« Phase 17 · Warmup · Lab 01

The Hitchhiker's Guide to the Composed Platform

Fast orientation. Read this in fifteen minutes, then go build the lab.

Table of Contents

• The one-sentence version
• The map
• The eleven steps, in a table
• Three assertions you can only make here
• The vocabulary
• What each layer denies
• Four outcomes, not two
• The seam checklist
• Reading the demo output
• If you only remember five things

The one-sentence version

Sixteen phases built sixteen mechanisms that each pass their own tests; this phase composes them into one request path and then attacks the composition, because the failures that matter live between components that are individually correct.

The map

                          ┌──────────────────────────────────┐
   Teams / API  ────────► │  1  CHANNEL      session         │
                          └───────────────┬──────────────────┘
                          ┌───────────────▼──────────────────┐
                          │  2  CONTROL PLANE   admission     │  ← default deny
                          └───────────────┬──────────────────┘
                          ┌───────────────▼──────────────────┐
                          │  3  KNOWLEDGE    barrier → clearance
                          └───────────────┬──────────────────┘
                          ┌───────────────▼──────────────────┐
                          │  4  GUARDRAILS ①  retrieved text  │  ← taint marked here
                          └───────────────┬──────────────────┘
                          ┌───────────────▼──────────────────┐
                          │  5  MODEL      class → residency → budget
                          └───────────────┬──────────────────┘
                          ┌───────────────▼──────────────────┐
                          │  6  DELEGATION   chain APPENDS    │
                          └───────────────┬──────────────────┘
                          ┌───────────────▼──────────────────┐
                          │  7  GUARDRAILS ②  the taint rule  │
                          └───────────────┬──────────────────┘
                          ┌───────────────▼──────────────────┐
                          │  8  ACTION GATEWAY  contract →    │
                          │     key → dual control → execute  │
                          └───────────────┬──────────────────┘
                            9 outcome · 10 evidence · 11 telemetry

The guardrail chain appears twice. If your architecture diagram has one guardrail box, you have drawn the components and not the flow.

The eleven steps, in a table

Three assertions you can only make here

1. Defence depth is a number. How many distinct layers denied this request? ≥ 2 required for anything irreversible. A depth of 1 is a finding that requires an explanation, not an automatic failure.

2. A control is never on the degradation ladder. Quality may degrade; safety may not. Checked at platform construction so a bad rung fails at start-up, not mid-incident.

3. The output of a run is an evidence pack. Generated along the path, not assembled at the end. Complete, or it names the missing artifact.

None of the three is a property of any single component, which is why none of the sixteen previous labs could assert them.

The vocabulary

What each layer denies

The most useful thing to be able to recite, because "what does it deny?" is the question that separates a platform diagram from a box diagram.

Four outcomes, not two

Collapsing DEGRADED and DENIED into "error" is the most common instrumentation mistake in this design, and it costs you both a correct availability SLI and a correct on-call signal.

The seam checklist

Run this against any distributed design, not just this one:

• What travels the whole way? (identity, tenant, classification, trace id, region, freshness)
• Where could each of them stop?
• Is anything built before the value it depends on is resolved? (cache keys and tenants)
• Does the fallback path pass through the same gates as the primary?
• Is the join key stamped in one place, or by each emitter?
• Can a control become a degradation rung without anything noticing?
• Is any step retried by a layer that does not know whether it is idempotent?
• Does a denial leave a record?

Reading the demo output

python solution.py prints twelve sections. What to look at:

1. The happy path — COMPLETED, depth 0, evidence complete. Depth 0 on a legitimate request is the point: controls that fire on everything are not controls, they are outages.
2. Defence depth — six attacks and one control case. Look at A-01: depth=2, layers guardrails + action_gateway. That second layer only appears because the gateway's checks run after an earlier block. Then look at A-07, the legitimate request: depth 0, permitted.
3. Chaos — seven cases, each showing declared vs actual. Four of the seven still produce a usable answer.
4. The ladder — five rungs, is_control=False on every one, and the refusal when a control is added.
5. Idempotency — two calls, one execution, same reference.
6. The budget — headroom, not just pass/fail.

If you only remember five things

1. The interesting failures live in the seams. Component tests cannot see them; something has to own the composition.
2. Defence depth is a number, and ≥ 2 for irreversible. Measure it or stop saying "layered".
3. A control is never on the degradation ladder. Shed traffic, not controls.
4. Fail static — last known-good, alarm, hard stop.
5. The run's output is an evidence pack, generated along the way, and it names what is missing.