▲

France → DK-edge-provider — Sovereign Whole-Tenant Migration

Autonomous, EDC-gated, cross-jurisdiction migration corridor · live audit surface
— live · auto-refresh 15 s cycle — build — Every figure is real & provenance-tagged. Green badge = value pulled this request; grey = recorded or not-yet-collected (never fabricated).
Verified evidence — whole-tenant death & revival across the corridor
—
accumulating…
corpus.jsonl
Each number above is a claim from the evaluation scheme (below). A claim is credible because its honest limitation is stated alongside — rose-glasses off.
01

Evaluation protocol — how to audit this yourself

claim → live evidence → independent check → standard → honest limitation
Seven falsifiable claims. Every panel below maps to one; each shows its live evidence and the caveat that makes it believable. Claims C1, C3, C4 & C6 now carry a live ✔ verify-this-yourself sub-panel — the auditor re-checks the row-count/hash, the whole-tenant namespace death (UID flip / NotFound), the gate refusal and the receiver-side erasure count in real time via read-only /api/verify/c1, /api/verify/c3, /api/verify/c4 & /api/verify/c6.
loading claim matrix…
docs/audit/EVALUATION_SCHEME.md
Guided 15-minute walkthrough  what we suggest an auditor DO, in order
loading…
Mapping to recognised frameworks: ACM Artifact Evaluation (Available / Functional / Reproduced) · claim→hypothesis→measurement→threats-to-validity · SRE golden signals + SLO · chaos-engineering steady-state + blast-radius + kill-switch · distributions with n / median / p95 / exact 95% confidence intervals.
docs/audit/EVALUATION_SCHEME.md § guided walkthrough
02

Live now

the current cycle & phase, mapped onto the six-participant / nine-step flow
waiting for loop…
6 participants ● active phase ● completed ● pending
custodian_runs/fullflow_loop/live.json + /api/flow
Claim C5 (autonomous, agent-driven) & C7 (turnkey). Honest limit: the ONE manual act is the injected fault (STEP 4, labelled MANUAL); every other step is unattended. Some external inputs (kubeconfig/ssh/DNS) are Commission-provided.
03

Per-process duration distributions

the “Fokker–Planck plank” — one panel per stage, filling in as cycles accumulate
Each histogram is that stage’s wall-clock duration over every completed cycle; the dashed line is the median.
—
Sub-stages (└) are the migration executor’s own fine-grained timers nested inside contract execute (whole). Distributions are honest empty-states until ≥1 cycle completes. 95% CI (median) is a distribution-free interval built from order statistics — it assumes no normality and uses no bootstrap RNG, so recomputing it from the same corpus returns these exact numbers. It is omitted, never fabricated, when n is too small to support it (n≥6 for a median, n≥72 for a p95).
corpus.jsonl
04

KPI evidence — every cycle, every invariant

the auditor’s at-a-glance “always green” grid
no completed cycle yet — the grid fills one column per cycle.
invariant held   violated   not recorded  —  gaps=0 exact row-for-row copy · hash-match content-hash gate MATCH · ns-death namespace UID changed (real tenant death) · provider-emptied authoritative table emptied on return.
Claims C1/C3/C6. Honest limits: Kafka stream history not fully mirrored (durable Postgres state is gaps=0); provider side is wiped, not ns-deleted (symmetric double-death = next work); a standing provider shell remains.
corpus.jsonl
05

Live footprint

real time-series — PromQL query_range (clusters) · podman stats (connectors)
Cluster footprint  node CPU / memory / load, per zone
Connector footprint  FR-connector EDC containers (provider / consumer / ih / iss / bdrs)
06

Comparisons

endpoint footprint · phase-duration summary · cost-of-custody (research context)
France vs DK-edge-provider — corridor endpoint footprint
loading…
Live node CPU-busy % and load1 at the two corridor endpoints — the sending (France/UC1) and receiving (DK-edge-provider) sovereign sites.
PromQL query (node_cpu_seconds_total / node_load1, per cluster)
Phase-duration summary — median ± p95 across cycles
accumulating…
Bars = median stage duration; the lighter cap marks p95. Reads the same corpus as panel 3.
corpus.jsonl
Cost of custody — our custody-preserving migration vs. naive stop-and-copy
Baseline comparison: pending. A naive stop-and-copy control (RQ1, the research cost-of-custody question) has not been collected on this corridor yet. When the BASELINE_STOPCOPY arm runs, its downtime & duration will appear here beside the live custody-preserving numbers. No bar is shown until real data exists — this placeholder is deliberately empty, not a fabricated value.
honest placeholder — no synthetic baseline curve
07

Audit detail

the verified nine-step run of record, the two forecasters, corridor health & supervisor grid
A · nine-step agent-orchestrated flow (verified run of record + live overlays)
B · the two forecasters (live on the FR-connector)
C · corridor health
D · max signals from all machines
EU-OBSERVABILITY FEDERATION — 4 zones (live PromQL)
MAPE-K SUPERVISOR — 14-element health grid
elementfaultlivereadyCPU (cores)RSS (MB)forecast
fault is the health verdict. The forecast anomaly flag is the raw OnlineOU divergence at a tight τ=0.1 (RSS jitter trips it even when HEALTHY) — an early-warning gradient, not a fault.
Honest scope. Every “LIVE” badge means this server pulled a real value on this request; a grey badge is either a recorded run-of-record fact or a source labelled unreachable/not-yet-collected — never a fabricated number. The Fokker–Planck distributions and the KPI grid grow live from custodian_runs/fullflow_loop/corpus.jsonl (one row per completed cycle, ~8–15 min each), so early on they show honest “accumulating” states. The nine-step PASSes are from the last verified end-to-end run (). This dashboard is read-only — it observes the corridor, it never acts. Recording sink: custodian_runs/audit_frontend/signal_snapshots.jsonl.
Which code is answering you.
Which numbers are answering you.
Which guard keeps this honest.