{
  "version": "certrail.kafka-production-design.v1",
  "title": "CertaRail production Kafka design",
  "status": "REQUIRES_ACTIVATION",
  "productionReady": false,
  "authority": "TARGET_PRODUCTION_DESIGN",
  "currentBoundary": "Local Compose runs one plaintext broker with RF=1 and min ISR=1. The Go producer implements opt-in SASL_SSL with SCRAM-SHA-512, CA trust and hostname verification for Hosted Sandbox; credential and CA changes require a rolling restart. OAUTHBEARER, client-certificate mTLS, Schema Registry integration and consumer-lag export remain unimplemented. This design does not confirm a Production deployment.",
  "sourceContract": "Canonical event names, addresses, payloads, headers and publication state remain owned by api/asyncapi/certarail.kafka.v1.yaml and api/events/*.schema.json.",
  "references": [
    {
      "label": "Apache Kafka 4.3 security overview",
      "href": "https://kafka.apache.org/43/security/security-overview/"
    },
    {
      "label": "Apache Kafka 4.3 SASL authentication",
      "href": "https://kafka.apache.org/43/security/authentication-using-sasl/"
    },
    {
      "label": "Apache Kafka 4.3 authorization and ACLs",
      "href": "https://kafka.apache.org/43/security/authorization-and-acls/"
    },
    {
      "label": "Apache Kafka 4.3 monitoring",
      "href": "https://kafka.apache.org/43/operations/monitoring/"
    },
    {
      "label": "Apache Kafka 4.3 geo-replication",
      "href": "https://kafka.apache.org/43/operations/geo-replication-cross-cluster-data-mirroring/"
    }
  ],
  "sections": [
    {
      "id": "production-tls",
      "title": "TLS transport",
      "lead": "Production listeners шифруют и взаимно проверяют каждый client, inter-broker и controller channel; plaintext listener не должен существовать ни в workload network, ни как аварийный обход.",
      "bullets": [
        "Разрешены TLS 1.3 и, только для утверждённой совместимости, TLS 1.2; более ранние версии и weak cipher suites запрещены. TLS 1.3 является preferred profile.",
        "Hostname verification и SAN обязательны. IP, DNS name и service discovery identity должны совпадать с сертификатом; insecure skip verify и trust-all callback запрещены.",
        "Client-to-broker, inter-broker, controller quorum, admin tooling, Schema Registry и replication links получают отдельные reviewed trust boundaries. Шифрование только внешнего listener недостаточно.",
        "Private keys поступают из bank-managed KMS/HSM или workload secret delivery, никогда не входят в image, environment dump, URL, log или replay manifest.",
        "Certificate rotation поддерживает перекрытие current/next CA и client certificates, имеет expiry alerts и проверяется без downtime до каждой Production activation.",
        "Egress policy разрешает workload только broker bootstrap/DNS, identity provider и approved telemetry endpoints; произвольный broker address запрещён."
      ],
      "table": {
        "caption": "Listener security boundary",
        "columns": [
          "Channel",
          "Target protocol",
          "Mandatory verification"
        ],
        "rows": [
          [
            "Application workload",
            "SASL_SSL или SSL/mTLS",
            "CA, SAN, principal, revocation/expiry"
          ],
          [
            "Broker replication",
            "TLS-authenticated private listener",
            "Dedicated broker principal and SAN"
          ],
          [
            "KRaft controller",
            "TLS-authenticated controller listener",
            "Dedicated controller principal and network segment"
          ],
          [
            "Admin plane",
            "mTLS-only isolated listener",
            "Named operator/service principal and approval"
          ]
        ]
      },
      "callout": {
        "tone": "critical",
        "title": "ТРЕБУЕТ АКТИВАЦИИ: Production Kafka identity",
        "description": "Local Compose intentionally advertises PLAINTEXT. Client TLS and SASL_SSL/SCRAM-SHA-512 are implemented with CA/hostname verification and negative tests for Hosted Sandbox. Production OAUTHBEARER, client-certificate mTLS and automated credential lifecycle remain unimplemented; Production outbox remains fail-closed."
      }
    },
    {
      "id": "production-authentication",
      "title": "SASL, OAuth и mTLS",
      "lead": "Каждый process получает собственную workload identity; один credential нельзя разделять между producer, consumer, operator или tenant, а network reachability никогда не заменяет authentication.",
      "bullets": [
        "Target Production hosted profile: SASL_SSL + OAUTHBEARER с machine-to-machine token от approved identity provider. Token short-lived, не дольше 10 минут, audience привязан к Kafka cluster, scope — к одной workload role.",
        "Kafka unsecured OAUTHBEARER запрещён: production validation проверяет issuer, audience, signature, expiry, not-before и principal mapping; token не попадает в logs, metrics, traces или command history.",
        "On-prem alternative: SSL/mTLS на отдельном listener с однозначным certificate-to-principal mapping. Он не включается как silent fallback при отказе OAuth.",
        "Admin и break-glass используют отдельный mTLS principal, hardware-backed key, time-bounded elevation и maker-checker approval. Application identity не получает admin ACL.",
        "SASL/PLAIN и static shared password запрещены. SCRAM допускается только как отдельно согласованный exception over TLS с vault rotation и не меняет least-privilege ACL.",
        "Token/certificate refresh проходит до expiry; auth failure не переключает client на plaintext, другой listener, другой principal или бесконечный retry."
      ],
      "table": {
        "caption": "Approved authentication profiles",
        "columns": [
          "Use case",
          "Authentication",
          "Fail-closed rule"
        ],
        "rows": [
          [
            "Hosted application",
            "SASL_SSL / OAUTHBEARER",
            "Validated short-lived JWT; no unsecured token mode"
          ],
          [
            "On-prem application",
            "SSL / mTLS",
            "Dedicated listener and deterministic DN/SAN mapping"
          ],
          [
            "Broker/controller",
            "Dedicated TLS or mTLS identity",
            "No application principal reuse"
          ],
          [
            "Administration",
            "Isolated mTLS + temporary elevation",
            "No standing super-user credential"
          ]
        ]
      },
      "callout": {
        "tone": "warning",
        "title": "Один environment — один выбранный profile",
        "description": "OAuth и mTLS являются reviewed deployment profiles, а не цепочкой fallback. Production manifest фиксирует listener, principal mapping, issuer/CA fingerprints и rotation evidence без самих credentials."
      }
    },
    {
      "id": "production-tenant-topic-acl",
      "title": "Tenant и topic ACL",
      "lead": "Kafka ACL применяется к principal, topic, consumer group и admin resource; он не умеет безопасно ограничить tenant по payload field внутри общего shared topic.",
      "bullets": [
        "KRaft StandardAuthorizer работает deny-by-default с allow.everyone.if.no.acl.found=false. Wildcard grants для application principals запрещены; super.users ограничен broker/controller break-glass contour.",
        "Outbox principal получает Write и Describe только на approved internal topics плюс минимальный IdempotentWrite, если он требуется producer client. Create, Delete, Alter и AlterConfigs ему запрещены.",
        "Consumer principal получает Read/Describe только на назначенные topics и Read/Describe только на собственный consumer group prefix. Один consumer не может присоединиться к group другой команды.",
        "Canonical shared topics доступны только внутренним multi-tenant services, которые применяют server-side tenant boundary. Внешнему tenant consumer нельзя дать ACL на shared topic с чужими records.",
        "Если bank или tenant получает direct Kafka delivery, создаётся отдельный cluster/namespace либо opaque tenant topic prefix и отдельный group prefix. Opaque tenant alias не содержит названия клиента или PII.",
        "Topic creation, partition count, replication, retention, cleanup policy, quotas и ACL управляются IaC через отдельный release principal. Runtime auto-create выключен.",
        "Per-principal byte/request quotas берутся из approved load test; unlimited quota или silent throttling без alert и ownership не допускаются."
      ],
      "table": {
        "caption": "Minimum ACL matrix",
        "columns": [
          "Principal",
          "Topic rights",
          "Group/admin rights"
        ],
        "rows": [
          [
            "Outbox producer",
            "Write + Describe on explicit internal topics",
            "No group; minimal cluster IdempotentWrite only"
          ],
          [
            "Internal consumer",
            "Read + Describe on assigned topics",
            "Read + Describe on own group prefix"
          ],
          [
            "Tenant delivery consumer",
            "Read + Describe on isolated tenant namespace",
            "Own tenant group prefix only"
          ],
          [
            "Release controller",
            "Reviewed Create/Alter/DescribeConfigs",
            "No application data consumption"
          ],
          [
            "Break-glass admin",
            "Time-bound audited elevation",
            "Maker-checker and session recording"
          ]
        ]
      },
      "callout": {
        "tone": "critical",
        "title": "Record-level tenant ACL не заявлен",
        "description": "tenant_id в payload и hashed partition key помогают domain processing, но не являются Kafka authorization boundary. Direct tenant access требует physically or logically isolated topic namespace, declared production address and negative cross-tenant ACL tests."
      }
    },
    {
      "id": "production-schema-registry",
      "title": "Schema Registry",
      "lead": "Production registry становится контролируемым каталогом immutable JSON Schema identities; canonical repository остаётся источником review, а registry — promotion и runtime resolution layer.",
      "bullets": [
        "Формат payload остаётся JSON Schema 2020-12. Каждый promoted schema artifact связывается с canonical $id, event_type, major version, Git commit и SHA-256 exact bytes.",
        "Subject scope — topic + event_type, чтобы несколько event families или versions на одном topic не делили несовместимую compatibility chain. Key и value subjects разделены.",
        "Runtime auto-registration=off. CI validates schema/examples/compatibility, затем release principal регистрирует exact digest; application principal может только read approved schema ID.",
        "Producer wire contract содержит immutable schema ID или утверждённый registry framing. До изменения wire format соответствующий binding/header добавляется в canonical AsyncAPI и проходит consumer overlap.",
        "Registry endpoint использует TLS, workload authentication, least-privilege ACL и отдельный audit stream. Unknown schema ID или digest mismatch fail closed и отправляет record в quarantine.",
        "Metadata database, subjects, compatibility settings и soft-delete state входят в encrypted backup/restore drill. Permanent delete в Production запрещён до data-governance approval.",
        "Consumer держит bounded cache уже проверенных schema IDs для краткого registry outage, но не принимает незнакомую schema по inference или latest lookup."
      ],
      "table": {
        "caption": "Schema promotion lifecycle",
        "columns": [
          "Stage",
          "Actor",
          "Required evidence"
        ],
        "rows": [
          [
            "Validate",
            "CI",
            "JSON Schema validity, examples, references and digest"
          ],
          [
            "Compare",
            "CI compatibility gate",
            "Transitive consumer compatibility report"
          ],
          [
            "Register",
            "Release principal",
            "Approved subject, schema ID and immutable digest"
          ],
          [
            "Activate",
            "Producer release",
            "Old/new consumer matrix and rollback plan"
          ],
          [
            "Restore",
            "Platform operator",
            "Backup manifest, recovered IDs and digest equality"
          ]
        ]
      },
      "callout": {
        "tone": "critical",
        "title": "ЕЩЁ НЕ РЕАЛИЗОВАНО: Schema Registry integration",
        "description": "Current producer publishes raw canonical JSON and does not resolve or attach a registry schema ID. Registry service, auth, backup, client cache and promotion gate must be implemented and tested before activation."
      }
    },
    {
      "id": "production-compatibility-policy",
      "title": "Compatibility policy",
      "lead": "Внутри одного major event subject действует FULL_TRANSITIVE compatibility и consumer-first rollout; любое исключение оформляется как reviewed migration, а не registry override в incident.",
      "bullets": [
        "Удаление или переименование field, изменение type/format, добавление required field, сужение range, изменение enum semantics и изменение event identity считаются breaking.",
        "Current payload schemas используют additionalProperties=false. Поэтому даже новый optional field отвергается strict old consumer и не считается автоматически backward-compatible.",
        "Breaking evolution получает new major topic и новый subject. Producer overlap публикует обе версии только после capacity, dedupe и reconciliation review; old topic остаётся до подтверждённого consumer migration.",
        "Frozen v1 и v2 на одном существующем topic являются documented migration exception: consumer dispatches exact event_type и поддерживает overlap. Этот precedent не разрешает новые mixed-version migrations без approval.",
        "Compatibility gate проверяет все исторические promoted schemas, schema-valid examples и current consumer matrix. Registry setting нельзя ослаблять вручную для прохождения release.",
        "Enum расширение рассматривается отдельно: consumer должен иметь explicit UNKNOWN/quarantine path либо новая value требует major version. Silent default запрещён."
      ],
      "table": {
        "caption": "Change disposition under strict schemas",
        "columns": [
          "Change",
          "Default decision",
          "Release path"
        ],
        "rows": [
          [
            "Description/example only",
            "Compatible after validation",
            "Same subject"
          ],
          [
            "Optional field with strict old consumer",
            "Breaking in current contract",
            "Consumer-first migration or new major"
          ],
          [
            "New required field",
            "Breaking",
            "New major topic and subject"
          ],
          [
            "Removed/narrowed field or type",
            "Breaking",
            "New major topic and subject"
          ],
          [
            "Enum value or meaning changed",
            "Breaking unless UNKNOWN path is proven",
            "Compatibility review or new major"
          ],
          [
            "Auth/topic/key semantics changed",
            "Breaking operational contract",
            "New version plus migration runbook"
          ]
        ]
      },
      "callout": {
        "tone": "warning",
        "title": "Registry green не равен end-to-end compatibility",
        "description": "Activation requires parser/validator tests in every registered consumer, old/new replay fixtures and rollback evidence. Schema comparison alone cannot prove application semantics."
      }
    },
    {
      "id": "production-consumer-lag",
      "title": "Consumer lag",
      "lead": "Production monitoring измеряет не только records lag, но и lag age до durable consumer outcome; маленькое число records может скрывать старый или остановленный partition.",
      "bullets": [
        "Для каждого approved consumer group/topic/partition собираются log-end offset, committed offset, records lag, oldest-unprocessed lag age, last successful process time и fetch/error rate.",
        "Отдельно наблюдаются paused partition count/reason, rebalance duration/count, assigned partitions, commit failures, inbox conflicts, quarantine/DLQ backlog и schema lookup failures.",
        "Alert строится по workload, environment, consumer group, topic и bounded outcome. tenant_id, event_id, partition key, raw error и customer reference не являются metric label.",
        "Dashboard показывает max и p95 lag age, total records lag, zero-throughput с растущим end offset, partition skew и связь с producer outbox backlog.",
        "Warning открывается до исчерпания freshness SLO; critical page срабатывает при projected SLO breach, stopped consumption, unknown schema или growing quarantine.",
        "Planned replay использует отдельный group и annotation, но не скрывает lag рабочего consumer. Silence time-bounded, approved и остаётся в audit evidence."
      ],
      "table": {
        "caption": "Lag signals and operator meaning",
        "columns": [
          "Signal",
          "Interpretation",
          "Required action"
        ],
        "rows": [
          [
            "records lag grows",
            "Consumer throughput below ingress",
            "Scale or throttle after bottleneck evidence"
          ],
          [
            "lag age grows with few records",
            "Old record is blocked or partition paused",
            "Inspect exact partition and disposition"
          ],
          [
            "zero fetch + moving log end",
            "Consumer stopped or unauthorized",
            "Page owner; verify auth and assignment"
          ],
          [
            "rebalance storm",
            "Unstable membership or processing timeout",
            "Stabilize group before offset changes"
          ],
          [
            "quarantine grows",
            "Integrity/schema/application failure",
            "Pause affected partition and remediate"
          ]
        ]
      },
      "callout": {
        "tone": "critical",
        "title": "ЕЩЁ НЕ РЕАЛИЗОВАНО: consumer lag telemetry",
        "description": "Current repository exports producer outbox backlog and publish outcomes, but consumer lag telemetry не экспортируется: reference consumer and consumer lag instruments отсутствуют. Production SLI cannot be claimed until a real group emits and exercises these signals."
      }
    },
    {
      "id": "production-slo",
      "title": "Kafka SLO",
      "lead": "SLO фиксирует измеряемую границу от committed fact до broker acknowledgement и durable consumer outcome; local alert threshold или successful smoke не становится Production SLO.",
      "bullets": [
        "Окно оценки — rolling 30 days; planned maintenance исключается только по заранее утверждённому change window, а incident silence не удаляет bad events из SLI.",
        "Error budget считается раздельно для publication, broker availability и каждого critical consumer. Fast/slow burn alerts имеют owner, page route и linked runbook.",
        "Invalid record считается успешным только после durable quarantine disposition в установленный срок; silent skip, manual offset jump или loss исключать из denominator запрещено.",
        "Цели активируются только после 30-day baseline, security-on load test, broker/AZ failover и consumer replay drill. До этого это design targets, не измеренная гарантия."
      ],
      "table": {
        "caption": "Activation targets; not current measured guarantees",
        "columns": [
          "SLI",
          "Target",
          "Measurement boundary"
        ],
        "rows": [
          [
            "Publication freshness",
            "99.9% within 60 секунд",
            "PostgreSQL commit time → Kafka durable ACK"
          ],
          [
            "Critical consumer freshness",
            "99.9% within 120 секунд",
            "Broker append time → inbox PROCESSED or durable quarantine"
          ],
          [
            "Authorized broker API availability",
            "99.95% monthly",
            "Successful eligible produce/fetch requests"
          ],
          [
            "Integrity and silent loss",
            "100%; any mismatch is incident",
            "Committed event set → broker/consumer reconciliation"
          ]
        ]
      },
      "callout": {
        "tone": "warning",
        "title": "ТРЕБУЕТ АКТИВАЦИИ: measured SLO",
        "description": "Numbers above are release gates to validate with the selected bank/vendor topology. They are not current service claims, and the existing ten-minute local backlog alert is not evidence that these targets are met."
      }
    },
    {
      "id": "production-replay-procedure",
      "title": "Production replay procedure",
      "lead": "Production replay является maker-checker change-controlled восстановлением exact retained records; он сохраняет event identity, не создаёт новый business fact и не обходит normal consumer authorization.",
      "steps": [
        {
          "title": "Открыть replay request",
          "description": "Maker фиксирует incident/change ticket, reason, data classification, consumer owner и ожидаемый reconciliation result."
        },
        {
          "title": "Собрать replay manifest",
          "description": "Зафиксировать immutable source cluster, topic, partitions, start/end offsets, event-count digest, schema snapshot и consumer build digest."
        },
        {
          "title": "Получить независимый approval",
          "description": "Checker отличается от maker и подтверждает range, ACL, retention availability, side-effect mode, quota и rollback/stop conditions."
        },
        {
          "title": "Запустить shadow consumer group",
          "description": "External effects disabled либо защищены тем же durable idempotency key; рабочие group offsets не изменяются."
        },
        {
          "title": "Выполнять bounded replay",
          "description": "Throttle не превышает security-on load-test limit; per-partition checkpoints и new/duplicate/quarantined/failed counters сохраняются."
        },
        {
          "title": "Остановиться на conflict",
          "description": "Digest mismatch, unknown schema, authorization drift или unexpected side effect немедленно останавливает affected partition."
        },
        {
          "title": "Выполнить reconciliation",
          "description": "Сверить source event set, inbox outcomes, rebuilt projection, quarantine и external-effect journal до любого cutover."
        },
        {
          "title": "Закрыть change",
          "description": "Подписать result manifest, сохранить evidence, удалить temporary ACL/group по approved cleanup и зафиксировать остаточный risk."
        }
      ],
      "code": {
        "title": "Replay manifest — values are placeholders, never credentials",
        "examples": [
          {
            "id": "replay-manifest",
            "label": "YAML",
            "language": "yaml",
            "value": "version: certarail.kafka-replay.v1\nrequest_id: replay-<ticket-id>\nreason: <approved incident or rebuild reason>\nmaker: <workload-or-operator-principal>\nchecker: <different approving principal>\nsource_cluster: <immutable cluster identity>\nconsumer:\n  name: <consumer-name>\n  build_digest: sha256:<image-digest>\n  shadow_group: <new-isolated-group>\nrange:\n  topic: <approved-topic>\n  partitions:\n    - partition: 0\n      start_offset: 1200\n      end_offset: 1750\nschemas:\n  registry_snapshot_sha256: <sha256>\neffects:\n  mode: disabled-or-idempotent\nlimits:\n  max_records_per_second: <load-tested-limit>\nevidence:\n  expected_event_count: 551\n  expected_event_set_sha256: <sha256>\n  output_manifest_uri: <approved-evidence-location>"
          }
        ]
      },
      "callout": {
        "tone": "critical",
        "title": "Рабочий offset reset запрещён как первый шаг",
        "description": "Manual group reset without an approved bounded manifest, shadow validation and reconciliation can duplicate effects or hide loss. Break-glass execution still produces the same evidence and post-incident review."
      }
    },
    {
      "id": "production-disaster-recovery-test",
      "title": "Disaster recovery test",
      "lead": "Production topology использует минимум три brokers в независимых failure domains, RF=3, min.insync.replicas=2 и acks=all; DR считается проверенным только после measured restore/failover drill.",
      "steps": [
        {
          "title": "Зафиксировать baseline",
          "description": "Сохранить topic configs, ACL/schema snapshots, cluster IDs, offsets, outbox head, event-set digest, current lag и SLO burn."
        },
        {
          "title": "Изолировать failure domain",
          "description": "Quarterly убрать broker/AZ; semiannual изолировать primary cluster/region. Test controller не должен зависеть от затронутого domain."
        },
        {
          "title": "Проверить protected write behavior",
          "description": "Writes продолжаются только при required ISR; unclean leader election и silent downgrade durability запрещены."
        },
        {
          "title": "Promote DR path",
          "description": "Переключить reviewed bootstrap endpoint, restore Schema Registry and consumer offsets, then rotate cluster authority epoch to prevent split-brain clients."
        },
        {
          "title": "Drain authoritative backlog",
          "description": "Outbox publishes committed facts through the new cluster; duplicates converge through stable event_id and inbox."
        },
        {
          "title": "Reconcile and measure",
          "description": "Compare source/outbox/broker/inbox event sets and record actual RPO, RTO, lag, duplicates, quarantine and error-budget impact."
        },
        {
          "title": "Return without split brain",
          "description": "Old cluster rejoins only after fencing and re-seed; evidence owner signs findings and tracks every failed acceptance item."
        }
      ],
      "table": {
        "caption": "DR targets requiring drill evidence",
        "columns": [
          "Failure domain",
          "Target RPO",
          "Target RTO",
          "Frequency"
        ],
        "rows": [
          [
            "Single broker or AZ",
            "0 acknowledged records",
            "≤ 5 min",
            "Quarterly and after topology change"
          ],
          [
            "Primary Kafka region",
            "≤ 5 min replicated log; PostgreSQL facts remain authoritative",
            "≤ 60 min",
            "Semiannual"
          ],
          [
            "Schema Registry",
            "≤ 5 min metadata",
            "≤ 60 min",
            "Quarterly restore"
          ],
          [
            "Consumer offsets/checkpoints",
            "≤ 5 min",
            "≤ 60 min plus replay",
            "Quarterly restore"
          ]
        ]
      },
      "callout": {
        "tone": "warning",
        "title": "Local broker не проверяет DR",
        "description": "Compose runs one broker with RF=1 and min ISR=1. Multi-AZ quorum, cross-region replication, registry/offset restore and fenced failover remain unimplemented activation gates."
      }
    },
    {
      "id": "production-audit-evidence",
      "title": "Audit evidence",
      "lead": "Каждая security, schema, replay и recovery операция оставляет privacy-minimised, tamper-evident manifest, позволяющий независимо восстановить кто, что, когда и по какому approval изменил.",
      "bullets": [
        "Release evidence включает broker/controller version and image digest, cluster ID, listener/TLS policy, topic configs, replication/ISR state, quotas и payload-free health result.",
        "Access evidence включает normalized principal map, ACL snapshot/diff, denied cross-tenant canary, group ownership, temporary elevation expiry и maker-checker approval.",
        "Schema evidence включает registry subject/schema ID, canonical $id, schema SHA-256, FULL_TRANSITIVE result, example validation, consumer matrix и promotion actor.",
        "Operational evidence включает lag/SLO report, alert delivery drill, replay manifest/result, DR test timeline, measured RPO/RTO и reconciliation event-set digest.",
        "Credentials, OAuth token, private key, truststore password, raw payload, tenant PII и unrestricted error text не входят в evidence или logs.",
        "Manifest canonicalized, hashed with SHA-256, signed by approved workload/operator identity, timestamped and anchored in bank-managed WORM/SIEM storage with retention/legal-hold policy.",
        "Evidence has an owner, classification, retention_until, verification status and immutable link to incident/change/release. Missing artifact blocks Production activation or closes drill as failed."
      ],
      "table": {
        "caption": "Minimum activation evidence pack",
        "columns": [
          "Evidence class",
          "Required artifacts",
          "Fail gate"
        ],
        "rows": [
          [
            "Transport and identity",
            "TLS scan, CA/principal map, rotation and negative auth tests",
            "Plaintext or fallback path exists"
          ],
          [
            "Authorization",
            "ACL snapshot/diff, cross-tenant deny and admin separation",
            "Wildcard or unowned grant"
          ],
          [
            "Schema",
            "Registry IDs/digests and schema compatibility report",
            "Unregistered or incompatible schema"
          ],
          [
            "Reliability",
            "Lag dashboard, SLO burn and alert receiver drill",
            "No consumer freshness signal"
          ],
          [
            "Recovery",
            "Replay/DR manifests, event-set reconciliation and actual RPO/RTO",
            "Loss, split brain or unresolved mismatch"
          ]
        ]
      },
      "callout": {
        "tone": "critical",
        "title": "Design artifact не подтверждает готовность Production",
        "description": "This contract records required controls and evidence. Production status remains blocked until deployed infrastructure, client implementation, negative security tests, SLO baseline, replay and DR drills produce verifiable artifacts."
      }
    }
  ]
}