NFR baseline¶
Decision
This page records a decision and its status. A Proposed decision is not binding; an Accepted decision is binding on the Factory until amended or superseded.
Decided on 2026-10-09 (ADR-0018; D30). The Factory starts in the pilot class: tens of concurrent runs per tenant, a single region, interactive commands acknowledged within two seconds at p95, 99.5 % monthly availability for the control plane, RPO 15 minutes and RTO 4 hours. Numbers are a baseline that can be raised; they are not aspirations copied from the 2025 roadmap, whose figures were withdrawn.
NFR classes¶
Every service declares one class in its model entry (nfr.class) and may override single values; the generated NFR classes catalog lists the classes and the services assigned to each.
| Class | Applies to | Latency p95 | Availability | Throughput | RPO / RTO |
|---|---|---|---|---|---|
pilot-interactive |
Commands and reads a person waits for: submit, cancel, decide, read run, list approvals | 2 000 ms (Run Control overrides to 500 ms) | 99.5 % monthly | 50 rps per host | 15 min / 4 h |
pilot-batch |
Runs, attempts, reconcilers, ingestion | not latency-bound; minutes to hours per run | 99.5 % | 10 runs/s dispatch | 15 min / 4 h |
pilot-projection |
Read models, dashboards, SLO views | 500 ms; staleness under 1 min p95 | 99.5 % | 100 rps | 15 min / 4 h |
external-canonical |
Identity Platform, Config Platform, SaaS templates, external systems of record | inherited from that system | inherited | inherited | inherited |
Restore order¶
When a store is restored, the order is fixed (D30) so that authority is rebuilt before projections: run journal → approvals → releases → outbox and inbox → artifacts → indexes. Runs with an open lease at restore time are reconciled as Uncertain and surfaced to operators rather than retried; indexes are rebuilt from approved sources, never restored as authority.
Failure domains¶
Process · host · database · messaging transport · model provider · region · identity provider. Each service's failure-modes section names the detection signal, the recovery action, the data impact and an RTO per domain it is exposed to; the resilience page of the Trust & Operations plane aggregates them.
The eighteen NFR groups¶
The packet's NFR-01…18 groups remain the traceability families (see the generated NFR traceability). Their targets:
| Group | Baseline statement |
|---|---|
| NFR-01 Identity and tenant isolation | Canonical ADR-0100/0101 applied; every table tenant-scoped; no cross-tenant read or write; row filters in SharedDb mode |
| NFR-02 Tool and supply-chain security | One governed executor; signed releases with dependency closure; MCP servers authenticated |
| NFR-03 Privacy and data lifecycle | Classification, tenant-selectable region, retention and deletion per data governance |
| NFR-04 Governance and decisions | Approvals bound to exact versions; policy decisions and audit evidence recorded |
| NFR-05 Durable state and effect reliability | Transition and outbox in one transaction; outcomes receipted exactly once |
| NFR-06 Recovery and continuity | RPO 15 min, RTO 4 h, restore order above |
| NFR-07 Latency | Interactive 2 s p95 (Run Control 500 ms) |
| NFR-08 Capacity and tenant fairness | Tens of concurrent runs per tenant; per-tenant quotas enforced by Usage Accounting and Execution Capacity |
| NFR-09 Resource efficiency and backpressure | Leases, queues and budgets bound load; noisy tenants throttled before others degrade |
| NFR-10 Observability and audit | OpenTelemetry GenAI conventions; traces 30 days; audit 7 years redacted; no raw prompt logging |
| NFR-11 AI and task quality | Evaluation gates per release (quality gates) |
| NFR-12 Cost and usage accountability | Reservation → settlement → reconciliation; unknown usage stays unknown |
| NFR-13 Compatibility and adapter portability | Ports and profiles (ADR-0012, ADR-0013); adapters replaceable by migration |
| NFR-14 Maintainability | House template structure; generated and preserved projects split |
| NFR-15 Usability, accessibility, localization | WCAG 2.2 AA; EN, HE (RTL), RU; keyboard; light and dark; reduced motion |
| NFR-16 Data quality and provenance | Source revision, chunk identity, embedding profile and index version on every citation |
| NFR-17 Release and operability | Runbooks, health, rollout and rollback per host; generated products operated to product SLOs (D33) |
| NFR-18 Dependency and failure-domain availability | Failure domains named per service; provider outage degrades, never corrupts |