{ "format": "vercy-world-model-candidate/v1", "contourId": "EM-TEC-06", "modelId": "WM-SFT-016", "registryId": "vr.wm-sft-016", "name": "Service Level Objective / Reliability Commitment", "version": "0.1.0-candidate.2", "entryKind": "reliability-aggregate", "status": "research-candidate", "canonicalPublishable": false, "purpose": "Represent immutable SLI and SLO policy versions, append-only evaluations, derived error-budget state and effective-dated observability coverage bindings without owning metric definitions, observations, service identity or contractual SLA obligations.", "boundary": { "owns": [ "commitment-scoped SLI references whose reusable formula, population and unit remain externally mastered", "immutable SLO policy versions, one identified Service subject and policy-owned absence-to-failure mapping", "window definitions, eligibility rules, exclusions, coverage thresholds, target units and calendar pins", "append-only SLO evaluations, supersession, retraction lineage and stamped provenance", "error-budget policy and derived recomputable consumption state", "effective-dated coverage-only observability bindings with deterministic stream combination" ], "delegates": [ "formula, population, unit, dimensions and null semantics to the identifier-unassigned Metric Definition candidate", "raw observations, absence and censoring evidence to WM-MAT-008", "Service identity and lifecycle to WM-ACT-004", "contractual obligations, breach mappings, credits and remedies to WM-ECO-006", "calendar identity, timezone and period conventions to WM-XCT-009", "exclusion-event mastership to an identifier-unassigned external authority", "User Journey identity, membership and aggregation to an identifier-unassigned candidate" ], "excludes": [ "telemetry storage or observation rewriting", "authoritative persisted budget balances", "contractual SLA authority in either direction", "automatic rollup from component or journey diagnostics", "silent exclusion, denominator, absence-mapping or window changes", "successful verdicts inferred from missing data", "current evaluable User Journey semantics" ] }, "objects": { "SLISpecification": { "identity": [ "sliId", "version" ], "required": [ "metricDefinitionRef", "unitOfUserWork", "goodEventPredicate", "validEventPredicate", "observationPoint", "effectiveFrom", "contentDigest", "status" ], "optional": [ "observabilityBindingRef", "supersedesVersion" ], "lifecycle": [ "draft", "issued", "superseded", "withdrawn" ] }, "SLOPolicy": { "identity": [ "sloId", "version" ], "required": [ "subjectRef", "sliVersionRef", "purpose", "target", "windowDefinition", "eligibilityRule", "exclusionPolicy", "minimumCoverage", "errorBudgetPolicyRef", "effectiveFrom", "status", "targetUnit", "absenceFailureMapping", "calendarBasisRef", "transitionRule" ], "optional": [ "effectiveTo", "supersedesVersion", "retractedAt", "retractionReason" ], "lifecycle": [ "draft", "issued", "effective", "superseded", "withdrawn" ] }, "SLOEvaluation": { "identity": [ "evaluationId" ], "required": [ "sloPolicyVersionRef", "subjectRef", "windowInstance", "evaluatedAt", "evaluatorRef", "evaluatorVersion", "bindingVersionRef", "absenceMappingVersionRef", "validCount", "goodCount", "ineligibleCount", "indeterminateCount", "coverageRatio", "unknownCount", "attainedValue", "verdict", "evidenceRefs" ], "optional": [ "supersedesEvaluationId", "gapEvidenceRefs", "comparisonRef", "retractionRef", "diagnosticRefs" ], "lifecycle": [ "recorded", "superseded", "invalidated-by-retraction" ] }, "ErrorBudgetPolicy": { "identity": [ "errorBudgetPolicyId", "version" ], "required": [ "derivationRule", "consumptionRule", "reactionRules", "transitionRule", "effectiveFrom", "status", "materializationRule" ], "optional": [ "effectiveTo", "supersedesVersion" ] }, "ObservabilityBinding": { "identity": [ "bindingId", "bindingVersion" ], "required": [ "subjectRef", "sliVersionRef", "streamRefs", "streamCombinationRule", "absenceVocabularyRef", "validFrom", "authorityRef", "status" ], "optional": [ "validTo", "environmentScope", "methodRef", "withdrawalReason", "supersedesBindingVersion" ], "lifecycle": [ "proposed", "effective", "superseded", "withdrawn" ] } }, "verdictVocabulary": [ "met", "not-met", "unknown-insufficient-coverage", "no-eligible-traffic", "indeterminate" ], "relations": [ { "target": "WM-MAT-008", "relation": "REFERENCE", "required": true, "purpose": "Resolve immutable observations, absence reasons, time and provenance." }, { "target": "WM-ACT-004", "relation": "REFERENCE", "required": false, "purpose": "Attach the reliability commitment to a service without importing service identity." }, { "target": "WM-ECO-006", "relation": "REFERENCE", "required": false, "purpose": "Allow a contractual agreement to cite policy and evidence while obligations and remedies remain contract-owned." }, { "target": "WM-XCT-009", "relation": "REFERENCE", "required": false, "purpose": "Pin calendar identity, timezone and period conventions for aligned windows." } ], "operations": [ { "id": "issue-sli", "effect": "Issue an immutable SLI specification bound to one metric definition.", "authority": "reliability owner" }, { "id": "issue-slo-policy", "effect": "Issue an immutable policy version with target window coverage and budget rules.", "authority": "service or reliability owner" }, { "id": "bind-observability", "effect": "Create an effective-dated source and collection binding.", "authority": "reliability owner" }, { "id": "evaluate-window", "effect": "Append a window evaluation with counts coverage evidence and verdict.", "authority": "authorized evaluator" }, { "id": "restate-evaluation", "effect": "Append a corrected evaluation while preserving the predecessor.", "authority": "authorized evaluator" }, { "id": "transition-window", "effect": "Issue a successor policy and explicit budget transition for a changed window definition.", "authority": "reliability owner" }, { "id": "retract-policy", "effect": "Record an immutable retraction, close the policy to new evaluations and retain affected evaluation history.", "authority": "reliability owner" }, { "id": "retract-policy", "effect": "Record an immutable retraction, close the policy to new evaluations and retain affected evaluation history.", "authority": "reliability owner" }, { "id": "retract-policy", "effect": "Record an immutable retraction, close the policy to new evaluations and retain affected evaluation history.", "authority": "reliability owner" } ], "invariants": [ "Service is the only currently evaluable subject; extending subject kinds requires allocated identity, membership and aggregation semantics.", "SLI, SLO policy, evaluation, budget policy and observability binding are internal WM-SFT-016 artifacts and receive no independent registry identifiers.", "An enforceable frozen SLI meaning cannot be published until Metric Definition is allocated and version-pinnable.", "Every policy names one immutable SLI reference, target, target unit, window, calendar basis and policy-owned absence-to-failure mapping.", "Metric formula, population, unit, dimensions and null semantics are referenced rather than restated.", "Raw observations remain externally mastered and are never copied into policy.", "No data, no eligible traffic, excluded traffic, indeterminate and met are distinct states.", "Coverage-complete empty eligible population yields no-eligible-traffic and is budget-neutral, distinct from unknown.", "Missing coverage yields unknown-insufficient-coverage; unknown is budget-neutral unless the immutable policy maps a named absence class to failure.", "Every verdict reports coverage ratio and unknown count.", "Exclusion is present-but-ineligible and is distinct from absence.", "Retroactive exclusion creates a new superseding evaluation; the predecessor remains retained and resolvable.", "Policy, evaluation, observability binding and derived budget state use separate consistency boundaries.", "Budget consumption is derived from evaluations; any stored balance is non-authoritative cache state.", "Exactly one binding is effective per Service, SLI and instant; overlapping bindings are invalid.", "Every evaluation stamps policy, binding and absence-mapping versions and offset-qualified window bounds.", "Window or target change creates a successor policy with contiguous non-overlapping effectivity and immutable reset, carry or prorate transition semantics.", "Policy retraction retains and marks invalidated evaluations and never erases history.", "Diagnostic signals are prohibited as verdict, budget or obligation inputs.", "SLO and SLA authority is firewalled in both directions and requires an explicit contract-owned mapping.", "User Journey is specified only as a deferred non-normative candidate and cannot be evaluated under this candidate.", "Access to an evaluation cannot exceed access to its observation evidence." ], "holds": [ "Publication is held after one frozen semantic audit; remediation was applied without rerunning the audit.", "Metric Definition remains identifier-unassigned and therefore cannot yet provide an enforceable pinned SLI meaning.", "User Journey remains identifier-unassigned, non-normative and non-evaluable.", "Exclusion-event mastership and its authoritative event contract remain unallocated.", "Cross-stream binding precedence and aggregation operators require approved contracts.", "WM-XCT-009 is selected as calendar authority but retains its own canonical publication constraints.", "Retraction authority and empty-population conformance remain specified but require executable acceptance.", "WM-MAT-008, WM-ACT-004 and WM-ECO-006 retain their own publication holds.", "Package conversion and live HTTP, runtime, search and package verification remain pending." ], "consistencyBoundaries": { "policy": "Slow-changing immutable SLI, SLO and error-budget policy versions; one writer authority per policy lineage.", "evaluation": "Append-only derived evaluation records; corrections create a superseding record and retain predecessors.", "observabilityBinding": "Effective-dated coverage-only mappings; binding changes do not mutate policy when SLI meaning is unchanged.", "budgetState": "Derived non-authoritative state recomputed from evaluations; any materialized balance is a disposable cache and evaluations govern." }, "bindingRules": [ "Exactly one effective binding version exists for each Service, SLI version and instant; overlaps are invalid.", "Every multi-stream binding states deterministic union, join, precedence, de-duplication and absence behavior.", "A binding interval covers the complete evaluation slice or the verdict is unknown-insufficient-coverage.", "Every evaluation stamps the policy version, binding version and absence-mapping version used.", "Binding absence classes reuse WM-MAT-008 vocabulary; policy owns their failure mapping.", "A change to producible absence classes under an active policy requires a successor policy." ], "successionRules": [ "Policy effective intervals are non-overlapping and successor windows are contiguous under WM-XCT-009 calendar authority.", "A partial successor window has an explicit disposition and may never be silently completed with predecessor data.", "The immutable transition choice is reset, carry or prorate; its inputs and resulting state are recorded.", "Retroactive policy effectivity is prohibited.", "Service retirement closes the policy to new evaluations; rename, merge, split or re-identification requires a successor while historical evaluations retain the stamped subject identifier." ], "retractionRules": [ "Retraction is orthogonal to succession and retains the policy version.", "Retraction closes the policy to new evaluations from the recorded retraction instant.", "Evaluations invalidated by retraction remain resolvable with an explicit invalidation reference." ], "diagnosticRule": "Diagnostic signals may support triage but may not determine a verdict, consume budget or establish an obligation.", "slaFirewall": [ "WM-SFT-016 may not create contractual breach, credit or remedy semantics.", "WM-ECO-006 may not define SLI or SLO semantics and may not treat an SLO verdict as breach without an explicit contract-owned mapping." ] }