Skip to content

ADR-0018: Pilot-class NFR baseline

Decision

This page records a decision and its status. A Proposed decision is not binding; an Accepted decision is binding on the Factory until amended or superseded.

  • Status: Accepted 2026-10-09 by the product owner (decision D30; closes Q-08)
  • Date: 2026-10-09
  • Deciders: Dmitry Khaymov (product owner)
  • Tags: nfr, reliability, performance

Context

The 2025 roadmap carried numbers ("1000+ concurrent projects", "> 95 % autonomous") with no evidence, and the 2026-10 review removed un-approved RTO/RPO figures from the resilience page. Design pages need a baseline to size queues, leases, stores and projections.

Decision

  • Workload: tens of concurrent runs per tenant; single region.
  • Latency: interactive commands acknowledged within 2 s at p95 (Run Control 500 ms); projections fresh within 1 min at p95.
  • Availability: 99.5 % monthly for the control plane; error budget 0.5 %.
  • Recovery: RPO 15 min, RTO 4 h; restore order run journal → approvals → releases → outbox/inbox → artifacts → indexes; open leases reconciled as Uncertain.
  • Classes: pilot-interactive, pilot-batch, pilot-projection, external-canonical in model/nfr-targets.yaml; every service declares one and may override single values.
  • The numbers are a baseline to be raised with evidence, not a ceiling.
  • No SLO is currently measured. Nothing of the Factory is deployed; these are pilot-class targets chosen by the product owner (D30), not observed values. The first measurement replaces them with evidence.

Consequences

  • Positive: queues, leases, reservations and stores can be sized; failure-mode sections have an RTO to state; SLO views have targets.
  • Negative: the baseline is deliberately modest; customers needing production class (multi-zone, 99.9 %) require a later decision and infrastructure design.

Alternatives considered

Alternative Why not chosen
Production class from the start Infrastructure design before any workflow runs; contradicts the first-slice direction
Qualitative tiers only Pages could not state concrete recovery or sizing rules