Skip to content

docs(ops): operational serving split (ADR 0011) + ops-surfaces spec (D1) - #143

Merged
brownjuly2003-code merged 1 commit into
mainfrom
docs/d1-ops-serving-split
Jul 3, 2026
Merged

docs(ops): operational serving split (ADR 0011) + ops-surfaces spec (D1)#143
brownjuly2003-code merged 1 commit into
mainfrom
docs/d1-ops-serving-split

Conversation

@brownjuly2003-code

Copy link
Copy Markdown
Owner

What

Design step D1 of the endgame plan: the architectural decision + implementation contract for the operational layer (domain.md §4 — Order 360 timeline, stuck-orders worklist, exception inbox), ahead of implementation slices D2–D4.

ADR 0011 — operational serving split

  • Every ops surface composes exactly the two existing ports: QueryEngine/ServingBackend for analytical reads (entity point-reads, pipeline_events journal, open-order scans), ControlPlaneStore for transactional triage state. No third data path (no query_engine._conn, no vault DSN) — pinned as a structural-ratchet invariant.
  • Options rejected with reasons: everything-on-ClickHouse (re-litigates ADR 0010 option 1, would fork dead-letter state), everything-on-PostgreSQL (against ADR 0006), direct vault reads for the customer block (governance boundary; users_enriched is the PII-free MDM projection), precomputed ops marts (freshness is the point).
  • Exception-triage overlay recorded as the 7th control-plane state class, extending ADR 0010's inventory (both adapters).

docs/ops-surfaces-spec.md — the D2–D4 contract

  • SLA stage model: budgets as catalog data (stages: block in contracts/entities/order.yaml), single ladder v1 (pending 30m / confirmed 24h / shipped 5d).
  • Stage clock = orders.status journal rows with an honest created_at fallback (clock: "fallback"); the journal's entity_id axis becomes real on live writes (today only the demo seed populates it — verified in local_pipeline.py / clickhouse_sink.py).
  • Endpoint contracts + response shapes: GET /v1/entity/order/{id}/timeline, GET /v1/ops/stuck-orders, GET /v1/ops/exceptions (+stats, +acknowledge/resolve).
  • Exception sources v1: dead-letter (native lifecycle, never duplicated), dead webhook deliveries, reconciliation checks R1 (journal↔store) / R2 (stuck replay); manual-resolutions counter = the kill-five-programs KPI.
  • Pinned demo story (ORD-20260404-1004 = sole SLA breach; ORD-1001 = full timeline) + flagged pin ripples (error_rate denominator moves with seeded stage rows — re-pin by arithmetic).
  • 12 machine-checkable invariants (I1–I12) as the test ТЗ, generator-spec §12 style.

Also

  • architecture.md + domain.md gain pointers; CHANGELOG [Unreleased] entry.
  • Docs-only — no runtime behavior changes.

🤖 Generated with Claude Code

…ces spec (D1)

The operational layer (domain.md §4: Order 360 timeline, stuck-orders
worklist, exception inbox) needed a committed home for three very
different read shapes before D2-D4 implement it.

ADR 0011 records the split: every ops surface composes exactly the two
existing ports - QueryEngine/ServingBackend for analytical reads (entity
point-reads, the pipeline_events journal, open-order scans) and
ControlPlaneStore for transactional triage state - with no third data
path. Rejected with reasons: everything-on-ClickHouse,
everything-on-PostgreSQL, direct vault reads for the customer block,
precomputed ops marts. The exception-triage overlay becomes the seventh
control-plane state class (extends ADR 0010's inventory).

docs/ops-surfaces-spec.md is the D2-D4 implementation contract: SLA
stage model with budgets as catalog data (stages: block in the order
entity contract), orders.status stage-entry journal rows as the stage
clock with an honest created_at fallback, the journal entity_id axis
made real on live writes (today only the demo seed populates it),
endpoint contracts for /v1/entity/order/{id}/timeline,
/v1/ops/stuck-orders and /v1/ops/exceptions (+stats), reconciliation
checks R1/R2, the manual-resolutions counter, a pinned demo story
(ORD-20260404-1004 as the sole SLA breach) and twelve machine-checkable
invariants as the test contract.

architecture.md and domain.md gain pointers; CHANGELOG entry added.
Docs-only - no runtime behavior changes.
@github-actions

github-actions Bot commented Jul 3, 2026

Copy link
Copy Markdown

DORA Metrics

  • Window: last 30 days
  • Branch: main
  • Deployment frequency: 119 total / 27.77 per week
  • Lead time for changes: avg 0.43h / median 0.0h
  • Change failure rate: 78.99% (94/119)
  • MTTR: 0.29h across 2 incident(s)

@brownjuly2003-code
brownjuly2003-code merged commit 08e8211 into main Jul 3, 2026
19 checks passed
@brownjuly2003-code
brownjuly2003-code deleted the docs/d1-ops-serving-split branch July 3, 2026 20:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants