@empire-builder-kit/nx 1.0.0-rc.44 → 1.0.0-rc.46

package/src/generators/slice/built-in-plan-reliability-files.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderProductReliabilityFiles = renderProductReliabilityFiles;
 const reliability_1 = require("@empire-builder-kit/runtime/reliability");
+const deterministic_order_js_1 = require("../../deterministic-order.js");
+const built_in_plan_alarm_identity_js_1 = require("./built-in-plan-alarm-identity.js");
 const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
 function reliabilityContract(name, reviewedAt) {
     return {
@@ -128,295 +130,214 @@ function reliabilityContract(name, reviewedAt) {
     };
 }
 function alarmRegistrations(name, sql) {
-    const owner = `${name}-product`;
-    const route = `${name}-on-call`;
     const common = {
-        escalationRouteKey: route,
         expectedFalseNegativeRisk: 'Low traffic or delayed CloudWatch data can delay detection.',
         expectedFalsePositiveRisk: 'A dependency or synthetic client can fail while the application remains healthy.',
         missingData: 'missing',
-        owner,
         testRef: 'evidence:reliability/failure-recovery',
     };
+    // Symptom, owner, route and runbook come from the shared alarm identity
+    // table, as every managed emitter's description does.
+    const registered = (id) => {
+        const identity = (0, built_in_plan_alarm_identity_js_1.sliceAlarmIdentity)(name, id);
+        return {
+            ...common,
+            businessSymptom: identity.businessSymptom,
+            escalationRouteKey: identity.route,
+            id,
+            owner: identity.owner,
+            runbookRef: identity.runbookRef,
+        };
+    };
     const registrations = [
         {
-            ...common,
-            businessSymptom: 'Critical API operations are failing.',
+            ...registered('api-fast-burn'),
             condition: 'The API availability objective is consuming budget rapidly.',
             dependencyAlarmIds: ['database-capacity'],
-            id: 'api-fast-burn',
-            runbookRef: 'runbook:api-recovery',
             severity: 'critical',
         },
         {
-            ...common,
-            businessSymptom: 'Critical API operations have sustained failures.',
+            ...registered('api-slow-burn'),
             condition: 'The API availability objective is consuming budget slowly.',
             dependencyAlarmIds: ['database-capacity'],
-            id: 'api-slow-burn',
-            runbookRef: 'runbook:api-recovery',
             severity: 'high',
         },
         {
-            ...common,
-            businessSymptom: 'Server-rendered routes exceed the latency objective.',
+            ...registered('web-latency-fast-burn'),
             condition: 'Web p95 latency exceeds the reviewed threshold.',
             dependencyAlarmIds: ['database-capacity'],
-            id: 'web-latency-fast-burn',
-            runbookRef: 'runbook:web-recovery',
             severity: 'high',
         },
         {
-            ...common,
-            businessSymptom: 'Server-rendered routes have sustained latency degradation.',
+            ...registered('web-latency-slow-burn'),
             condition: 'Web p95 latency remains above the reviewed threshold for the slow window.',
             dependencyAlarmIds: ['database-capacity'],
-            id: 'web-latency-slow-burn',
-            runbookRef: 'runbook:web-recovery',
             severity: 'high',
         },
         {
-            ...common,
-            businessSymptom: 'Accepted provider work is missing its deadline.',
+            ...registered('provider-queue-age'),
             condition: 'Oldest provider-queue work exceeds 900 seconds.',
             dependencyAlarmIds: [],
-            id: 'provider-queue-age',
-            runbookRef: 'runbook:async-recovery',
             severity: 'high',
         },
         {
-            ...common,
-            businessSymptom: 'Slice data access or durable event delivery is being throttled.',
+            ...registered('database-capacity'),
             condition: 'The Slice DynamoDB table or PendingEvents index reports read or write throttling.',
             dependencyAlarmIds: [],
-            id: 'database-capacity',
-            runbookRef: 'runbook:database-recovery',
             severity: 'high',
         },
         {
-            ...common,
-            businessSymptom: 'Expired protected performance-load control records are accumulating.',
+            ...registered('performance-load-cleanup-backlog'),
             condition: 'The bounded performance-load expiry cleanup reports a nonzero backlog.',
             dependencyAlarmIds: [],
-            id: 'performance-load-cleanup-backlog',
-            runbookRef: 'runbook:performance-capacity-cost',
             severity: 'high',
         },
         {
-            ...common,
-            businessSymptom: 'Protected performance-load residue exceeded its cleanup deadline.',
+            ...registered('performance-load-cleanup-deadline'),
             condition: 'The bounded expiry worker reports residue at least 24 hours past eligible expiry.',
             dependencyAlarmIds: ['performance-load-cleanup-backlog'],
-            id: 'performance-load-cleanup-deadline',
-            runbookRef: 'runbook:performance-capacity-cost',
             severity: 'critical',
         },
         {
-            ...common,
-            businessSymptom: 'The confidential-export cleanup invocation is failing.',
+            ...registered('data-export-cleanup-failure'),
             condition: 'AWS/Lambda reports an error for the exact generated confidential-export cleanup Function.',
             dependencyAlarmIds: [],
-            id: 'data-export-cleanup-failure',
-            runbookRef: 'runbook:database-recovery',
             severity: 'high',
         },
         {
-            ...common,
-            businessSymptom: 'The scheduled confidential-export cleanup is not running.',
+            ...registered('data-export-cleanup-invocation-missing'),
             condition: 'AWS/Lambda reports fewer than one invocation across two consecutive hourly periods.',
             dependencyAlarmIds: [],
-            id: 'data-export-cleanup-invocation-missing',
-            runbookRef: 'runbook:database-recovery',
             severity: 'critical',
         },
         {
-            ...common,
-            businessSymptom: 'Confidential-export residue exceeded its deletion deadline.',
+            ...registered('data-export-cleanup-deadline'),
             condition: 'The cleanup worker reports an open export at or after its immutable 24-hour cleanup deadline.',
             dependencyAlarmIds: [
                 'data-export-cleanup-failure',
                 'data-export-cleanup-invocation-missing',
             ],
-            id: 'data-export-cleanup-deadline',
-            runbookRef: 'runbook:database-recovery',
             severity: 'critical',
         },
         {
-            ...common,
-            businessSymptom: 'The generated confidential-export cleanup Function has a terminal invocation error.',
+            ...registered('function-failure'),
             condition: 'AWS/Lambda reports one or more errors in one minute for the exact generated data-export cleanup Function. Event-delivery Functions have their own error alarms.',
             dependencyAlarmIds: [],
-            id: 'function-failure',
-            runbookRef: 'runbook:api-recovery',
             severity: 'high',
         },
         {
-            ...common,
-            businessSymptom: 'The built-in retention Job terminated unsuccessfully.',
+            ...registered('retention-job-failure'),
             condition: 'AWS Step Functions reports a failed, timed-out, or aborted execution for the exact retention state machine.',
             dependencyAlarmIds: [],
-            id: 'retention-job-failure',
-            runbookRef: 'runbook:database-recovery',
             severity: 'high',
         },
         {
-            ...common,
-            businessSymptom: 'The primary alert route is failing delivery.',
+            ...registered('alert-delivery-degraded'),
             condition: 'SNS reports one or more failed notifications.',
             dependencyAlarmIds: [],
-            id: 'alert-delivery-degraded',
-            runbookRef: 'runbook:alert-delivery',
             severity: 'critical',
         },
         {
-            ...common,
-            businessSymptom: 'A managed log group contains a protected-data finding.',
+            ...registered('data-protection-findings'),
             condition: 'CloudWatch Logs reports one or more protected-data findings.',
             dependencyAlarmIds: [],
-            id: 'data-protection-findings',
-            runbookRef: 'runbook:log-investigation',
             severity: 'critical',
         },
         {
-            ...common,
-            businessSymptom: 'Domain-event processing has terminal failures.',
+            ...registered('event-dlq-depth'),
             condition: 'The event dead-letter queue contains one or more messages.',
             dependencyAlarmIds: [],
-            id: 'event-dlq-depth',
-            runbookRef: 'runbook:async-recovery',
             severity: 'high',
         },
         {
-            ...common,
-            businessSymptom: 'Provider deliveries have terminal failures.',
+            ...registered('provider-dlq-depth'),
             condition: 'The provider-delivery dead-letter queue contains one or more messages.',
             dependencyAlarmIds: [],
-            id: 'provider-dlq-depth',
-            runbookRef: 'runbook:async-recovery',
             severity: 'high',
         },
         {
-            ...common,
-            businessSymptom: 'An asynchronous target has terminal failures.',
+            ...registered('async-target-dlq-depth'),
             condition: 'The asynchronous-target dead-letter queue contains one or more messages.',
             dependencyAlarmIds: [],
-            id: 'async-target-dlq-depth',
-            runbookRef: 'runbook:async-recovery',
             severity: 'high',
         },
         {
-            ...common,
-            businessSymptom: 'The isolated performance-sink outbox relay is failing.',
+            ...registered('outbox-relay-errors'),
             condition: 'AWS/Lambda reports one or more errors in five minutes for the generated async/outbox-relay Function, which drains only the isolated performance sink. Domain-event delivery is the key-value stream and reconciliation.',
             dependencyAlarmIds: [],
-            id: 'outbox-relay-errors',
-            runbookRef: 'runbook:async-recovery',
             severity: 'high',
         },
         {
-            ...common,
-            businessSymptom: 'The asynchronous inbox cleanup job is failing.',
+            ...registered('inbox-cleanup-errors'),
             condition: 'The generated inbox cleanup job reports one or more errors.',
             dependencyAlarmIds: [],
-            id: 'inbox-cleanup-errors',
-            runbookRef: 'runbook:async-recovery',
             severity: 'high',
         },
         {
-            ...common,
-            businessSymptom: 'The key-value stream delivery Function failed an invocation.',
+            ...registered('key-value-stream-delivery-errors'),
             condition: 'AWS/Lambda reports one or more errors in five minutes for the exact key-value stream delivery Function: the stream identity or record shape was rejected, or the handler crashed. Per-record publish failures are partial batch failures, not Lambda errors; they surface through key-value-stream-iterator-age while retries hold the shard back, and through outbox-backlog and event-delivery-attempts after the mapping discards them.',
             dependencyAlarmIds: [],
-            id: 'key-value-stream-delivery-errors',
-            runbookRef: 'runbook:async-recovery',
             severity: 'high',
         },
         {
-            ...common,
-            businessSymptom: 'Prompt domain-event delivery from the key-value stream is falling behind.',
+            ...registered('key-value-stream-iterator-age'),
             condition: 'AWS/Lambda reports a stream iterator age of at least ten minutes for the exact key-value stream delivery Function. The mapping discards records older than one hour; reconciliation then recovers their retained intents.',
             dependencyAlarmIds: ['key-value-stream-delivery-errors'],
-            id: 'key-value-stream-iterator-age',
-            runbookRef: 'runbook:async-recovery',
             severity: 'high',
         },
         {
-            ...common,
-            businessSymptom: 'Durable domain-event recovery is failing.',
+            ...registered('key-value-reconciliation-errors'),
             condition: 'AWS/Lambda reports one or more errors in five minutes for the exact key-value reconciliation Function. Partial runs do not error; the backlog, rejected-intent, and attempts alarms report them.',
             dependencyAlarmIds: [],
-            id: 'key-value-reconciliation-errors',
-            runbookRef: 'runbook:async-recovery',
             severity: 'high',
         },
         {
-            ...common,
-            businessSymptom: 'Durable domain-event intents remain undelivered.',
+            ...registered('outbox-backlog'),
             condition: 'In two consecutive hours, key-value reconciliation reported one or more due intents it could not deliver (retry-required plus rejected). Each run reads at most one 25-intent page per shard, so the value is a lower bound, not a global count, and excludes intents leased by another delivery owner.',
             dependencyAlarmIds: [
                 'key-value-reconciliation-errors',
                 'key-value-stream-delivery-errors',
             ],
             expectedFalseNegativeRisk: 'Intents beyond the sampled pages, or behind a paused outbox, are not counted until a later run reaches them. When the configured reconciliation cadence is slower than one hour, some hourly periods have no data and the two-period condition may never be met.',
-            id: 'outbox-backlog',
-            runbookRef: 'runbook:async-recovery',
             severity: 'high',
         },
         {
-            ...common,
-            businessSymptom: 'A retained domain-event intent cannot be delivered.',
+            ...registered('event-intent-rejected'),
             condition: 'Within an hour, key-value reconciliation reported one or more retained intents that fail validation. Rejected intents are never dispatched or deleted, so this recurs until an operator investigates.',
             dependencyAlarmIds: [],
-            id: 'event-intent-rejected',
-            runbookRef: 'runbook:async-recovery',
             severity: 'high',
         },
         {
-            ...common,
-            businessSymptom: 'A domain-event intent is repeatedly failing delivery.',
+            ...registered('event-delivery-attempts'),
             condition: 'Within an hour, key-value reconciliation observed a due intent with at least ten delivery leases (attempts). Attempts are reported only; no intent is capped, dropped, or quarantined.',
             dependencyAlarmIds: ['key-value-reconciliation-errors'],
-            id: 'event-delivery-attempts',
-            runbookRef: 'runbook:async-recovery',
             severity: 'high',
         },
         {
-            ...common,
-            businessSymptom: 'Terminal asynchronous inbox records are accumulating.',
+            ...registered('inbox-cleanup-backlog'),
             condition: 'The terminal inbox cleanup backlog remains nonempty.',
             dependencyAlarmIds: ['inbox-cleanup-errors'],
-            id: 'inbox-cleanup-backlog',
-            runbookRef: 'runbook:async-recovery',
             severity: 'high',
         },
         ...(sql
             ? [
                 {
-                    ...common,
-                    businessSymptom: 'Relational event delivery is failing.',
+                    ...registered('sql-outbox-relay-errors'),
                     condition: 'AWS/Lambda reports one or more errors in five minutes for the exact SQL outbox relay Function, which fails every run that retains a failed delivery.',
                     dependencyAlarmIds: [],
-                    id: 'sql-outbox-relay-errors',
-                    runbookRef: 'runbook:async-recovery',
                     severity: 'high',
                 },
                 {
-                    ...common,
-                    businessSymptom: 'Relational event intents remain undelivered.',
+                    ...registered('sql-outbox-backlog'),
                     condition: 'Every SQL relay run in two consecutive hours ended with one or more unpublished intents (Minimum of a global count). A paused relay reports nothing.',
                     dependencyAlarmIds: ['sql-outbox-relay-errors'],
                     expectedFalseNegativeRisk: 'A paused relay reports nothing. When the configured sqlOutboxRecovery cadence is slower than one hour and no notification wakes the relay, some hourly periods have no data and the two-period condition may never be met.',
-                    id: 'sql-outbox-backlog',
-                    runbookRef: 'runbook:async-recovery',
                     severity: 'high',
                 },
                 {
-                    ...common,
-                    businessSymptom: 'A relational event intent is repeatedly failing delivery.',
+                    ...registered('sql-outbox-attempts'),
                     condition: 'Within an hour, an unpublished SQL intent reached at least ten relay attempts. Attempts are reported only; no intent is capped or dropped.',
                     dependencyAlarmIds: ['sql-outbox-relay-errors'],
-                    id: 'sql-outbox-attempts',
-                    runbookRef: 'runbook:async-recovery',
                     severity: 'high',
                 },
             ]
@@ -595,14 +516,40 @@ function reliabilityExercises(name) {
         },
     ];
 }
+const ROUTED_INVENTORY_LEADING_KEYS = [
+    'actions',
+    'comparisonOperator',
+    'owner',
+    'route',
+];
+/**
+ * One inventory entry with the shared identity's owner, route and runbook,
+ * the fields the generated verifier compares with the deployed alarm's
+ * description. Keys keep the seeded order: a routed alarm's actions,
+ * comparison operator, owner and route first, then the rest sorted.
+ */
+function inventoryAlarmResource(name, resource) {
+    const identity = (0, built_in_plan_alarm_identity_js_1.sliceAlarmIdentity)(name, resource.id);
+    const fields = {
+        ...resource,
+        owner: identity.owner,
+        route: identity.route,
+        runbook: identity.runbook,
+    };
+    const leading = resource.actions === 'primary-route' ? ROUTED_INVENTORY_LEADING_KEYS : [];
+    return Object.fromEntries([
+        ...leading,
+        ...Object.keys(fields)
+            .filter((key) => !leading.includes(key))
+            .sort(deterministic_order_js_1.compareUtf16),
+    ].map((key) => [key, fields[key]]));
+}
 function deployedAlarmResources(name, sql) {
     const primary = {
         actions: 'primary-route',
         comparisonOperator: 'GreaterThanOrEqualToThreshold',
-        owner: `${name}-product`,
-        route: `${name}-on-call`,
     };
-    return [
+    const resources = [
         {
             ...primary,
             dimensionNames: ['ApiId'],
@@ -612,7 +559,6 @@ function deployedAlarmResources(name, sql) {
             name: `${name}-{stage}-api-fast-burn`,
             namespace: 'AWS/ApiGateway',
             objectiveId: 'api-availability',
-            runbook: 'docs/runbooks/api-recovery.md',
             signal: 'metric-math',
             threshold: 14.4,
             treatMissingData: 'missing',
@@ -626,7 +572,6 @@ function deployedAlarmResources(name, sql) {
             name: `${name}-{stage}-api-slow-burn`,
             namespace: 'AWS/ApiGateway',
             objectiveId: 'api-availability',
-            runbook: 'docs/runbooks/api-recovery.md',
             signal: 'metric-math',
             threshold: 6,
             treatMissingData: 'missing',
@@ -647,7 +592,6 @@ function deployedAlarmResources(name, sql) {
             name: `${name}-{stage}-web-latency-fast-burn`,
             namespace: `EBK/${name}`,
             objectiveId: 'web-latency',
-            runbook: 'docs/runbooks/web-recovery.md',
             signal: 'metric-math',
             threshold: 14.4,
             treatMissingData: 'missing',
@@ -668,7 +612,6 @@ function deployedAlarmResources(name, sql) {
             name: `${name}-{stage}-web-latency-slow-burn`,
             namespace: `EBK/${name}`,
             objectiveId: 'web-latency',
-            runbook: 'docs/runbooks/web-recovery.md',
             signal: 'metric-math',
             threshold: 6,
             treatMissingData: 'missing',
@@ -685,7 +628,6 @@ function deployedAlarmResources(name, sql) {
             name: `${name}-{stage}-provider-deadline`,
             namespace: 'AWS/SQS',
             period: 300,
-            runbook: 'docs/runbooks/async-recovery.md',
             signal: 'metric',
             statistic: 'Maximum',
             threshold: 900,
@@ -701,7 +643,6 @@ function deployedAlarmResources(name, sql) {
             name: `${name}-{stage}-database-capacity`,
             namespace: 'AWS/DynamoDB',
             period: 60,
-            runbook: 'docs/runbooks/database-recovery.md',
             signal: 'metric-math',
             statistic: 'Sum',
             threshold: 1,
@@ -723,7 +664,6 @@ function deployedAlarmResources(name, sql) {
             name: `${name}-{stage}-performance-load-cleanup-backlog`,
             namespace: 'EBK/Performance',
             period: 3600,
-            runbook: 'docs/runbooks/performance-capacity-cost.md',
             signal: 'metric',
             statistic: 'Maximum',
             threshold: 1,
@@ -745,7 +685,6 @@ function deployedAlarmResources(name, sql) {
             name: `${name}-{stage}-performance-load-cleanup-deadline`,
             namespace: 'EBK/Performance',
             period: 3600,
-            runbook: 'docs/runbooks/performance-capacity-cost.md',
             signal: 'metric',
             statistic: 'Maximum',
             threshold: 1,
@@ -761,7 +700,6 @@ function deployedAlarmResources(name, sql) {
             name: `${name}-{stage}-data-export-cleanup-invocation-missing`,
             namespace: 'AWS/Lambda',
             period: 3600,
-            runbook: 'docs/runbooks/database-recovery.md',
             signal: 'metric',
             statistic: 'Sum',
             threshold: 1,
@@ -776,7 +714,6 @@ function deployedAlarmResources(name, sql) {
             name: `${name}-{stage}-data-export-cleanup-failure`,
             namespace: 'AWS/Lambda',
             period: 300,
-            runbook: 'docs/runbooks/database-recovery.md',
             signal: 'metric',
             statistic: 'Sum',
             threshold: 1,
@@ -798,7 +735,6 @@ function deployedAlarmResources(name, sql) {
             name: `${name}-{stage}-data-export-cleanup-deadline`,
             namespace: 'EBK/DataLifecycle',
             period: 3600,
-            runbook: 'docs/runbooks/database-recovery.md',
             signal: 'metric',
             statistic: 'Maximum',
             threshold: 1,
@@ -813,7 +749,6 @@ function deployedAlarmResources(name, sql) {
             name: `${name}-{stage}-function-failure`,
             namespace: 'AWS/Lambda',
             period: 60,
-            runbook: 'docs/runbooks/api-recovery.md',
             signal: 'metric',
             statistic: 'Sum',
             threshold: 1,
@@ -831,7 +766,6 @@ function deployedAlarmResources(name, sql) {
             ],
             name: `${name}-{stage}-retention-job-failure`,
             namespace: 'AWS/States',
-            runbook: 'docs/runbooks/database-recovery.md',
             signal: 'metric-math',
             threshold: 1,
             treatMissingData: 'notBreaching',
@@ -848,7 +782,6 @@ function deployedAlarmResources(name, sql) {
             name: `${name}-{stage}-event-dlq-depth`,
             namespace: 'AWS/SQS',
             period: 300,
-            runbook: 'docs/runbooks/async-recovery.md',
             signal: 'metric',
             statistic: 'Maximum',
             threshold: 1,
@@ -866,7 +799,6 @@ function deployedAlarmResources(name, sql) {
             name: `${name}-{stage}-provider-dlq-depth`,
             namespace: 'AWS/SQS',
             period: 300,
-            runbook: 'docs/runbooks/async-recovery.md',
             signal: 'metric',
             statistic: 'Maximum',
             threshold: 1,
@@ -884,7 +816,6 @@ function deployedAlarmResources(name, sql) {
             name: `${name}-{stage}-async-target-dlq-depth`,
             namespace: 'AWS/SQS',
             period: 300,
-            runbook: 'docs/runbooks/async-recovery.md',
             signal: 'metric',
             statistic: 'Maximum',
             threshold: 1,
@@ -899,7 +830,6 @@ function deployedAlarmResources(name, sql) {
             name: `${name}-{stage}-outbox-relay-errors`,
             namespace: 'AWS/Lambda',
             period: 300,
-            runbook: 'docs/runbooks/async-recovery.md',
             signal: 'metric',
             statistic: 'Sum',
             threshold: 1,
@@ -914,7 +844,6 @@ function deployedAlarmResources(name, sql) {
             name: `${name}-{stage}-inbox-cleanup-errors`,
             namespace: 'AWS/Lambda',
             period: 300,
-            runbook: 'docs/runbooks/async-recovery.md',
             signal: 'metric',
             statistic: 'Sum',
             threshold: 1,
@@ -929,7 +858,6 @@ function deployedAlarmResources(name, sql) {
             name: `${name}-{stage}-key-value-stream-delivery-errors`,
             namespace: 'AWS/Lambda',
             period: 300,
-            runbook: 'docs/runbooks/async-recovery.md',
             signal: 'metric',
             statistic: 'Sum',
             threshold: 1,
@@ -944,7 +872,6 @@ function deployedAlarmResources(name, sql) {
             name: `${name}-{stage}-key-value-stream-iterator-age`,
             namespace: 'AWS/Lambda',
             period: 300,
-            runbook: 'docs/runbooks/async-recovery.md',
             signal: 'metric',
             statistic: 'Maximum',
             threshold: 600_000,
@@ -959,7 +886,6 @@ function deployedAlarmResources(name, sql) {
             name: `${name}-{stage}-key-value-reconciliation-errors`,
             namespace: 'AWS/Lambda',
             period: 300,
-            runbook: 'docs/runbooks/async-recovery.md',
             signal: 'metric',
             statistic: 'Sum',
             threshold: 1,
@@ -975,7 +901,6 @@ function deployedAlarmResources(name, sql) {
             name: `${name}-{stage}-outbox-backlog`,
             namespace: 'EBK/Async',
             period: 3600,
-            runbook: 'docs/runbooks/async-recovery.md',
             signal: 'metric',
             statistic: 'Maximum',
             threshold: 1,
@@ -991,7 +916,6 @@ function deployedAlarmResources(name, sql) {
             name: `${name}-{stage}-event-intent-rejected`,
             namespace: 'EBK/Async',
             period: 3600,
-            runbook: 'docs/runbooks/async-recovery.md',
             signal: 'metric',
             statistic: 'Maximum',
             threshold: 1,
@@ -1007,7 +931,6 @@ function deployedAlarmResources(name, sql) {
             name: `${name}-{stage}-event-delivery-attempts`,
             namespace: 'EBK/Async',
             period: 3600,
-            runbook: 'docs/runbooks/async-recovery.md',
             signal: 'metric',
             statistic: 'Maximum',
             threshold: 10,
@@ -1024,7 +947,6 @@ function deployedAlarmResources(name, sql) {
                     name: `${name}-{stage}-sql-outbox-relay-errors`,
                     namespace: 'AWS/Lambda',
                     period: 300,
-                    runbook: 'docs/runbooks/async-recovery.md',
                     signal: 'metric',
                     statistic: 'Sum',
                     threshold: 1,
@@ -1040,7 +962,6 @@ function deployedAlarmResources(name, sql) {
                     name: `${name}-{stage}-sql-outbox-backlog`,
                     namespace: 'EBK/Async',
                     period: 3600,
-                    runbook: 'docs/runbooks/async-recovery.md',
                     signal: 'metric',
                     statistic: 'Minimum',
                     threshold: 1,
@@ -1056,7 +977,6 @@ function deployedAlarmResources(name, sql) {
                     name: `${name}-{stage}-sql-outbox-attempts`,
                     namespace: 'EBK/Async',
                     period: 3600,
-                    runbook: 'docs/runbooks/async-recovery.md',
                     signal: 'metric',
                     statistic: 'Maximum',
                     threshold: 10,
@@ -1080,7 +1000,6 @@ function deployedAlarmResources(name, sql) {
             name: `${name}-{stage}-inbox-cleanup-backlog`,
             namespace: 'EBK/Async',
             period: 3600,
-            runbook: 'docs/runbooks/async-recovery.md',
             signal: 'metric',
             statistic: 'Maximum',
             threshold: 1,
@@ -1095,22 +1014,21 @@ function deployedAlarmResources(name, sql) {
             metricName: 'NumberOfNotificationsFailed',
             name: `${name}-{stage}-alert-delivery-degraded`,
             namespace: 'AWS/SNS',
-            owner: `${name}-product`,
             period: 300,
-            route: `${name}-on-call`,
-            runbook: 'docs/runbooks/alert-delivery.md',
             signal: 'metric',
             statistic: 'Sum',
             threshold: 1,
             treatMissingData: 'notBreaching',
         },
     ];
+    return resources.map((resource) => inventoryAlarmResource(name, resource));
 }
 /** @internal */
 function renderProductReliabilityFiles(name, pascalName, reviewedAt, sql = false) {
     const contract = reliabilityContract(name, reviewedAt);
     const alarms = alarmRegistrations(name, sql);
     const exercises = reliabilityExercises(name);
+    const ownership = (0, built_in_plan_alarm_identity_js_1.sliceAlarmOwnership)(name);
     return {
         'docs/reliability/slo.json': (0, built_in_plan_shared_js_1.json)(contract),
         'docs/reliability/exclusions.md': `# SLO exclusions
@@ -1257,10 +1175,20 @@ import declaration from '../docs/reliability/slo.json';
 export const Reliability = validateReliabilityContract(declaration);
 `,
         'reliability/metrics.ts': `import {
+  createEmfMetricRecord,
   createMetricEmitter,
+  createMetricRejectionReporter,
+  type BatchedMetricEmitter,
+  type EmfMetricObservation,
+  type MetricDimensions,
   type MetricEmitter,
+  type MetricEmitterOptions,
   type MetricOutcome,
 } from '@empire-builder-kit/runtime/observability';
+import {
+  reliabilityMetricDeclarations,
+  type ReliabilityMetricDeclaration,
+} from './metric-declarations.js';
 
 export interface ReliabilityOperation {
   component: string;
@@ -1271,37 +1199,146 @@ export interface ReliabilityOperation {
   outcome: MetricOutcome;
 }
 
+// Managed core declarations grow with generated callers on upgrade. Adopter
+// declarations stay in the seeded extension file, never in request input.
+const coreMetricDeclarations: readonly ReliabilityMetricDeclaration[] = [
+  { component: 'next-server', feature: 'web', operation: 'request' },
+];
+const metricDeclarations: readonly ReliabilityMetricDeclaration[] = Object.freeze(
+  [...coreMetricDeclarations, ...reliabilityMetricDeclarations].map((entry) =>
+    Object.freeze({ ...entry }),
+  ),
+);
+// Deployment identity is fixed when the Lambda/Next module starts, not per request.
+const reliabilityStage = process.env.EBK_STAGE ?? 'development';
+
+export function createReliabilityMetricEmitter(
+  options: Omit<MetricEmitterOptions, 'cardinalityPolicy'> = {},
+): BatchedMetricEmitter {
+  const values = (dimension: keyof ReliabilityMetricDeclaration) =>
+    [...new Set(metricDeclarations.map((entry) => entry[dimension]))];
+  const reportRejected = createMetricRejectionReporter(options.onRejected);
+  const emitter = createMetricEmitter({
+    ...options,
+    onRejected: reportRejected,
+    cardinalityPolicy: {
+      dimensions: {
+        component: values('component'),
+        feature: values('feature'),
+        operation: values('operation'),
+        slice: ['${name}'],
+        stage: [reliabilityStage],
+      },
+      metricNames: ['OperationValid', 'OperationGood', 'OperationDuration'],
+    },
+  });
+  // A declaration owns one tuple, not every Cartesian combination of its labels.
+  const tupleKey = (dimensions: MetricDimensions | undefined) => {
+    const labels = [dimensions?.component, dimensions?.feature, dimensions?.operation];
+    return labels.every((label) => typeof label === 'string')
+      ? JSON.stringify(labels.map((label) => label.trim()))
+      : undefined;
+  };
+  const declaredTuples = new Set(metricDeclarations.map((entry) =>
+    tupleKey({ ...entry, slice: '${name}', stage: reliabilityStage }),
+  ));
+  return {
+    reportRejected,
+    emit(input) {
+      if (!declaredTuples.has(tupleKey(input?.dimensions))) {
+        reportRejected('undeclared-tuple');
+        return undefined;
+      }
+      return emitter.emit(input);
+    },
+    emitBatch(input) {
+      if (!declaredTuples.has(tupleKey(input?.dimensions))) {
+        reportRejected('undeclared-tuple');
+        return undefined;
+      }
+      return emitter.emitBatch(input);
+    },
+  };
+}
+
+// Invalid declarations fail closed during module initialization and prevent
+// startup. After successful initialization, emission failures stay observational.
+const defaultReliabilityMetricEmitter = createReliabilityMetricEmitter();
+
 export function recordReliabilityOperation(
   input: ReliabilityOperation,
-  metrics: MetricEmitter = createMetricEmitter(),
+  metrics: MetricEmitter = defaultReliabilityMetricEmitter,
 ) {
   const dimensions = {
     component: input.component,
     feature: input.feature,
     operation: input.operation,
     slice: '${name}',
-    stage: process.env.EBK_STAGE ?? 'development',
+    stage: reliabilityStage,
   };
-  const valid = metrics.emit({
-    dimensions,
-    metricName: 'OperationValid',
-    unit: 'Count',
-    value: 1,
-  });
-  const good = metrics.emit({
-    dimensions,
+  const validObservation = {
+    metricName: 'OperationValid', unit: 'Count', value: 1,
+  } as const;
+  const goodObservation = {
     metricName: 'OperationGood',
     unit: 'Count',
     value: (input.good ?? input.outcome === 'success') ? 1 : 0,
-  });
-  const latency = metrics.emit({
-    dimensions,
-    metricName: 'OperationDuration',
-    unit: 'Milliseconds',
-    value: input.durationMilliseconds,
-  });
+  } as const;
+  const latencyObservation = Number.isFinite(input.durationMilliseconds)
+    ? {
+        metricName: 'OperationDuration',
+        unit: 'Milliseconds',
+        value: input.durationMilliseconds,
+      } as const
+    : undefined;
+  if (!latencyObservation) {
+    try {
+      const reportRejected = metrics.reportRejected ?? defaultReliabilityMetricEmitter.reportRejected;
+      reportRejected?.('invalid-observation');
+    } catch {
+      // Custom diagnostic adapters cannot turn completed work into a failed response.
+    }
+  }
+  const observations: readonly EmfMetricObservation[] = [
+    validObservation,
+    goodObservation,
+    ...(latencyObservation ? [latencyObservation] : []),
+  ];
+  if (metrics.emitBatch) {
+    const batch = metrics.emitBatch({ dimensions, metrics: observations });
+    // Keep the public per-metric result records while delivering one envelope.
+    const result = (observation: EmfMetricObservation | undefined) =>
+      batch && observation && createEmfMetricRecord({
+        ...observation,
+        dimensions,
+        now: () => new Date(batch._aws.Timestamp),
+      });
+    return {
+      good: result(goodObservation),
+      latency: result(latencyObservation),
+      valid: result(validObservation),
+    };
+  }
+  // Existing custom emit-only adapters retain one call per valid observation.
+  const valid = metrics.emit({ ...validObservation, dimensions });
+  const good = metrics.emit({ ...goodObservation, dimensions });
+  const latency = latencyObservation &&
+    metrics.emit({ ...latencyObservation, dimensions });
   return { good, latency, valid };
 }
+`,
+        'reliability/metric-declarations.ts': `import type {
+  MetricDimensions,
+} from '@empire-builder-kit/runtime/observability';
+
+export type ReliabilityMetricDeclaration = Required<
+  Pick<MetricDimensions, 'component' | 'feature' | 'operation'>
+>;
+
+// Seeded extension: declare finite deployment-owned labels for custom features.
+// Never derive declarations from request, user, resource, or correlation IDs.
+// Generated core declarations are added separately by the managed recorder.
+export const reliabilityMetricDeclarations: readonly ReliabilityMetricDeclaration[] = [];
 `,
         'infra/reliability.ts': `import {
   createSloBurnAlarmPlan,
@@ -1320,15 +1357,13 @@ ${'  databaseTableName: any;\n'}\
 function alarmDescription(input: {
   businessSymptom: string;
   id: string;
-  owner: string;
-  route: string;
   runbook: string;
 }) {
   return JSON.stringify({
     businessSymptom: input.businessSymptom,
     id: input.id,
-    owner: input.owner,
-    route: input.route,
+    owner: '${ownership.owner}',
+    route: '${ownership.route}',
     runbook: input.runbook,
     schemaVersion: 1,
     slice: '${name}',
@@ -1386,13 +1421,7 @@ export function create${pascalName}Reliability(
     '${pascalName}ApiFastBurn',
     {
       alarmActions: [input.alertTopicArn],
-      alarmDescription: alarmDescription({
-        businessSymptom: 'Critical API operations are failing.',
-        id: 'api-fast-burn',
-        owner: '${name}-product',
-        route: '${name}-on-call',
-        runbook: 'docs/runbooks/api-recovery.md',
-      }),
+      alarmDescription: alarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'api-fast-burn', '      ')}),
       comparisonOperator: 'GreaterThanOrEqualToThreshold',
       datapointsToAlarm: 1,
       evaluationPeriods: 1,
@@ -1406,13 +1435,7 @@ export function create${pascalName}Reliability(
     '${pascalName}ApiSlowBurn',
     {
       alarmActions: [input.alertTopicArn],
-      alarmDescription: alarmDescription({
-        businessSymptom: 'Critical API operations have sustained failures.',
-        id: 'api-slow-burn',
-        owner: '${name}-product',
-        route: '${name}-on-call',
-        runbook: 'docs/runbooks/api-recovery.md',
-      }),
+      alarmDescription: alarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'api-slow-burn', '      ')}),
       comparisonOperator: 'GreaterThanOrEqualToThreshold',
       datapointsToAlarm: 1,
       evaluationPeriods: 1,
@@ -1426,13 +1449,7 @@ export function create${pascalName}Reliability(
     '${pascalName}WebLatencyBurn',
     {
       alarmActions: [input.alertTopicArn],
-      alarmDescription: alarmDescription({
-        businessSymptom: 'Server-rendered routes exceed the latency objective.',
-        id: 'web-latency-fast-burn',
-        owner: '${name}-product',
-        route: '${name}-on-call',
-        runbook: 'docs/runbooks/web-recovery.md',
-      }),
+      alarmDescription: alarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'web-latency-fast-burn', '      ')}),
       comparisonOperator: 'GreaterThanOrEqualToThreshold',
       datapointsToAlarm: 1,
       evaluationPeriods: 1,
@@ -1446,13 +1463,7 @@ export function create${pascalName}Reliability(
     '${pascalName}WebLatencySlowBurn',
     {
       alarmActions: [input.alertTopicArn],
-      alarmDescription: alarmDescription({
-        businessSymptom: 'Server-rendered routes have sustained latency degradation.',
-        id: 'web-latency-slow-burn',
-        owner: '${name}-product',
-        route: '${name}-on-call',
-        runbook: 'docs/runbooks/web-recovery.md',
-      }),
+      alarmDescription: alarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'web-latency-slow-burn', '      ')}),
       comparisonOperator: 'GreaterThanOrEqualToThreshold',
       datapointsToAlarm: 1,
       evaluationPeriods: 1,
@@ -1466,13 +1477,7 @@ export function create${pascalName}Reliability(
     '${pascalName}ProviderDeadline',
     {
       alarmActions: [input.alertTopicArn],
-      alarmDescription: alarmDescription({
-        businessSymptom: 'Accepted provider work is missing its deadline.',
-        id: 'provider-queue-age',
-        owner: '${name}-product',
-        route: '${name}-on-call',
-        runbook: 'docs/runbooks/async-recovery.md',
-      }),
+      alarmDescription: alarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'provider-queue-age', '      ')}),
       comparisonOperator: 'GreaterThanOrEqualToThreshold',
       dimensions: { QueueName: input.providerQueueName },
       evaluationPeriods: 2,
@@ -1489,13 +1494,7 @@ export function create${pascalName}Reliability(
     '${pascalName}DatabaseCapacity',
     {
       alarmActions: [input.alertTopicArn],
-      alarmDescription: alarmDescription({
-        businessSymptom: ${JSON.stringify('The Slice table or event-reconciliation index is throttling operations.')},
-        id: 'database-capacity',
-        owner: '${name}-product',
-        route: '${name}-on-call',
-        runbook: 'docs/runbooks/database-recovery.md',
-      }),
+      alarmDescription: alarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'database-capacity', '      ')}),
       comparisonOperator: 'GreaterThanOrEqualToThreshold',
 ${`      evaluationPeriods: 1,
       name: '${name}-' + $app.stage + '-database-capacity',
@@ -1522,14 +1521,7 @@ ${`      evaluationPeriods: 1,
     '${pascalName}FunctionFailure',
     {
       alarmActions: [input.alertTopicArn],
-      alarmDescription: alarmDescription({
-        businessSymptom:
-          'The generated confidential-export cleanup Function has a terminal invocation error.',
-        id: 'function-failure',
-        owner: '${name}-product',
-        route: '${name}-on-call',
-        runbook: 'docs/runbooks/api-recovery.md',
-      }),
+      alarmDescription: alarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'function-failure', '      ')}),
       comparisonOperator: 'GreaterThanOrEqualToThreshold',
       dimensions: { FunctionName: input.functionName },
       evaluationPeriods: 1,
@@ -1545,13 +1537,7 @@ ${`      evaluationPeriods: 1,
   const alertDelivery = new aws.cloudwatch.MetricAlarm(
     '${pascalName}AlertDelivery',
     {
-      alarmDescription: alarmDescription({
-        businessSymptom: 'The primary alert route is failing delivery.',
-        id: 'alert-delivery-degraded',
-        owner: '${name}-product',
-        route: '${name}-on-call',
-        runbook: 'docs/runbooks/alert-delivery.md',
-      }),
+      alarmDescription: alarmDescription(${(0, built_in_plan_alarm_identity_js_1.renderSliceAlarmDescriptionInput)(name, 'alert-delivery-degraded', '      ')}),
       comparisonOperator: 'GreaterThanOrEqualToThreshold',
       dimensions: { TopicName: input.alertTopicName },
       evaluationPeriods: 1,