Product Fleet Operations — aggregate roots

Generated from the architecture model

This page is rendered from model/**/*.yaml by tools/docs_model during mkdocs build. Edit the YAML, not this page; hand-written design lives on the linked service, platform and plane pages.

Aggregate	Service	Root entity	Events	Tables
ProductIncident	FleetIncidentService	ProductIncident	IncidentOpened, IncidentStateChanged, IncidentResolved	ProductIncidents, IncidentTimeline
OnCallRecord	FleetIncidentService	OnCallRecord	OnCallChanged	OnCallRecords
Offboarding	FleetIncidentService	Offboarding	OffboardingRequested, OffboardingCompleted	Offboardings
OperatedProduct	FleetInventoryService	OperatedProduct	ProductOnboarded, ProductInstanceStateChanged	OperatedProducts, ProductInstances
ProductObjective	FleetInventoryService	ProductObjective	ProductObjectiveDefined	ProductObjectives
Rollout	FleetRolloutService	Rollout	RolloutPlanned, RolloutWaveCompleted, RolloutHalted, RolloutCompleted	Rollouts, RolloutWaves

ProductIncident (FleetIncidentService)

An incident on one product (and the affected instances): severity, state, timeline entries, linked alerts, rollouts and Factory runs, the responder, customer notifications sent, and the post-incident review.

Field	Type	Required	Description
incidentId	guid	yes
tenantId	string	yes
productId	string	yes
instanceIds	list:guid	yes
severity	enum:IncidentSeverity	yes
state	enum:IncidentState	yes
title	string	yes
linkedAlertIds	list:guid	yes
linkedRolloutId	guid	no
linkedRunIds	list:guid	yes
responder	string	no
timeline	json	yes
customerNotifications	json	yes
reviewRef	string	no	Post-incident review artifact.
openedAt	datetime	yes
resolvedAt	datetime	no

Invariants

• Sev1 and Sev2 incidents page the on-call of the product's edition and notify affected customers within the edition's target.
• A mitigation that changes a product goes through a rollout or a promotion; an incident never applies changes itself.
• Resolution requires a review for Sev1 and Sev2 before the incident is Reviewed.

States (IncidentState)

stateDiagram-v2
    Open --> Acknowledged : ResponderAcknowledges
    Acknowledged --> Mitigated : MitigationApplied
    Mitigated --> Resolved : ObjectivesRecovered
    Resolved --> Reviewed : ReviewRecorded

Hold "Alt" / "Option" to enable pan & zoom

OnCallRecord (FleetIncidentService)

Who is on call for which products and edition in which window, with the paging connector used.

Field	Type	Required	Description
recordId	guid	yes
tenantId	string	yes
productIds	list:string	yes
edition	string	yes
responder	string	yes
from	datetime	yes
to	datetime	yes
pagingConnectionId	guid	yes

Invariants

• Every ManagedPlus product has an on-call responder at all times; a gap is an alert.

Offboarding (FleetIncidentService)

Off-boarding of a customer tenant from a product or of a whole product: approval, export order (data handover in open formats), handover acknowledgement by the customer, deletion order within the retention window, and completion evidence — orchestrated over the Data & Event platform's governance orders.

Field	Type	Required	Description
offboardingId	guid	yes
tenantId	string	yes
productId	string	yes
customerTenantId	string	no	Empty for a whole-product off-boarding.
approvalId	guid	no
exportOrderId	guid	no
handoverAcknowledgedBy	string	no
deletionOrderId	guid	no
state	enum:OffboardingState	yes
requestedAt	datetime	yes
completedAt	datetime	no

Invariants

• Deletion starts only after the export was handed over and acknowledged, or the customer waived the export in writing (recorded as evidence).
• Off-boarding a whole product needs an approval of class production; a customer tenant off-boarding needs the customer's request and the owner's approval.

States (OffboardingState)

stateDiagram-v2
    Requested --> Approved : ApprovalGranted
    Approved --> Exporting : ExportOrdered
    Exporting --> HandedOver : HandoverAcknowledged
    HandedOver --> Deleting : DeletionOrdered
    Deleting --> Completed : DeletionCompleted
    Requested --> Cancelled : Cancel

Hold "Alt" / "Option" to enable pan & zoom

OperatedProduct (FleetInventoryService)

A generated product under fleet operation: its project, the generating template and blueprint releases, its product gateway (GW-07), its current product release, support edition and the customer tenants it serves.

Field	Type	Required	Description
productId	string	yes
tenantId	string	yes	The Factory tenant that owns the product.
projectId	string	yes
name	string	yes
generatedBy	json	yes	Template, blueprint and agent release ids.
currentReleaseId	guid	no
edition	enum:ManagedEdition	yes
gatewayRef	string	yes	GW-07 endpoint reference.
instanceCount	int	yes
onboardedAt	datetime	yes

Invariants

• A product is operated only while its owner's subscription covers a managed edition; SelfOperated products are inventoried, not operated.
• Instances inherit the product's release unless a rollout wave says otherwise; version skew across instances is visible and bounded by the rollout policy.

Entities: ProductInstance · Value objects: —

ProductObjective (FleetInventoryService)

An objective for a product (availability, latency, error rate, support response) per edition, defined here and measured by the Observability platform's SLO service with the product's instances as subjects.

Field	Type	Required	Description
objectiveId	guid	yes
tenantId	string	yes
productId	string	yes
kind	string	yes
target	decimal	yes
window	string	yes
sloId	guid	no	Objective registered with SloService.
editionFloor	enum:ManagedEdition	yes

Invariants

• Edition floors cannot be loosened per product; a customer may buy a stricter edition, not a weaker objective.

Rollout (FleetRolloutService)

A plan to move a product's instances to a target (release, template or library version, re-scaffolded release) in ordered waves with sizes, bake times, objective guards and a halt policy; production waves need a production-class approval; a failed wave halts the rollout and rolls back the wave.

Field	Type	Required	Description
rolloutId	guid	yes
tenantId	string	yes
productId	string	yes
kind	enum:RolloutKind	yes
targetReleaseId	guid	no
targetAssetReleaseId	string	no	Template or library release for upgrades and re-scaffolds.
sourceRunId	guid	no	The Factory run that produced the re-scaffolded release.
waves	json	yes	Ordered waves: instance selection, size, bake minutes
guards	json	yes	Objectives that halt the rollout on breach.
approvalId	guid	no
state	enum:RolloutState	yes
currentWave	int	yes
requestedBy	string	yes
startedAt	datetime	no
completedAt	datetime	no

Invariants

• A wave is a set of promotions through EnvironmentPromotionService with the same gates; the rollout never bypasses them.
• The first wave never includes production instances of customers on ManagedPlus unless they opted in; bake time runs against the product's objectives and halts on breach.
• A re-scaffold rollout starts from a Factory run that regenerated the product with the new template and passed evaluation (ADR-0021); the rollout moves the resulting release.

States (RolloutState)

stateDiagram-v2
    Planned --> AwaitingApproval : ProductionWaves
    Planned --> Rolling : StartNoApproval
    AwaitingApproval --> Rolling : ApprovalGranted
    AwaitingApproval --> Cancelled : ApprovalRejectedOrExpired
    Rolling --> Baking : WavePromoted
    Baking --> Rolling : BakePassedNextWave
    Baking --> Completed : BakePassedLastWave
    Baking --> Halted : GuardBreached
    Rolling --> Halted : PromotionFailed
    Halted --> RolledBack : WaveRolledBack
    Halted --> Rolling : OperatorResumes
    Planned --> Cancelled : Cancel

Hold "Alt" / "Option" to enable pan & zoom

Entities: RolloutWave · Value objects: —