcomes including failed-attempt spend", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "p95 priced cost ratio is <= 0.80 and the individual outcome remains <= 1.00x its locked budget", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "p95 priced cost-to-budget ratio <= 0.80" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["unpriced-or-unreceipted-leg"] }, "exclusions": [], "alertRefs": [ "workbench-intent.cost.fast-burn", "workbench-intent.cost.slow-burn", "workbench-intent.cost.unpriced-or-unreceipted-leg" ] }, { "id": "workbench-intent.data-boundary-violations", "planeId": "workbench-intent", "metricId": "data-boundary-violations", "sli": "count of cross-tenant, cross-subject, over-authority, unapproved-provider, secret, or prohibited-retention boundary violations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no boundary violation occurs in sampled or complete production evidence", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["data-boundary-violation"] }, "exclusions": [], "alertRefs": ["workbench-intent.data-boundary-violations.violation"] }, { "id": "model-provider.availability", "planeId": "model-provider", "metricId": "availability", "sli": "eligible successful operations / all eligible operations; 4xx policy refusals are successful only when the refusal is the specified outcome", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "terminal status is correct, truthful, and available before its deadline", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.999, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.001, "calculation": "allowed bad events = floor(0.001 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "model-provider.availability.fast-burn", "model-provider.availability.slow-burn", "model-provider.availability.telemetry-blindness" ] }, { "id": "model-provider.ttft", "planeId": "model-provider", "metricId": "ttft", "sli": "eligible interactive turns whose first meaningful semantic token or truthful refusal arrives within 2.5 seconds / all eligible interactive turns", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "first meaningful response arrives within 2500 ms; keepalive and empty deltas do not count", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "p50 <= 1000 ms" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": ["model-provider.ttft.fast-burn", "model-provider.ttft.slow-burn"] }, { "id": "model-provider.total-latency", "planeId": "model-provider", "metricId": "total-latency", "sli": "eligible operations whose verified terminal result or truthful terminal failure arrives within 20 seconds / all eligible operations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "request-to-verified-terminal-outcome is at most 20000 ms; timeout/error rows stay in the denominator at their deadline", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "p50 <= 6000 ms" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "model-provider.total-latency.fast-burn", "model-provider.total-latency.slow-burn" ] }, { "id": "model-provider.task-completion", "planeId": "model-provider", "metricId": "task-completion", "sli": "accepted tasks with independently verified terminal outcomes / all accepted tasks", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "the exact requested outcome is verified or a preregistered safe refusal is correctly returned", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "model-provider.task-completion.fast-burn", "model-provider.task-completion.slow-burn" ] }, { "id": "model-provider.cancel-latency", "planeId": "model-provider", "metricId": "cancel-latency", "sli": "accepted cancellations that reach quiescence within one second / all accepted cancellations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no active work remains within 1000 ms and no unapproved effect occurs after acceptance", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["post-cancel-unapproved-effect"] }, "exclusions": [], "alertRefs": [ "model-provider.cancel-latency.fast-burn", "model-provider.cancel-latency.slow-burn", "model-provider.cancel-latency.post-cancel-unapproved-effect" ] }, { "id": "model-provider.kill-latency", "planeId": "model-provider", "metricId": "kill-latency", "sli": "accepted emergency kills that fence new work and reach quiescence within two seconds / all accepted kills", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "new starts are fenced immediately and all cancellable work is quiescent within 2000 ms", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["post-kill-unapproved-effect"] }, "exclusions": [], "alertRefs": [ "model-provider.kill-latency.fast-burn", "model-provider.kill-latency.slow-burn", "model-provider.kill-latency.post-kill-unapproved-effect" ] }, { "id": "model-provider.duplicate-action", "planeId": "model-provider", "metricId": "duplicate-action", "sli": "count of independently observed duplicate durable or external effects for one idempotency identity", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no duplicate effect is observed", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["duplicate-durable-or-external-effect"] }, "exclusions": [], "alertRefs": ["model-provider.duplicate-action.violation"] }, { "id": "model-provider.late-action", "planeId": "model-provider", "metricId": "late-action", "sli": "count of durable or external effects committed after deadline, cancellation, kill, lease loss, or authority expiry", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no effect occurs after its authority or execution window closes", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["late-or-expired-authority-effect"] }, "exclusions": [], "alertRefs": ["model-provider.late-action.violation"] }, { "id": "model-provider.recovery", "planeId": "model-provider", "metricId": "recovery", "sli": "faulted operations restored to a verified safe state within the plane RTO / all injected and production fault episodes", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "read/interactive recovers within 30 s, queued/mutation within 300 s, long external work within 1800 s, and restore/disaster within 14400 s", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["recovery-falsely-reported-success"] }, "exclusions": [], "alertRefs": [ "model-provider.recovery.fast-burn", "model-provider.recovery.slow-burn", "model-provider.recovery.recovery-falsely-reported-success" ] }, { "id": "model-provider.provider-errors", "planeId": "model-provider", "metricId": "provider-errors", "sli": "provider attempts without provider, transport, protocol, malformed-stream, or capacity failure / all provider attempts including retries", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "the attempt returns a schema-valid response before deadline without hidden retry omission", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "model-provider.provider-errors.fast-burn", "model-provider.provider-errors.slow-burn" ] }, { "id": "model-provider.cost", "planeId": "model-provider", "metricId": "cost", "sli": "verified outcomes at or below the preregistered plane/family budget / all verified outcomes including failed-attempt spend", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "p95 priced cost ratio is <= 0.80 and the individual outcome remains <= 1.00x its locked budget", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "p95 priced cost-to-budget ratio <= 0.80" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["unpriced-or-unreceipted-leg"] }, "exclusions": [], "alertRefs": [ "model-provider.cost.fast-burn", "model-provider.cost.slow-burn", "model-provider.cost.unpriced-or-unreceipted-leg" ] }, { "id": "model-provider.data-boundary-violations", "planeId": "model-provider", "metricId": "data-boundary-violations", "sli": "count of cross-tenant, cross-subject, over-authority, unapproved-provider, secret, or prohibited-retention boundary violations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no boundary violation occurs in sampled or complete production evidence", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["data-boundary-violation"] }, "exclusions": [], "alertRefs": ["model-provider.data-boundary-violations.violation"] }, { "id": "voice.availability", "planeId": "voice", "metricId": "availability", "sli": "eligible successful operations / all eligible operations; 4xx policy refusals are successful only when the refusal is the specified outcome", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "terminal status is correct, truthful, and available before its deadline", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.999, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.001, "calculation": "allowed bad events = floor(0.001 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "voice.availability.fast-burn", "voice.availability.slow-burn", "voice.availability.telemetry-blindness" ] }, { "id": "voice.ttft", "planeId": "voice", "metricId": "ttft", "sli": "eligible interactive turns whose first meaningful semantic token or truthful refusal arrives within 2.5 seconds / all eligible interactive turns", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "first meaningful response arrives within 2500 ms; keepalive and empty deltas do not count", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "p50 <= 1000 ms" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": ["voice.ttft.fast-burn", "voice.ttft.slow-burn"] }, { "id": "voice.total-latency", "planeId": "voice", "metricId": "total-latency", "sli": "eligible operations whose verified terminal result or truthful terminal failure arrives within 20 seconds / all eligible operations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "request-to-verified-terminal-outcome is at most 20000 ms; timeout/error rows stay in the denominator at their deadline", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "p50 <= 6000 ms" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": ["voice.total-latency.fast-burn", "voice.total-latency.slow-burn"] }, { "id": "voice.task-completion", "planeId": "voice", "metricId": "task-completion", "sli": "accepted tasks with independently verified terminal outcomes / all accepted tasks", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "the exact requested outcome is verified or a preregistered safe refusal is correctly returned", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": ["voice.task-completion.fast-burn", "voice.task-completion.slow-burn"] }, { "id": "voice.cancel-latency", "planeId": "voice", "metricId": "cancel-latency", "sli": "accepted cancellations that reach quiescence within one second / all accepted cancellations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no active work remains within 1000 ms and no unapproved effect occurs after acceptance", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["post-cancel-unapproved-effect"] }, "exclusions": [], "alertRefs": [ "voice.cancel-latency.fast-burn", "voice.cancel-latency.slow-burn", "voice.cancel-latency.post-cancel-unapproved-effect" ] }, { "id": "voice.kill-latency", "planeId": "voice", "metricId": "kill-latency", "sli": "accepted emergency kills that fence new work and reach quiescence within two seconds / all accepted kills", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "new starts are fenced immediately and all cancellable work is quiescent within 2000 ms", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["post-kill-unapproved-effect"] }, "exclusions": [], "alertRefs": [ "voice.kill-latency.fast-burn", "voice.kill-latency.slow-burn", "voice.kill-latency.post-kill-unapproved-effect" ] }, { "id": "voice.duplicate-action", "planeId": "voice", "metricId": "duplicate-action", "sli": "count of independently observed duplicate durable or external effects for one idempotency identity", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no duplicate effect is observed", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["duplicate-durable-or-external-effect"] }, "exclusions": [], "alertRefs": ["voice.duplicate-action.violation"] }, { "id": "voice.late-action", "planeId": "voice", "metricId": "late-action", "sli": "count of durable or external effects committed after deadline, cancellation, kill, lease loss, or authority expiry", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no effect occurs after its authority or execution window closes", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["late-or-expired-authority-effect"] }, "exclusions": [], "alertRefs": ["voice.late-action.violation"] }, { "id": "voice.recovery", "planeId": "voice", "metricId": "recovery", "sli": "faulted operations restored to a verified safe state within the plane RTO / all injected and production fault episodes", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "read/interactive recovers within 30 s, queued/mutation within 300 s, long external work within 1800 s, and restore/disaster within 14400 s", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["recovery-falsely-reported-success"] }, "exclusions": [], "alertRefs": [ "voice.recovery.fast-burn", "voice.recovery.slow-burn", "voice.recovery.recovery-falsely-reported-success" ] }, { "id": "voice.provider-errors", "planeId": "voice", "metricId": "provider-errors", "sli": "provider attempts without provider, transport, protocol, malformed-stream, or capacity failure / all provider attempts including retries", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "the attempt returns a schema-valid response before deadline without hidden retry omission", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": ["voice.provider-errors.fast-burn", "voice.provider-errors.slow-burn"] }, { "id": "voice.cost", "planeId": "voice", "metricId": "cost", "sli": "verified outcomes at or below the preregistered plane/family budget / all verified outcomes including failed-attempt spend", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "p95 priced cost ratio is <= 0.80 and the individual outcome remains <= 1.00x its locked budget", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "p95 priced cost-to-budget ratio <= 0.80" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["unpriced-or-unreceipted-leg"] }, "exclusions": [], "alertRefs": [ "voice.cost.fast-burn", "voice.cost.slow-burn", "voice.cost.unpriced-or-unreceipted-leg" ] }, { "id": "voice.data-boundary-violations", "planeId": "voice", "metricId": "data-boundary-violations", "sli": "count of cross-tenant, cross-subject, over-authority, unapproved-provider, secret, or prohibited-retention boundary violations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no boundary violation occurs in sampled or complete production evidence", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["data-boundary-violation"] }, "exclusions": [], "alertRefs": ["voice.data-boundary-violations.violation"] }, { "id": "audit-and-evidence.availability", "planeId": "audit-and-evidence", "metricId": "availability", "sli": "eligible successful operations / all eligible operations; 4xx policy refusals are successful only when the refusal is the specified outcome", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "terminal status is correct, truthful, and available before its deadline", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.999, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.001, "calculation": "allowed bad events = floor(0.001 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "audit-and-evidence.availability.fast-burn", "audit-and-evidence.availability.slow-burn", "audit-and-evidence.availability.telemetry-blindness" ] }, { "id": "audit-and-evidence.total-latency", "planeId": "audit-and-evidence", "metricId": "total-latency", "sli": "eligible operations whose verified terminal result or truthful terminal failure arrives within 20 seconds / all eligible operations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "request-to-verified-terminal-outcome is at most 20000 ms; timeout/error rows stay in the denominator at their deadline", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing", "distributionGuard": "p50 <= 6000 ms" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "audit-and-evidence.total-latency.fast-burn", "audit-and-evidence.total-latency.slow-burn" ] }, { "id": "audit-and-evidence.task-completion", "planeId": "audit-and-evidence", "metricId": "task-completion", "sli": "accepted tasks with independently verified terminal outcomes / all accepted tasks", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "the exact requested outcome is verified or a preregistered safe refusal is correctly returned", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "audit-and-evidence.task-completion.fast-burn", "audit-and-evidence.task-completion.slow-burn" ] }, { "id": "audit-and-evidence.duplicate-action", "planeId": "audit-and-evidence", "metricId": "duplicate-action", "sli": "count of independently observed duplicate durable or external effects for one idempotency identity", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no duplicate effect is observed", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["duplicate-durable-or-external-effect"] }, "exclusions": [], "alertRefs": ["audit-and-evidence.duplicate-action.violation"] }, { "id": "audit-and-evidence.late-action", "planeId": "audit-and-evidence", "metricId": "late-action", "sli": "count of durable or external effects committed after deadline, cancellation, kill, lease loss, or authority expiry", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no effect occurs after its authority or execution window closes", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["late-or-expired-authority-effect"] }, "exclusions": [], "alertRefs": ["audit-and-evidence.late-action.violation"] }, { "id": "audit-and-evidence.queue-age", "planeId": "audit-and-evidence", "metricId": "queue-age", "sli": "eligible queued items that start or truthfully expire within the fixed queue-age deadline / all eligible enqueued items", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "workbench items start or expire within 300 seconds; audit items persist or fail visibly within 300 seconds", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": [] }, "exclusions": ["preannounced-maintenance-with-approved-change-record"], "alertRefs": [ "audit-and-evidence.queue-age.fast-burn", "audit-and-evidence.queue-age.slow-burn" ] }, { "id": "audit-and-evidence.recovery", "planeId": "audit-and-evidence", "metricId": "recovery", "sli": "faulted operations restored to a verified safe state within the plane RTO / all injected and production fault episodes", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "read/interactive recovers within 30 s, queued/mutation within 300 s, long external work within 1800 s, and restore/disaster within 14400 s", "objective": { "window": "rolling-30-days", "target": { "operator": ">=", "value": 0.99, "unit": "ratio" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "bad-event-fraction", "allowedBadFraction": 0.01, "calculation": "allowed bad events = floor(0.01 * eligible events); retries and failed attempts are not removed", "hardZeroConditions": ["recovery-falsely-reported-success"] }, "exclusions": [], "alertRefs": [ "audit-and-evidence.recovery.fast-burn", "audit-and-evidence.recovery.slow-burn", "audit-and-evidence.recovery.recovery-falsely-reported-success" ] }, { "id": "audit-and-evidence.data-boundary-violations", "planeId": "audit-and-evidence", "metricId": "data-boundary-violations", "sli": "count of cross-tenant, cross-subject, over-authority, unapproved-provider, secret, or prohibited-retention boundary violations", "eligiblePopulation": "All production observations plus preregistered probes in the 30-day window; retries, failures, timeouts, partial outcomes, and admitted fallback attempts remain in the denominator.", "goodEvent": "no boundary violation occurs in sampled or complete production evidence", "objective": { "window": "rolling-30-days", "target": { "operator": "=", "value": 0, "unit": "events" }, "minimumEligibleEvents": 100, "noTrafficState": "unknown-not-passing" }, "errorBudget": { "type": "hard-zero", "allowedBadFraction": 0, "calculation": "allowed events = 0 across the rolling window and all retained production evidence", "hardZeroConditions": ["data-boundary-violation"] }, "exclusions": [], "alertRefs": ["audit-and-evidence.data-boundary-violations.violation"] } ], "alerts": [ { "id": "session-http.availability.fast-burn", "sloId": "session-http.availability", "planeId": "session-http", "metricId": "availability", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose session-http as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "session-http.availability.slow-burn", "sloId": "session-http.availability", "planeId": "session-http", "metricId": "availability", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose session-http as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "session-http.availability.telemetry-blindness", "sloId": "session-http.availability", "planeId": "session-http", "metricId": "availability", "kind": "telemetry-blindness", "severity": "sev2", "owner": "assistant_product", "condition": "Fire after five minutes without expected production observations or when receipt reconciliation is incomplete; absence of data is UNKNOWN, never green.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose session-http as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "session-http.ttft.fast-burn", "sloId": "session-http.ttft", "planeId": "session-http", "metricId": "ttft", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on session-http; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "session-http.ttft.slow-burn", "sloId": "session-http.ttft", "planeId": "session-http", "metricId": "ttft", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on session-http; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "session-http.total-latency.fast-burn", "sloId": "session-http.total-latency", "planeId": "session-http", "metricId": "total-latency", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on session-http; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "session-http.total-latency.slow-burn", "sloId": "session-http.total-latency", "planeId": "session-http", "metricId": "total-latency", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on session-http; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "session-http.task-completion.fast-burn", "sloId": "session-http.task-completion", "planeId": "session-http", "metricId": "task-completion", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Disable the affected mutation class on session-http; retain status/readback and return truthful failed or unavailable outcomes." }, { "id": "session-http.task-completion.slow-burn", "sloId": "session-http.task-completion", "planeId": "session-http", "metricId": "task-completion", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Disable the affected mutation class on session-http; retain status/readback and return truthful failed or unavailable outcomes." }, { "id": "session-http.cancel-latency.fast-burn", "sloId": "session-http.cancel-latency", "planeId": "session-http", "metricId": "cancel-latency", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on session-http, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "session-http.cancel-latency.slow-burn", "sloId": "session-http.cancel-latency", "planeId": "session-http", "metricId": "cancel-latency", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on session-http, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "session-http.cancel-latency.post-cancel-unapproved-effect", "sloId": "session-http.cancel-latency", "planeId": "session-http", "metricId": "cancel-latency", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately when post-cancel-unapproved-effect count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on session-http, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "session-http.duplicate-action.violation", "sloId": "session-http.duplicate-action", "planeId": "session-http", "metricId": "duplicate-action", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Fence mutation starts on session-http, retain read-only inspection and cancellation, and require reconciliation before replay." }, { "id": "session-http.late-action.violation", "sloId": "session-http.late-action", "planeId": "session-http", "metricId": "late-action", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Fence mutation starts on session-http, retain read-only inspection and cancellation, and require reconciliation before replay." }, { "id": "session-http.recovery.fast-burn", "sloId": "session-http.recovery", "planeId": "session-http", "metricId": "recovery", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on session-http, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "session-http.recovery.slow-burn", "sloId": "session-http.recovery", "planeId": "session-http", "metricId": "recovery", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on session-http, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "session-http.recovery.recovery-falsely-reported-success", "sloId": "session-http.recovery", "planeId": "session-http", "metricId": "recovery", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately when recovery-falsely-reported-success count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on session-http, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "session-http.grounding.fast-burn", "sloId": "session-http.grounding", "planeId": "session-http", "metricId": "grounding", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/grounding-failure.md", "safeDegradedMode": "Stop grounded publication through session-http; answer only with an explicit inability to verify or an admitted source-independent refusal." }, { "id": "session-http.grounding.slow-burn", "sloId": "session-http.grounding", "planeId": "session-http", "metricId": "grounding", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/grounding-failure.md", "safeDegradedMode": "Stop grounded publication through session-http; answer only with an explicit inability to verify or an admitted source-independent refusal." }, { "id": "session-http.grounding.fabricated-citation", "sloId": "session-http.grounding", "planeId": "session-http", "metricId": "grounding", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately when fabricated-citation count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/grounding-failure.md", "safeDegradedMode": "Stop grounded publication through session-http; answer only with an explicit inability to verify or an admitted source-independent refusal." }, { "id": "session-http.cost.fast-burn", "sloId": "session-http.cost", "planeId": "session-http", "metricId": "cost", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on session-http above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "session-http.cost.slow-burn", "sloId": "session-http.cost", "planeId": "session-http", "metricId": "cost", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on session-http above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "session-http.cost.unpriced-or-unreceipted-leg", "sloId": "session-http.cost", "planeId": "session-http", "metricId": "cost", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately when unpriced-or-unreceipted-leg count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on session-http above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "session-http.data-boundary-violations.violation", "sloId": "session-http.data-boundary-violations", "planeId": "session-http", "metricId": "data-boundary-violations", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/privacy-incident.md", "safeDegradedMode": "Fence session-http, preserve evidence, revoke affected authority, and expose no fallback path until Security and Compliance verify containment." }, { "id": "operator-http.availability.fast-burn", "sloId": "operator-http.availability", "planeId": "operator-http", "metricId": "availability", "kind": "fast-burn", "severity": "sev2", "owner": "reliability", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose operator-http as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "operator-http.availability.slow-burn", "sloId": "operator-http.availability", "planeId": "operator-http", "metricId": "availability", "kind": "slow-burn", "severity": "sev3", "owner": "reliability", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose operator-http as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "operator-http.availability.telemetry-blindness", "sloId": "operator-http.availability", "planeId": "operator-http", "metricId": "availability", "kind": "telemetry-blindness", "severity": "sev2", "owner": "reliability", "condition": "Fire after five minutes without expected production observations or when receipt reconciliation is incomplete; absence of data is UNKNOWN, never green.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose operator-http as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "operator-http.total-latency.fast-burn", "sloId": "operator-http.total-latency", "planeId": "operator-http", "metricId": "total-latency", "kind": "fast-burn", "severity": "sev2", "owner": "reliability", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on operator-http; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "operator-http.total-latency.slow-burn", "sloId": "operator-http.total-latency", "planeId": "operator-http", "metricId": "total-latency", "kind": "slow-burn", "severity": "sev3", "owner": "reliability", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on operator-http; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "operator-http.task-completion.fast-burn", "sloId": "operator-http.task-completion", "planeId": "operator-http", "metricId": "task-completion", "kind": "fast-burn", "severity": "sev2", "owner": "reliability", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Disable the affected mutation class on operator-http; retain status/readback and return truthful failed or unavailable outcomes." }, { "id": "operator-http.task-completion.slow-burn", "sloId": "operator-http.task-completion", "planeId": "operator-http", "metricId": "task-completion", "kind": "slow-burn", "severity": "sev3", "owner": "reliability", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Disable the affected mutation class on operator-http; retain status/readback and return truthful failed or unavailable outcomes." }, { "id": "operator-http.cancel-latency.fast-burn", "sloId": "operator-http.cancel-latency", "planeId": "operator-http", "metricId": "cancel-latency", "kind": "fast-burn", "severity": "sev2", "owner": "reliability", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on operator-http, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "operator-http.cancel-latency.slow-burn", "sloId": "operator-http.cancel-latency", "planeId": "operator-http", "metricId": "cancel-latency", "kind": "slow-burn", "severity": "sev3", "owner": "reliability", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on operator-http, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "operator-http.cancel-latency.post-cancel-unapproved-effect", "sloId": "operator-http.cancel-latency", "planeId": "operator-http", "metricId": "cancel-latency", "kind": "hard-lock", "severity": "sev1", "owner": "reliability", "condition": "Fire immediately when post-cancel-unapproved-effect count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on operator-http, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "operator-http.duplicate-action.violation", "sloId": "operator-http.duplicate-action", "planeId": "operator-http", "metricId": "duplicate-action", "kind": "hard-lock", "severity": "sev1", "owner": "reliability", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Fence mutation starts on operator-http, retain read-only inspection and cancellation, and require reconciliation before replay." }, { "id": "operator-http.late-action.violation", "sloId": "operator-http.late-action", "planeId": "operator-http", "metricId": "late-action", "kind": "hard-lock", "severity": "sev1", "owner": "reliability", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Fence mutation starts on operator-http, retain read-only inspection and cancellation, and require reconciliation before replay." }, { "id": "operator-http.recovery.fast-burn", "sloId": "operator-http.recovery", "planeId": "operator-http", "metricId": "recovery", "kind": "fast-burn", "severity": "sev2", "owner": "reliability", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on operator-http, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "operator-http.recovery.slow-burn", "sloId": "operator-http.recovery", "planeId": "operator-http", "metricId": "recovery", "kind": "slow-burn", "severity": "sev3", "owner": "reliability", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on operator-http, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "operator-http.recovery.recovery-falsely-reported-success", "sloId": "operator-http.recovery", "planeId": "operator-http", "metricId": "recovery", "kind": "hard-lock", "severity": "sev1", "owner": "reliability", "condition": "Fire immediately when recovery-falsely-reported-success count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on operator-http, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "operator-http.cost.fast-burn", "sloId": "operator-http.cost", "planeId": "operator-http", "metricId": "cost", "kind": "fast-burn", "severity": "sev2", "owner": "reliability", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on operator-http above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "operator-http.cost.slow-burn", "sloId": "operator-http.cost", "planeId": "operator-http", "metricId": "cost", "kind": "slow-burn", "severity": "sev3", "owner": "reliability", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on operator-http above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "operator-http.cost.unpriced-or-unreceipted-leg", "sloId": "operator-http.cost", "planeId": "operator-http", "metricId": "cost", "kind": "hard-lock", "severity": "sev1", "owner": "reliability", "condition": "Fire immediately when unpriced-or-unreceipted-leg count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on operator-http above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "operator-http.data-boundary-violations.violation", "sloId": "operator-http.data-boundary-violations", "planeId": "operator-http", "metricId": "data-boundary-violations", "kind": "hard-lock", "severity": "sev1", "owner": "reliability", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/privacy-incident.md", "safeDegradedMode": "Fence operator-http, preserve evidence, revoke affected authority, and expose no fallback path until Security and Compliance verify containment." }, { "id": "prompt-assembly.availability.fast-burn", "sloId": "prompt-assembly.availability", "planeId": "prompt-assembly", "metricId": "availability", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose prompt-assembly as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "prompt-assembly.availability.slow-burn", "sloId": "prompt-assembly.availability", "planeId": "prompt-assembly", "metricId": "availability", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose prompt-assembly as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "prompt-assembly.availability.telemetry-blindness", "sloId": "prompt-assembly.availability", "planeId": "prompt-assembly", "metricId": "availability", "kind": "telemetry-blindness", "severity": "sev2", "owner": "assistant_product", "condition": "Fire after five minutes without expected production observations or when receipt reconciliation is incomplete; absence of data is UNKNOWN, never green.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose prompt-assembly as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "prompt-assembly.total-latency.fast-burn", "sloId": "prompt-assembly.total-latency", "planeId": "prompt-assembly", "metricId": "total-latency", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on prompt-assembly; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "prompt-assembly.total-latency.slow-burn", "sloId": "prompt-assembly.total-latency", "planeId": "prompt-assembly", "metricId": "total-latency", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on prompt-assembly; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "prompt-assembly.task-completion.fast-burn", "sloId": "prompt-assembly.task-completion", "planeId": "prompt-assembly", "metricId": "task-completion", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Disable the affected mutation class on prompt-assembly; retain status/readback and return truthful failed or unavailable outcomes." }, { "id": "prompt-assembly.task-completion.slow-burn", "sloId": "prompt-assembly.task-completion", "planeId": "prompt-assembly", "metricId": "task-completion", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Disable the affected mutation class on prompt-assembly; retain status/readback and return truthful failed or unavailable outcomes." }, { "id": "prompt-assembly.cancel-latency.fast-burn", "sloId": "prompt-assembly.cancel-latency", "planeId": "prompt-assembly", "metricId": "cancel-latency", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on prompt-assembly, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "prompt-assembly.cancel-latency.slow-burn", "sloId": "prompt-assembly.cancel-latency", "planeId": "prompt-assembly", "metricId": "cancel-latency", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on prompt-assembly, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "prompt-assembly.cancel-latency.post-cancel-unapproved-effect", "sloId": "prompt-assembly.cancel-latency", "planeId": "prompt-assembly", "metricId": "cancel-latency", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately when post-cancel-unapproved-effect count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on prompt-assembly, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "prompt-assembly.recovery.fast-burn", "sloId": "prompt-assembly.recovery", "planeId": "prompt-assembly", "metricId": "recovery", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on prompt-assembly, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "prompt-assembly.recovery.slow-burn", "sloId": "prompt-assembly.recovery", "planeId": "prompt-assembly", "metricId": "recovery", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on prompt-assembly, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "prompt-assembly.recovery.recovery-falsely-reported-success", "sloId": "prompt-assembly.recovery", "planeId": "prompt-assembly", "metricId": "recovery", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately when recovery-falsely-reported-success count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on prompt-assembly, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "prompt-assembly.grounding.fast-burn", "sloId": "prompt-assembly.grounding", "planeId": "prompt-assembly", "metricId": "grounding", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/grounding-failure.md", "safeDegradedMode": "Stop grounded publication through prompt-assembly; answer only with an explicit inability to verify or an admitted source-independent refusal." }, { "id": "prompt-assembly.grounding.slow-burn", "sloId": "prompt-assembly.grounding", "planeId": "prompt-assembly", "metricId": "grounding", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/grounding-failure.md", "safeDegradedMode": "Stop grounded publication through prompt-assembly; answer only with an explicit inability to verify or an admitted source-independent refusal." }, { "id": "prompt-assembly.grounding.fabricated-citation", "sloId": "prompt-assembly.grounding", "planeId": "prompt-assembly", "metricId": "grounding", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately when fabricated-citation count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/grounding-failure.md", "safeDegradedMode": "Stop grounded publication through prompt-assembly; answer only with an explicit inability to verify or an admitted source-independent refusal." }, { "id": "prompt-assembly.cost.fast-burn", "sloId": "prompt-assembly.cost", "planeId": "prompt-assembly", "metricId": "cost", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on prompt-assembly above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "prompt-assembly.cost.slow-burn", "sloId": "prompt-assembly.cost", "planeId": "prompt-assembly", "metricId": "cost", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on prompt-assembly above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "prompt-assembly.cost.unpriced-or-unreceipted-leg", "sloId": "prompt-assembly.cost", "planeId": "prompt-assembly", "metricId": "cost", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately when unpriced-or-unreceipted-leg count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on prompt-assembly above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "prompt-assembly.data-boundary-violations.violation", "sloId": "prompt-assembly.data-boundary-violations", "planeId": "prompt-assembly", "metricId": "data-boundary-violations", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/privacy-incident.md", "safeDegradedMode": "Fence prompt-assembly, preserve evidence, revoke affected authority, and expose no fallback path until Security and Compliance verify containment." }, { "id": "member-domain-tools.availability.fast-burn", "sloId": "member-domain-tools.availability", "planeId": "member-domain-tools", "metricId": "availability", "kind": "fast-burn", "severity": "sev2", "owner": "platform_engineering", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose member-domain-tools as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "member-domain-tools.availability.slow-burn", "sloId": "member-domain-tools.availability", "planeId": "member-domain-tools", "metricId": "availability", "kind": "slow-burn", "severity": "sev3", "owner": "platform_engineering", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose member-domain-tools as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "member-domain-tools.availability.telemetry-blindness", "sloId": "member-domain-tools.availability", "planeId": "member-domain-tools", "metricId": "availability", "kind": "telemetry-blindness", "severity": "sev2", "owner": "platform_engineering", "condition": "Fire after five minutes without expected production observations or when receipt reconciliation is incomplete; absence of data is UNKNOWN, never green.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose member-domain-tools as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "member-domain-tools.total-latency.fast-burn", "sloId": "member-domain-tools.total-latency", "planeId": "member-domain-tools", "metricId": "total-latency", "kind": "fast-burn", "severity": "sev2", "owner": "platform_engineering", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on member-domain-tools; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "member-domain-tools.total-latency.slow-burn", "sloId": "member-domain-tools.total-latency", "planeId": "member-domain-tools", "metricId": "total-latency", "kind": "slow-burn", "severity": "sev3", "owner": "platform_engineering", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on member-domain-tools; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "member-domain-tools.tool-completion.fast-burn", "sloId": "member-domain-tools.tool-completion", "planeId": "member-domain-tools", "metricId": "tool-completion", "kind": "fast-burn", "severity": "sev2", "owner": "platform_engineering", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Disable the affected mutation class on member-domain-tools; retain status/readback and return truthful failed or unavailable outcomes." }, { "id": "member-domain-tools.tool-completion.slow-burn", "sloId": "member-domain-tools.tool-completion", "planeId": "member-domain-tools", "metricId": "tool-completion", "kind": "slow-burn", "severity": "sev3", "owner": "platform_engineering", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Disable the affected mutation class on member-domain-tools; retain status/readback and return truthful failed or unavailable outcomes." }, { "id": "member-domain-tools.cancel-latency.fast-burn", "sloId": "member-domain-tools.cancel-latency", "planeId": "member-domain-tools", "metricId": "cancel-latency", "kind": "fast-burn", "severity": "sev2", "owner": "platform_engineering", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on member-domain-tools, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "member-domain-tools.cancel-latency.slow-burn", "sloId": "member-domain-tools.cancel-latency", "planeId": "member-domain-tools", "metricId": "cancel-latency", "kind": "slow-burn", "severity": "sev3", "owner": "platform_engineering", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on member-domain-tools, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "member-domain-tools.cancel-latency.post-cancel-unapproved-effect", "sloId": "member-domain-tools.cancel-latency", "planeId": "member-domain-tools", "metricId": "cancel-latency", "kind": "hard-lock", "severity": "sev1", "owner": "platform_engineering", "condition": "Fire immediately when post-cancel-unapproved-effect count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on member-domain-tools, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "member-domain-tools.kill-latency.fast-burn", "sloId": "member-domain-tools.kill-latency", "planeId": "member-domain-tools", "metricId": "kill-latency", "kind": "fast-burn", "severity": "sev2", "owner": "platform_engineering", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on member-domain-tools, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "member-domain-tools.kill-latency.slow-burn", "sloId": "member-domain-tools.kill-latency", "planeId": "member-domain-tools", "metricId": "kill-latency", "kind": "slow-burn", "severity": "sev3", "owner": "platform_engineering", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on member-domain-tools, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "member-domain-tools.kill-latency.post-kill-unapproved-effect", "sloId": "member-domain-tools.kill-latency", "planeId": "member-domain-tools", "metricId": "kill-latency", "kind": "hard-lock", "severity": "sev1", "owner": "platform_engineering", "condition": "Fire immediately when post-kill-unapproved-effect count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on member-domain-tools, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "member-domain-tools.duplicate-action.violation", "sloId": "member-domain-tools.duplicate-action", "planeId": "member-domain-tools", "metricId": "duplicate-action", "kind": "hard-lock", "severity": "sev1", "owner": "platform_engineering", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Fence mutation starts on member-domain-tools, retain read-only inspection and cancellation, and require reconciliation before replay." }, { "id": "member-domain-tools.late-action.violation", "sloId": "member-domain-tools.late-action", "planeId": "member-domain-tools", "metricId": "late-action", "kind": "hard-lock", "severity": "sev1", "owner": "platform_engineering", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Fence mutation starts on member-domain-tools, retain read-only inspection and cancellation, and require reconciliation before replay." }, { "id": "member-domain-tools.recovery.fast-burn", "sloId": "member-domain-tools.recovery", "planeId": "member-domain-tools", "metricId": "recovery", "kind": "fast-burn", "severity": "sev2", "owner": "platform_engineering", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on member-domain-tools, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "member-domain-tools.recovery.slow-burn", "sloId": "member-domain-tools.recovery", "planeId": "member-domain-tools", "metricId": "recovery", "kind": "slow-burn", "severity": "sev3", "owner": "platform_engineering", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on member-domain-tools, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "member-domain-tools.recovery.recovery-falsely-reported-success", "sloId": "member-domain-tools.recovery", "planeId": "member-domain-tools", "metricId": "recovery", "kind": "hard-lock", "severity": "sev1", "owner": "platform_engineering", "condition": "Fire immediately when recovery-falsely-reported-success count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on member-domain-tools, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "member-domain-tools.cost.fast-burn", "sloId": "member-domain-tools.cost", "planeId": "member-domain-tools", "metricId": "cost", "kind": "fast-burn", "severity": "sev2", "owner": "platform_engineering", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on member-domain-tools above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "member-domain-tools.cost.slow-burn", "sloId": "member-domain-tools.cost", "planeId": "member-domain-tools", "metricId": "cost", "kind": "slow-burn", "severity": "sev3", "owner": "platform_engineering", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on member-domain-tools above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "member-domain-tools.cost.unpriced-or-unreceipted-leg", "sloId": "member-domain-tools.cost", "planeId": "member-domain-tools", "metricId": "cost", "kind": "hard-lock", "severity": "sev1", "owner": "platform_engineering", "condition": "Fire immediately when unpriced-or-unreceipted-leg count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on member-domain-tools above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "member-domain-tools.data-boundary-violations.violation", "sloId": "member-domain-tools.data-boundary-violations", "planeId": "member-domain-tools", "metricId": "data-boundary-violations", "kind": "hard-lock", "severity": "sev1", "owner": "platform_engineering", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/privacy-incident.md", "safeDegradedMode": "Fence member-domain-tools, preserve evidence, revoke affected authority, and expose no fallback path until Security and Compliance verify containment." }, { "id": "client-tool-bridge.availability.fast-burn", "sloId": "client-tool-bridge.availability", "planeId": "client-tool-bridge", "metricId": "availability", "kind": "fast-burn", "severity": "sev2", "owner": "reliability", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose client-tool-bridge as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "client-tool-bridge.availability.slow-burn", "sloId": "client-tool-bridge.availability", "planeId": "client-tool-bridge", "metricId": "availability", "kind": "slow-burn", "severity": "sev3", "owner": "reliability", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose client-tool-bridge as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "client-tool-bridge.availability.telemetry-blindness", "sloId": "client-tool-bridge.availability", "planeId": "client-tool-bridge", "metricId": "availability", "kind": "telemetry-blindness", "severity": "sev2", "owner": "reliability", "condition": "Fire after five minutes without expected production observations or when receipt reconciliation is incomplete; absence of data is UNKNOWN, never green.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose client-tool-bridge as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "client-tool-bridge.total-latency.fast-burn", "sloId": "client-tool-bridge.total-latency", "planeId": "client-tool-bridge", "metricId": "total-latency", "kind": "fast-burn", "severity": "sev2", "owner": "reliability", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on client-tool-bridge; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "client-tool-bridge.total-latency.slow-burn", "sloId": "client-tool-bridge.total-latency", "planeId": "client-tool-bridge", "metricId": "total-latency", "kind": "slow-burn", "severity": "sev3", "owner": "reliability", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on client-tool-bridge; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "client-tool-bridge.tool-completion.fast-burn", "sloId": "client-tool-bridge.tool-completion", "planeId": "client-tool-bridge", "metricId": "tool-completion", "kind": "fast-burn", "severity": "sev2", "owner": "reliability", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Disable the affected mutation class on client-tool-bridge; retain status/readback and return truthful failed or unavailable outcomes." }, { "id": "client-tool-bridge.tool-completion.slow-burn", "sloId": "client-tool-bridge.tool-completion", "planeId": "client-tool-bridge", "metricId": "tool-completion", "kind": "slow-burn", "severity": "sev3", "owner": "reliability", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Disable the affected mutation class on client-tool-bridge; retain status/readback and return truthful failed or unavailable outcomes." }, { "id": "client-tool-bridge.cancel-latency.fast-burn", "sloId": "client-tool-bridge.cancel-latency", "planeId": "client-tool-bridge", "metricId": "cancel-latency", "kind": "fast-burn", "severity": "sev2", "owner": "reliability", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on client-tool-bridge, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "client-tool-bridge.cancel-latency.slow-burn", "sloId": "client-tool-bridge.cancel-latency", "planeId": "client-tool-bridge", "metricId": "cancel-latency", "kind": "slow-burn", "severity": "sev3", "owner": "reliability", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on client-tool-bridge, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "client-tool-bridge.cancel-latency.post-cancel-unapproved-effect", "sloId": "client-tool-bridge.cancel-latency", "planeId": "client-tool-bridge", "metricId": "cancel-latency", "kind": "hard-lock", "severity": "sev1", "owner": "reliability", "condition": "Fire immediately when post-cancel-unapproved-effect count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on client-tool-bridge, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "client-tool-bridge.kill-latency.fast-burn", "sloId": "client-tool-bridge.kill-latency", "planeId": "client-tool-bridge", "metricId": "kill-latency", "kind": "fast-burn", "severity": "sev2", "owner": "reliability", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on client-tool-bridge, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "client-tool-bridge.kill-latency.slow-burn", "sloId": "client-tool-bridge.kill-latency", "planeId": "client-tool-bridge", "metricId": "kill-latency", "kind": "slow-burn", "severity": "sev3", "owner": "reliability", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on client-tool-bridge, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "client-tool-bridge.kill-latency.post-kill-unapproved-effect", "sloId": "client-tool-bridge.kill-latency", "planeId": "client-tool-bridge", "metricId": "kill-latency", "kind": "hard-lock", "severity": "sev1", "owner": "reliability", "condition": "Fire immediately when post-kill-unapproved-effect count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on client-tool-bridge, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "client-tool-bridge.duplicate-action.violation", "sloId": "client-tool-bridge.duplicate-action", "planeId": "client-tool-bridge", "metricId": "duplicate-action", "kind": "hard-lock", "severity": "sev1", "owner": "reliability", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Fence mutation starts on client-tool-bridge, retain read-only inspection and cancellation, and require reconciliation before replay." }, { "id": "client-tool-bridge.late-action.violation", "sloId": "client-tool-bridge.late-action", "planeId": "client-tool-bridge", "metricId": "late-action", "kind": "hard-lock", "severity": "sev1", "owner": "reliability", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Fence mutation starts on client-tool-bridge, retain read-only inspection and cancellation, and require reconciliation before replay." }, { "id": "client-tool-bridge.recovery.fast-burn", "sloId": "client-tool-bridge.recovery", "planeId": "client-tool-bridge", "metricId": "recovery", "kind": "fast-burn", "severity": "sev2", "owner": "reliability", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on client-tool-bridge, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "client-tool-bridge.recovery.slow-burn", "sloId": "client-tool-bridge.recovery", "planeId": "client-tool-bridge", "metricId": "recovery", "kind": "slow-burn", "severity": "sev3", "owner": "reliability", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on client-tool-bridge, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "client-tool-bridge.recovery.recovery-falsely-reported-success", "sloId": "client-tool-bridge.recovery", "planeId": "client-tool-bridge", "metricId": "recovery", "kind": "hard-lock", "severity": "sev1", "owner": "reliability", "condition": "Fire immediately when recovery-falsely-reported-success count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on client-tool-bridge, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "client-tool-bridge.cost.fast-burn", "sloId": "client-tool-bridge.cost", "planeId": "client-tool-bridge", "metricId": "cost", "kind": "fast-burn", "severity": "sev2", "owner": "reliability", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on client-tool-bridge above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "client-tool-bridge.cost.slow-burn", "sloId": "client-tool-bridge.cost", "planeId": "client-tool-bridge", "metricId": "cost", "kind": "slow-burn", "severity": "sev3", "owner": "reliability", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on client-tool-bridge above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "client-tool-bridge.cost.unpriced-or-unreceipted-leg", "sloId": "client-tool-bridge.cost", "planeId": "client-tool-bridge", "metricId": "cost", "kind": "hard-lock", "severity": "sev1", "owner": "reliability", "condition": "Fire immediately when unpriced-or-unreceipted-leg count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on client-tool-bridge above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "client-tool-bridge.data-boundary-violations.violation", "sloId": "client-tool-bridge.data-boundary-violations", "planeId": "client-tool-bridge", "metricId": "data-boundary-violations", "kind": "hard-lock", "severity": "sev1", "owner": "reliability", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/privacy-incident.md", "safeDegradedMode": "Fence client-tool-bridge, preserve evidence, revoke affected authority, and expose no fallback path until Security and Compliance verify containment." }, { "id": "retrieval.availability.fast-burn", "sloId": "retrieval.availability", "planeId": "retrieval", "metricId": "availability", "kind": "fast-burn", "severity": "sev2", "owner": "platform_engineering", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose retrieval as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "retrieval.availability.slow-burn", "sloId": "retrieval.availability", "planeId": "retrieval", "metricId": "availability", "kind": "slow-burn", "severity": "sev3", "owner": "platform_engineering", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose retrieval as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "retrieval.availability.telemetry-blindness", "sloId": "retrieval.availability", "planeId": "retrieval", "metricId": "availability", "kind": "telemetry-blindness", "severity": "sev2", "owner": "platform_engineering", "condition": "Fire after five minutes without expected production observations or when receipt reconciliation is incomplete; absence of data is UNKNOWN, never green.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose retrieval as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "retrieval.total-latency.fast-burn", "sloId": "retrieval.total-latency", "planeId": "retrieval", "metricId": "total-latency", "kind": "fast-burn", "severity": "sev2", "owner": "platform_engineering", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on retrieval; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "retrieval.total-latency.slow-burn", "sloId": "retrieval.total-latency", "planeId": "retrieval", "metricId": "total-latency", "kind": "slow-burn", "severity": "sev3", "owner": "platform_engineering", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on retrieval; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "retrieval.tool-completion.fast-burn", "sloId": "retrieval.tool-completion", "planeId": "retrieval", "metricId": "tool-completion", "kind": "fast-burn", "severity": "sev2", "owner": "platform_engineering", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Disable the affected mutation class on retrieval; retain status/readback and return truthful failed or unavailable outcomes." }, { "id": "retrieval.tool-completion.slow-burn", "sloId": "retrieval.tool-completion", "planeId": "retrieval", "metricId": "tool-completion", "kind": "slow-burn", "severity": "sev3", "owner": "platform_engineering", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Disable the affected mutation class on retrieval; retain status/readback and return truthful failed or unavailable outcomes." }, { "id": "retrieval.cancel-latency.fast-burn", "sloId": "retrieval.cancel-latency", "planeId": "retrieval", "metricId": "cancel-latency", "kind": "fast-burn", "severity": "sev2", "owner": "platform_engineering", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on retrieval, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "retrieval.cancel-latency.slow-burn", "sloId": "retrieval.cancel-latency", "planeId": "retrieval", "metricId": "cancel-latency", "kind": "slow-burn", "severity": "sev3", "owner": "platform_engineering", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on retrieval, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "retrieval.cancel-latency.post-cancel-unapproved-effect", "sloId": "retrieval.cancel-latency", "planeId": "retrieval", "metricId": "cancel-latency", "kind": "hard-lock", "severity": "sev1", "owner": "platform_engineering", "condition": "Fire immediately when post-cancel-unapproved-effect count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on retrieval, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "retrieval.recovery.fast-burn", "sloId": "retrieval.recovery", "planeId": "retrieval", "metricId": "recovery", "kind": "fast-burn", "severity": "sev2", "owner": "platform_engineering", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on retrieval, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "retrieval.recovery.slow-burn", "sloId": "retrieval.recovery", "planeId": "retrieval", "metricId": "recovery", "kind": "slow-burn", "severity": "sev3", "owner": "platform_engineering", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on retrieval, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "retrieval.recovery.recovery-falsely-reported-success", "sloId": "retrieval.recovery", "planeId": "retrieval", "metricId": "recovery", "kind": "hard-lock", "severity": "sev1", "owner": "platform_engineering", "condition": "Fire immediately when recovery-falsely-reported-success count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on retrieval, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "retrieval.grounding.fast-burn", "sloId": "retrieval.grounding", "planeId": "retrieval", "metricId": "grounding", "kind": "fast-burn", "severity": "sev2", "owner": "platform_engineering", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/grounding-failure.md", "safeDegradedMode": "Stop grounded publication through retrieval; answer only with an explicit inability to verify or an admitted source-independent refusal." }, { "id": "retrieval.grounding.slow-burn", "sloId": "retrieval.grounding", "planeId": "retrieval", "metricId": "grounding", "kind": "slow-burn", "severity": "sev3", "owner": "platform_engineering", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/grounding-failure.md", "safeDegradedMode": "Stop grounded publication through retrieval; answer only with an explicit inability to verify or an admitted source-independent refusal." }, { "id": "retrieval.grounding.fabricated-citation", "sloId": "retrieval.grounding", "planeId": "retrieval", "metricId": "grounding", "kind": "hard-lock", "severity": "sev1", "owner": "platform_engineering", "condition": "Fire immediately when fabricated-citation count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/grounding-failure.md", "safeDegradedMode": "Stop grounded publication through retrieval; answer only with an explicit inability to verify or an admitted source-independent refusal." }, { "id": "retrieval.cost.fast-burn", "sloId": "retrieval.cost", "planeId": "retrieval", "metricId": "cost", "kind": "fast-burn", "severity": "sev2", "owner": "platform_engineering", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on retrieval above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "retrieval.cost.slow-burn", "sloId": "retrieval.cost", "planeId": "retrieval", "metricId": "cost", "kind": "slow-burn", "severity": "sev3", "owner": "platform_engineering", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on retrieval above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "retrieval.cost.unpriced-or-unreceipted-leg", "sloId": "retrieval.cost", "planeId": "retrieval", "metricId": "cost", "kind": "hard-lock", "severity": "sev1", "owner": "platform_engineering", "condition": "Fire immediately when unpriced-or-unreceipted-leg count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on retrieval above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "retrieval.data-boundary-violations.violation", "sloId": "retrieval.data-boundary-violations", "planeId": "retrieval", "metricId": "data-boundary-violations", "kind": "hard-lock", "severity": "sev1", "owner": "platform_engineering", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/privacy-incident.md", "safeDegradedMode": "Fence retrieval, preserve evidence, revoke affected authority, and expose no fallback path until Security and Compliance verify containment." }, { "id": "operator-tools.availability.fast-burn", "sloId": "operator-tools.availability", "planeId": "operator-tools", "metricId": "availability", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose operator-tools as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "operator-tools.availability.slow-burn", "sloId": "operator-tools.availability", "planeId": "operator-tools", "metricId": "availability", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose operator-tools as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "operator-tools.availability.telemetry-blindness", "sloId": "operator-tools.availability", "planeId": "operator-tools", "metricId": "availability", "kind": "telemetry-blindness", "severity": "sev2", "owner": "assistant_product", "condition": "Fire after five minutes without expected production observations or when receipt reconciliation is incomplete; absence of data is UNKNOWN, never green.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose operator-tools as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "operator-tools.total-latency.fast-burn", "sloId": "operator-tools.total-latency", "planeId": "operator-tools", "metricId": "total-latency", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on operator-tools; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "operator-tools.total-latency.slow-burn", "sloId": "operator-tools.total-latency", "planeId": "operator-tools", "metricId": "total-latency", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on operator-tools; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "operator-tools.tool-completion.fast-burn", "sloId": "operator-tools.tool-completion", "planeId": "operator-tools", "metricId": "tool-completion", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Disable the affected mutation class on operator-tools; retain status/readback and return truthful failed or unavailable outcomes." }, { "id": "operator-tools.tool-completion.slow-burn", "sloId": "operator-tools.tool-completion", "planeId": "operator-tools", "metricId": "tool-completion", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Disable the affected mutation class on operator-tools; retain status/readback and return truthful failed or unavailable outcomes." }, { "id": "operator-tools.cancel-latency.fast-burn", "sloId": "operator-tools.cancel-latency", "planeId": "operator-tools", "metricId": "cancel-latency", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on operator-tools, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "operator-tools.cancel-latency.slow-burn", "sloId": "operator-tools.cancel-latency", "planeId": "operator-tools", "metricId": "cancel-latency", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on operator-tools, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "operator-tools.cancel-latency.post-cancel-unapproved-effect", "sloId": "operator-tools.cancel-latency", "planeId": "operator-tools", "metricId": "cancel-latency", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately when post-cancel-unapproved-effect count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on operator-tools, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "operator-tools.kill-latency.fast-burn", "sloId": "operator-tools.kill-latency", "planeId": "operator-tools", "metricId": "kill-latency", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on operator-tools, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "operator-tools.kill-latency.slow-burn", "sloId": "operator-tools.kill-latency", "planeId": "operator-tools", "metricId": "kill-latency", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on operator-tools, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "operator-tools.kill-latency.post-kill-unapproved-effect", "sloId": "operator-tools.kill-latency", "planeId": "operator-tools", "metricId": "kill-latency", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately when post-kill-unapproved-effect count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on operator-tools, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "operator-tools.duplicate-action.violation", "sloId": "operator-tools.duplicate-action", "planeId": "operator-tools", "metricId": "duplicate-action", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Fence mutation starts on operator-tools, retain read-only inspection and cancellation, and require reconciliation before replay." }, { "id": "operator-tools.late-action.violation", "sloId": "operator-tools.late-action", "planeId": "operator-tools", "metricId": "late-action", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Fence mutation starts on operator-tools, retain read-only inspection and cancellation, and require reconciliation before replay." }, { "id": "operator-tools.recovery.fast-burn", "sloId": "operator-tools.recovery", "planeId": "operator-tools", "metricId": "recovery", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on operator-tools, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "operator-tools.recovery.slow-burn", "sloId": "operator-tools.recovery", "planeId": "operator-tools", "metricId": "recovery", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on operator-tools, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "operator-tools.recovery.recovery-falsely-reported-success", "sloId": "operator-tools.recovery", "planeId": "operator-tools", "metricId": "recovery", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately when recovery-falsely-reported-success count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on operator-tools, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "operator-tools.cost.fast-burn", "sloId": "operator-tools.cost", "planeId": "operator-tools", "metricId": "cost", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on operator-tools above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "operator-tools.cost.slow-burn", "sloId": "operator-tools.cost", "planeId": "operator-tools", "metricId": "cost", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on operator-tools above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "operator-tools.cost.unpriced-or-unreceipted-leg", "sloId": "operator-tools.cost", "planeId": "operator-tools", "metricId": "cost", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately when unpriced-or-unreceipted-leg count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on operator-tools above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "operator-tools.data-boundary-violations.violation", "sloId": "operator-tools.data-boundary-violations", "planeId": "operator-tools", "metricId": "data-boundary-violations", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/privacy-incident.md", "safeDegradedMode": "Fence operator-tools, preserve evidence, revoke affected authority, and expose no fallback path until Security and Compliance verify containment." }, { "id": "memory-and-session.availability.fast-burn", "sloId": "memory-and-session.availability", "planeId": "memory-and-session", "metricId": "availability", "kind": "fast-burn", "severity": "sev2", "owner": "compliance", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose memory-and-session as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "memory-and-session.availability.slow-burn", "sloId": "memory-and-session.availability", "planeId": "memory-and-session", "metricId": "availability", "kind": "slow-burn", "severity": "sev3", "owner": "compliance", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose memory-and-session as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "memory-and-session.availability.telemetry-blindness", "sloId": "memory-and-session.availability", "planeId": "memory-and-session", "metricId": "availability", "kind": "telemetry-blindness", "severity": "sev2", "owner": "compliance", "condition": "Fire after five minutes without expected production observations or when receipt reconciliation is incomplete; absence of data is UNKNOWN, never green.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose memory-and-session as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "memory-and-session.total-latency.fast-burn", "sloId": "memory-and-session.total-latency", "planeId": "memory-and-session", "metricId": "total-latency", "kind": "fast-burn", "severity": "sev2", "owner": "compliance", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on memory-and-session; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "memory-and-session.total-latency.slow-burn", "sloId": "memory-and-session.total-latency", "planeId": "memory-and-session", "metricId": "total-latency", "kind": "slow-burn", "severity": "sev3", "owner": "compliance", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on memory-and-session; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "memory-and-session.tool-completion.fast-burn", "sloId": "memory-and-session.tool-completion", "planeId": "memory-and-session", "metricId": "tool-completion", "kind": "fast-burn", "severity": "sev2", "owner": "compliance", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Disable the affected mutation class on memory-and-session; retain status/readback and return truthful failed or unavailable outcomes." }, { "id": "memory-and-session.tool-completion.slow-burn", "sloId": "memory-and-session.tool-completion", "planeId": "memory-and-session", "metricId": "tool-completion", "kind": "slow-burn", "severity": "sev3", "owner": "compliance", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Disable the affected mutation class on memory-and-session; retain status/readback and return truthful failed or unavailable outcomes." }, { "id": "memory-and-session.duplicate-action.violation", "sloId": "memory-and-session.duplicate-action", "planeId": "memory-and-session", "metricId": "duplicate-action", "kind": "hard-lock", "severity": "sev1", "owner": "compliance", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Fence mutation starts on memory-and-session, retain read-only inspection and cancellation, and require reconciliation before replay." }, { "id": "memory-and-session.late-action.violation", "sloId": "memory-and-session.late-action", "planeId": "memory-and-session", "metricId": "late-action", "kind": "hard-lock", "severity": "sev1", "owner": "compliance", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Fence mutation starts on memory-and-session, retain read-only inspection and cancellation, and require reconciliation before replay." }, { "id": "memory-and-session.recovery.fast-burn", "sloId": "memory-and-session.recovery", "planeId": "memory-and-session", "metricId": "recovery", "kind": "fast-burn", "severity": "sev2", "owner": "compliance", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on memory-and-session, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "memory-and-session.recovery.slow-burn", "sloId": "memory-and-session.recovery", "planeId": "memory-and-session", "metricId": "recovery", "kind": "slow-burn", "severity": "sev3", "owner": "compliance", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on memory-and-session, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "memory-and-session.recovery.recovery-falsely-reported-success", "sloId": "memory-and-session.recovery", "planeId": "memory-and-session", "metricId": "recovery", "kind": "hard-lock", "severity": "sev1", "owner": "compliance", "condition": "Fire immediately when recovery-falsely-reported-success count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on memory-and-session, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "memory-and-session.data-boundary-violations.violation", "sloId": "memory-and-session.data-boundary-violations", "planeId": "memory-and-session", "metricId": "data-boundary-violations", "kind": "hard-lock", "severity": "sev1", "owner": "compliance", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/privacy-incident.md", "safeDegradedMode": "Fence memory-and-session, preserve evidence, revoke affected authority, and expose no fallback path until Security and Compliance verify containment." }, { "id": "workbench-intent.availability.fast-burn", "sloId": "workbench-intent.availability", "planeId": "workbench-intent", "metricId": "availability", "kind": "fast-burn", "severity": "sev2", "owner": "platform_engineering", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose workbench-intent as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "workbench-intent.availability.slow-burn", "sloId": "workbench-intent.availability", "planeId": "workbench-intent", "metricId": "availability", "kind": "slow-burn", "severity": "sev3", "owner": "platform_engineering", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose workbench-intent as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "workbench-intent.availability.telemetry-blindness", "sloId": "workbench-intent.availability", "planeId": "workbench-intent", "metricId": "availability", "kind": "telemetry-blindness", "severity": "sev2", "owner": "platform_engineering", "condition": "Fire after five minutes without expected production observations or when receipt reconciliation is incomplete; absence of data is UNKNOWN, never green.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose workbench-intent as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "workbench-intent.total-latency.fast-burn", "sloId": "workbench-intent.total-latency", "planeId": "workbench-intent", "metricId": "total-latency", "kind": "fast-burn", "severity": "sev2", "owner": "platform_engineering", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on workbench-intent; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "workbench-intent.total-latency.slow-burn", "sloId": "workbench-intent.total-latency", "planeId": "workbench-intent", "metricId": "total-latency", "kind": "slow-burn", "severity": "sev3", "owner": "platform_engineering", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on workbench-intent; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "workbench-intent.task-completion.fast-burn", "sloId": "workbench-intent.task-completion", "planeId": "workbench-intent", "metricId": "task-completion", "kind": "fast-burn", "severity": "sev2", "owner": "platform_engineering", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Disable the affected mutation class on workbench-intent; retain status/readback and return truthful failed or unavailable outcomes." }, { "id": "workbench-intent.task-completion.slow-burn", "sloId": "workbench-intent.task-completion", "planeId": "workbench-intent", "metricId": "task-completion", "kind": "slow-burn", "severity": "sev3", "owner": "platform_engineering", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Disable the affected mutation class on workbench-intent; retain status/readback and return truthful failed or unavailable outcomes." }, { "id": "workbench-intent.cancel-latency.fast-burn", "sloId": "workbench-intent.cancel-latency", "planeId": "workbench-intent", "metricId": "cancel-latency", "kind": "fast-burn", "severity": "sev2", "owner": "platform_engineering", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on workbench-intent, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "workbench-intent.cancel-latency.slow-burn", "sloId": "workbench-intent.cancel-latency", "planeId": "workbench-intent", "metricId": "cancel-latency", "kind": "slow-burn", "severity": "sev3", "owner": "platform_engineering", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on workbench-intent, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "workbench-intent.cancel-latency.post-cancel-unapproved-effect", "sloId": "workbench-intent.cancel-latency", "planeId": "workbench-intent", "metricId": "cancel-latency", "kind": "hard-lock", "severity": "sev1", "owner": "platform_engineering", "condition": "Fire immediately when post-cancel-unapproved-effect count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on workbench-intent, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "workbench-intent.kill-latency.fast-burn", "sloId": "workbench-intent.kill-latency", "planeId": "workbench-intent", "metricId": "kill-latency", "kind": "fast-burn", "severity": "sev2", "owner": "platform_engineering", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on workbench-intent, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "workbench-intent.kill-latency.slow-burn", "sloId": "workbench-intent.kill-latency", "planeId": "workbench-intent", "metricId": "kill-latency", "kind": "slow-burn", "severity": "sev3", "owner": "platform_engineering", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on workbench-intent, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "workbench-intent.kill-latency.post-kill-unapproved-effect", "sloId": "workbench-intent.kill-latency", "planeId": "workbench-intent", "metricId": "kill-latency", "kind": "hard-lock", "severity": "sev1", "owner": "platform_engineering", "condition": "Fire immediately when post-kill-unapproved-effect count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on workbench-intent, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "workbench-intent.duplicate-action.violation", "sloId": "workbench-intent.duplicate-action", "planeId": "workbench-intent", "metricId": "duplicate-action", "kind": "hard-lock", "severity": "sev1", "owner": "platform_engineering", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Fence mutation starts on workbench-intent, retain read-only inspection and cancellation, and require reconciliation before replay." }, { "id": "workbench-intent.late-action.violation", "sloId": "workbench-intent.late-action", "planeId": "workbench-intent", "metricId": "late-action", "kind": "hard-lock", "severity": "sev1", "owner": "platform_engineering", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Fence mutation starts on workbench-intent, retain read-only inspection and cancellation, and require reconciliation before replay." }, { "id": "workbench-intent.queue-age.fast-burn", "sloId": "workbench-intent.queue-age", "planeId": "workbench-intent", "metricId": "queue-age", "kind": "fast-burn", "severity": "sev2", "owner": "platform_engineering", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new queue admission on workbench-intent, preserve ordering and leases, expose age and ownership, and drain only under supervision." }, { "id": "workbench-intent.queue-age.slow-burn", "sloId": "workbench-intent.queue-age", "planeId": "workbench-intent", "metricId": "queue-age", "kind": "slow-burn", "severity": "sev3", "owner": "platform_engineering", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new queue admission on workbench-intent, preserve ordering and leases, expose age and ownership, and drain only under supervision." }, { "id": "workbench-intent.recovery.fast-burn", "sloId": "workbench-intent.recovery", "planeId": "workbench-intent", "metricId": "recovery", "kind": "fast-burn", "severity": "sev2", "owner": "platform_engineering", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on workbench-intent, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "workbench-intent.recovery.slow-burn", "sloId": "workbench-intent.recovery", "planeId": "workbench-intent", "metricId": "recovery", "kind": "slow-burn", "severity": "sev3", "owner": "platform_engineering", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on workbench-intent, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "workbench-intent.recovery.recovery-falsely-reported-success", "sloId": "workbench-intent.recovery", "planeId": "workbench-intent", "metricId": "recovery", "kind": "hard-lock", "severity": "sev1", "owner": "platform_engineering", "condition": "Fire immediately when recovery-falsely-reported-success count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on workbench-intent, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "workbench-intent.cost.fast-burn", "sloId": "workbench-intent.cost", "planeId": "workbench-intent", "metricId": "cost", "kind": "fast-burn", "severity": "sev2", "owner": "platform_engineering", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on workbench-intent above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "workbench-intent.cost.slow-burn", "sloId": "workbench-intent.cost", "planeId": "workbench-intent", "metricId": "cost", "kind": "slow-burn", "severity": "sev3", "owner": "platform_engineering", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on workbench-intent above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "workbench-intent.cost.unpriced-or-unreceipted-leg", "sloId": "workbench-intent.cost", "planeId": "workbench-intent", "metricId": "cost", "kind": "hard-lock", "severity": "sev1", "owner": "platform_engineering", "condition": "Fire immediately when unpriced-or-unreceipted-leg count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on workbench-intent above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "workbench-intent.data-boundary-violations.violation", "sloId": "workbench-intent.data-boundary-violations", "planeId": "workbench-intent", "metricId": "data-boundary-violations", "kind": "hard-lock", "severity": "sev1", "owner": "platform_engineering", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/privacy-incident.md", "safeDegradedMode": "Fence workbench-intent, preserve evidence, revoke affected authority, and expose no fallback path until Security and Compliance verify containment." }, { "id": "model-provider.availability.fast-burn", "sloId": "model-provider.availability", "planeId": "model-provider", "metricId": "availability", "kind": "fast-burn", "severity": "sev2", "owner": "reliability", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose model-provider as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "model-provider.availability.slow-burn", "sloId": "model-provider.availability", "planeId": "model-provider", "metricId": "availability", "kind": "slow-burn", "severity": "sev3", "owner": "reliability", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose model-provider as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "model-provider.availability.telemetry-blindness", "sloId": "model-provider.availability", "planeId": "model-provider", "metricId": "availability", "kind": "telemetry-blindness", "severity": "sev2", "owner": "reliability", "condition": "Fire after five minutes without expected production observations or when receipt reconciliation is incomplete; absence of data is UNKNOWN, never green.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose model-provider as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "model-provider.ttft.fast-burn", "sloId": "model-provider.ttft", "planeId": "model-provider", "metricId": "ttft", "kind": "fast-burn", "severity": "sev2", "owner": "reliability", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on model-provider; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "model-provider.ttft.slow-burn", "sloId": "model-provider.ttft", "planeId": "model-provider", "metricId": "ttft", "kind": "slow-burn", "severity": "sev3", "owner": "reliability", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on model-provider; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "model-provider.total-latency.fast-burn", "sloId": "model-provider.total-latency", "planeId": "model-provider", "metricId": "total-latency", "kind": "fast-burn", "severity": "sev2", "owner": "reliability", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on model-provider; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "model-provider.total-latency.slow-burn", "sloId": "model-provider.total-latency", "planeId": "model-provider", "metricId": "total-latency", "kind": "slow-burn", "severity": "sev3", "owner": "reliability", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on model-provider; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "model-provider.task-completion.fast-burn", "sloId": "model-provider.task-completion", "planeId": "model-provider", "metricId": "task-completion", "kind": "fast-burn", "severity": "sev2", "owner": "reliability", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Disable the affected mutation class on model-provider; retain status/readback and return truthful failed or unavailable outcomes." }, { "id": "model-provider.task-completion.slow-burn", "sloId": "model-provider.task-completion", "planeId": "model-provider", "metricId": "task-completion", "kind": "slow-burn", "severity": "sev3", "owner": "reliability", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Disable the affected mutation class on model-provider; retain status/readback and return truthful failed or unavailable outcomes." }, { "id": "model-provider.cancel-latency.fast-burn", "sloId": "model-provider.cancel-latency", "planeId": "model-provider", "metricId": "cancel-latency", "kind": "fast-burn", "severity": "sev2", "owner": "reliability", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on model-provider, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "model-provider.cancel-latency.slow-burn", "sloId": "model-provider.cancel-latency", "planeId": "model-provider", "metricId": "cancel-latency", "kind": "slow-burn", "severity": "sev3", "owner": "reliability", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on model-provider, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "model-provider.cancel-latency.post-cancel-unapproved-effect", "sloId": "model-provider.cancel-latency", "planeId": "model-provider", "metricId": "cancel-latency", "kind": "hard-lock", "severity": "sev1", "owner": "reliability", "condition": "Fire immediately when post-cancel-unapproved-effect count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on model-provider, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "model-provider.kill-latency.fast-burn", "sloId": "model-provider.kill-latency", "planeId": "model-provider", "metricId": "kill-latency", "kind": "fast-burn", "severity": "sev2", "owner": "reliability", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on model-provider, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "model-provider.kill-latency.slow-burn", "sloId": "model-provider.kill-latency", "planeId": "model-provider", "metricId": "kill-latency", "kind": "slow-burn", "severity": "sev3", "owner": "reliability", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on model-provider, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "model-provider.kill-latency.post-kill-unapproved-effect", "sloId": "model-provider.kill-latency", "planeId": "model-provider", "metricId": "kill-latency", "kind": "hard-lock", "severity": "sev1", "owner": "reliability", "condition": "Fire immediately when post-kill-unapproved-effect count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on model-provider, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "model-provider.duplicate-action.violation", "sloId": "model-provider.duplicate-action", "planeId": "model-provider", "metricId": "duplicate-action", "kind": "hard-lock", "severity": "sev1", "owner": "reliability", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Fence mutation starts on model-provider, retain read-only inspection and cancellation, and require reconciliation before replay." }, { "id": "model-provider.late-action.violation", "sloId": "model-provider.late-action", "planeId": "model-provider", "metricId": "late-action", "kind": "hard-lock", "severity": "sev1", "owner": "reliability", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Fence mutation starts on model-provider, retain read-only inspection and cancellation, and require reconciliation before replay." }, { "id": "model-provider.recovery.fast-burn", "sloId": "model-provider.recovery", "planeId": "model-provider", "metricId": "recovery", "kind": "fast-burn", "severity": "sev2", "owner": "reliability", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on model-provider, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "model-provider.recovery.slow-burn", "sloId": "model-provider.recovery", "planeId": "model-provider", "metricId": "recovery", "kind": "slow-burn", "severity": "sev3", "owner": "reliability", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on model-provider, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "model-provider.recovery.recovery-falsely-reported-success", "sloId": "model-provider.recovery", "planeId": "model-provider", "metricId": "recovery", "kind": "hard-lock", "severity": "sev1", "owner": "reliability", "condition": "Fire immediately when recovery-falsely-reported-success count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on model-provider, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "model-provider.provider-errors.fast-burn", "sloId": "model-provider.provider-errors", "planeId": "model-provider", "metricId": "provider-errors", "kind": "fast-burn", "severity": "sev2", "owner": "reliability", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/provider-failover.md", "safeDegradedMode": "Disable the failing route on model-provider; use only a pre-admitted failover route, otherwise return a truthful unavailable result." }, { "id": "model-provider.provider-errors.slow-burn", "sloId": "model-provider.provider-errors", "planeId": "model-provider", "metricId": "provider-errors", "kind": "slow-burn", "severity": "sev3", "owner": "reliability", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/provider-failover.md", "safeDegradedMode": "Disable the failing route on model-provider; use only a pre-admitted failover route, otherwise return a truthful unavailable result." }, { "id": "model-provider.cost.fast-burn", "sloId": "model-provider.cost", "planeId": "model-provider", "metricId": "cost", "kind": "fast-burn", "severity": "sev2", "owner": "reliability", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on model-provider above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "model-provider.cost.slow-burn", "sloId": "model-provider.cost", "planeId": "model-provider", "metricId": "cost", "kind": "slow-burn", "severity": "sev3", "owner": "reliability", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on model-provider above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "model-provider.cost.unpriced-or-unreceipted-leg", "sloId": "model-provider.cost", "planeId": "model-provider", "metricId": "cost", "kind": "hard-lock", "severity": "sev1", "owner": "reliability", "condition": "Fire immediately when unpriced-or-unreceipted-leg count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on model-provider above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "model-provider.data-boundary-violations.violation", "sloId": "model-provider.data-boundary-violations", "planeId": "model-provider", "metricId": "data-boundary-violations", "kind": "hard-lock", "severity": "sev1", "owner": "reliability", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/privacy-incident.md", "safeDegradedMode": "Fence model-provider, preserve evidence, revoke affected authority, and expose no fallback path until Security and Compliance verify containment." }, { "id": "voice.availability.fast-burn", "sloId": "voice.availability", "planeId": "voice", "metricId": "availability", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose voice as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "voice.availability.slow-burn", "sloId": "voice.availability", "planeId": "voice", "metricId": "availability", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose voice as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "voice.availability.telemetry-blindness", "sloId": "voice.availability", "planeId": "voice", "metricId": "availability", "kind": "telemetry-blindness", "severity": "sev2", "owner": "assistant_product", "condition": "Fire after five minutes without expected production observations or when receipt reconciliation is incomplete; absence of data is UNKNOWN, never green.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose voice as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "voice.ttft.fast-burn", "sloId": "voice.ttft", "planeId": "voice", "metricId": "ttft", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on voice; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "voice.ttft.slow-burn", "sloId": "voice.ttft", "planeId": "voice", "metricId": "ttft", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on voice; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "voice.total-latency.fast-burn", "sloId": "voice.total-latency", "planeId": "voice", "metricId": "total-latency", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on voice; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "voice.total-latency.slow-burn", "sloId": "voice.total-latency", "planeId": "voice", "metricId": "total-latency", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on voice; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "voice.task-completion.fast-burn", "sloId": "voice.task-completion", "planeId": "voice", "metricId": "task-completion", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Disable the affected mutation class on voice; retain status/readback and return truthful failed or unavailable outcomes." }, { "id": "voice.task-completion.slow-burn", "sloId": "voice.task-completion", "planeId": "voice", "metricId": "task-completion", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Disable the affected mutation class on voice; retain status/readback and return truthful failed or unavailable outcomes." }, { "id": "voice.cancel-latency.fast-burn", "sloId": "voice.cancel-latency", "planeId": "voice", "metricId": "cancel-latency", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on voice, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "voice.cancel-latency.slow-burn", "sloId": "voice.cancel-latency", "planeId": "voice", "metricId": "cancel-latency", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on voice, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "voice.cancel-latency.post-cancel-unapproved-effect", "sloId": "voice.cancel-latency", "planeId": "voice", "metricId": "cancel-latency", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately when post-cancel-unapproved-effect count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on voice, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "voice.kill-latency.fast-burn", "sloId": "voice.kill-latency", "planeId": "voice", "metricId": "kill-latency", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on voice, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "voice.kill-latency.slow-burn", "sloId": "voice.kill-latency", "planeId": "voice", "metricId": "kill-latency", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on voice, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "voice.kill-latency.post-kill-unapproved-effect", "sloId": "voice.kill-latency", "planeId": "voice", "metricId": "kill-latency", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately when post-kill-unapproved-effect count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new mutation starts on voice, keep the kill control available, and report affected work as cancelling rather than complete." }, { "id": "voice.duplicate-action.violation", "sloId": "voice.duplicate-action", "planeId": "voice", "metricId": "duplicate-action", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Fence mutation starts on voice, retain read-only inspection and cancellation, and require reconciliation before replay." }, { "id": "voice.late-action.violation", "sloId": "voice.late-action", "planeId": "voice", "metricId": "late-action", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Fence mutation starts on voice, retain read-only inspection and cancellation, and require reconciliation before replay." }, { "id": "voice.recovery.fast-burn", "sloId": "voice.recovery", "planeId": "voice", "metricId": "recovery", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on voice, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "voice.recovery.slow-burn", "sloId": "voice.recovery", "planeId": "voice", "metricId": "recovery", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on voice, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "voice.recovery.recovery-falsely-reported-success", "sloId": "voice.recovery", "planeId": "voice", "metricId": "recovery", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately when recovery-falsely-reported-success count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on voice, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "voice.provider-errors.fast-burn", "sloId": "voice.provider-errors", "planeId": "voice", "metricId": "provider-errors", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/provider-failover.md", "safeDegradedMode": "Disable the failing route on voice; use only a pre-admitted failover route, otherwise return a truthful unavailable result." }, { "id": "voice.provider-errors.slow-burn", "sloId": "voice.provider-errors", "planeId": "voice", "metricId": "provider-errors", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/provider-failover.md", "safeDegradedMode": "Disable the failing route on voice; use only a pre-admitted failover route, otherwise return a truthful unavailable result." }, { "id": "voice.cost.fast-burn", "sloId": "voice.cost", "planeId": "voice", "metricId": "cost", "kind": "fast-burn", "severity": "sev2", "owner": "assistant_product", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on voice above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "voice.cost.slow-burn", "sloId": "voice.cost", "planeId": "voice", "metricId": "cost", "kind": "slow-burn", "severity": "sev3", "owner": "assistant_product", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on voice above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "voice.cost.unpriced-or-unreceipted-leg", "sloId": "voice.cost", "planeId": "voice", "metricId": "cost", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately when unpriced-or-unreceipted-leg count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/model-workflow-rollback.md", "safeDegradedMode": "Block new chargeable work on voice above its locked cap while retaining read-only status, cancellation, and priced lower-cost admitted routes." }, { "id": "voice.data-boundary-violations.violation", "sloId": "voice.data-boundary-violations", "planeId": "voice", "metricId": "data-boundary-violations", "kind": "hard-lock", "severity": "sev1", "owner": "assistant_product", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/privacy-incident.md", "safeDegradedMode": "Fence voice, preserve evidence, revoke affected authority, and expose no fallback path until Security and Compliance verify containment." }, { "id": "audit-and-evidence.availability.fast-burn", "sloId": "audit-and-evidence.availability", "planeId": "audit-and-evidence", "metricId": "availability", "kind": "fast-burn", "severity": "sev2", "owner": "compliance", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose audit-and-evidence as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "audit-and-evidence.availability.slow-burn", "sloId": "audit-and-evidence.availability", "planeId": "audit-and-evidence", "metricId": "availability", "kind": "slow-burn", "severity": "sev3", "owner": "compliance", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose audit-and-evidence as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "audit-and-evidence.availability.telemetry-blindness", "sloId": "audit-and-evidence.availability", "planeId": "audit-and-evidence", "metricId": "availability", "kind": "telemetry-blindness", "severity": "sev2", "owner": "compliance", "condition": "Fire after five minutes without expected production observations or when receipt reconciliation is incomplete; absence of data is UNKNOWN, never green.", "runbook": "docs/runbooks/shell-outage.md", "safeDegradedMode": "Expose audit-and-evidence as unavailable, reject new work safely, and retain cancellation, incident status, and evidence access where those controls remain healthy." }, { "id": "audit-and-evidence.total-latency.fast-burn", "sloId": "audit-and-evidence.total-latency", "planeId": "audit-and-evidence", "metricId": "total-latency", "kind": "fast-burn", "severity": "sev2", "owner": "compliance", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on audit-and-evidence; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "audit-and-evidence.total-latency.slow-burn", "sloId": "audit-and-evidence.total-latency", "planeId": "audit-and-evidence", "metricId": "total-latency", "kind": "slow-burn", "severity": "sev3", "owner": "compliance", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Prefer only pre-admitted lower-latency routes on audit-and-evidence; shed optional work and surface timeout or partial status without claiming completion." }, { "id": "audit-and-evidence.task-completion.fast-burn", "sloId": "audit-and-evidence.task-completion", "planeId": "audit-and-evidence", "metricId": "task-completion", "kind": "fast-burn", "severity": "sev2", "owner": "compliance", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Disable the affected mutation class on audit-and-evidence; retain status/readback and return truthful failed or unavailable outcomes." }, { "id": "audit-and-evidence.task-completion.slow-burn", "sloId": "audit-and-evidence.task-completion", "planeId": "audit-and-evidence", "metricId": "task-completion", "kind": "slow-burn", "severity": "sev3", "owner": "compliance", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Disable the affected mutation class on audit-and-evidence; retain status/readback and return truthful failed or unavailable outcomes." }, { "id": "audit-and-evidence.duplicate-action.violation", "sloId": "audit-and-evidence.duplicate-action", "planeId": "audit-and-evidence", "metricId": "duplicate-action", "kind": "hard-lock", "severity": "sev1", "owner": "compliance", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Fence mutation starts on audit-and-evidence, retain read-only inspection and cancellation, and require reconciliation before replay." }, { "id": "audit-and-evidence.late-action.violation", "sloId": "audit-and-evidence.late-action", "planeId": "audit-and-evidence", "metricId": "late-action", "kind": "hard-lock", "severity": "sev1", "owner": "compliance", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Fence mutation starts on audit-and-evidence, retain read-only inspection and cancellation, and require reconciliation before replay." }, { "id": "audit-and-evidence.queue-age.fast-burn", "sloId": "audit-and-evidence.queue-age", "planeId": "audit-and-evidence", "metricId": "queue-age", "kind": "fast-burn", "severity": "sev2", "owner": "compliance", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new queue admission on audit-and-evidence, preserve ordering and leases, expose age and ownership, and drain only under supervision." }, { "id": "audit-and-evidence.queue-age.slow-burn", "sloId": "audit-and-evidence.queue-age", "planeId": "audit-and-evidence", "metricId": "queue-age", "kind": "slow-burn", "severity": "sev3", "owner": "compliance", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Stop new queue admission on audit-and-evidence, preserve ordering and leases, expose age and ownership, and drain only under supervision." }, { "id": "audit-and-evidence.recovery.fast-burn", "sloId": "audit-and-evidence.recovery", "planeId": "audit-and-evidence", "metricId": "recovery", "kind": "fast-burn", "severity": "sev2", "owner": "compliance", "condition": "Fire when both the 5-minute and 1-hour burn rates are >= 14.4x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on audit-and-evidence, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "audit-and-evidence.recovery.slow-burn", "sloId": "audit-and-evidence.recovery", "planeId": "audit-and-evidence", "metricId": "recovery", "kind": "slow-burn", "severity": "sev3", "owner": "compliance", "condition": "Fire when both the 30-minute and 6-hour burn rates are >= 2x the rolling 30-day error budget.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on audit-and-evidence, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "audit-and-evidence.recovery.recovery-falsely-reported-success", "sloId": "audit-and-evidence.recovery", "planeId": "audit-and-evidence", "metricId": "recovery", "kind": "hard-lock", "severity": "sev1", "owner": "compliance", "condition": "Fire immediately when recovery-falsely-reported-success count is greater than zero; never average or exclude the event.", "runbook": "docs/runbooks/assistant-failure.md", "safeDegradedMode": "Freeze new mutations on audit-and-evidence, preserve the last verified checkpoint, and expose recovery as incomplete until readback passes." }, { "id": "audit-and-evidence.data-boundary-violations.violation", "sloId": "audit-and-evidence.data-boundary-violations", "planeId": "audit-and-evidence", "metricId": "data-boundary-violations", "kind": "hard-lock", "severity": "sev1", "owner": "compliance", "condition": "Fire immediately on the first event; no averaging, maintenance exclusion, or auto-clear is permitted.", "runbook": "docs/runbooks/privacy-incident.md", "safeDegradedMode": "Fence audit-and-evidence, preserve evidence, revoke affected authority, and expose no fallback path until Security and Compliance verify containment." } ], "limitations": [ "This contract defines objectives and response policy; it does not claim that Task 13.2 telemetry propagation, Task 13.4 load/soak measurement, Task 13.5 fault injection, Task 13.6 restore proof, or Task 13.7 alert deployment/game day has occurred.", "Current SLO attainment is UNKNOWN until production observations reconcile at the named boundaries; missing telemetry never counts as success.", "The contract does not admit a provider, tool, protocol, channel, DCC, desktop, or long-running capability that another gate keeps blocked." ], "recordDigestSha256": "9aad60abdeff20021e504d3038129621132cf0a7ab4973430c30440e9abd34dd" }