This document
This document
version 1.3.0 · openapi.json · source · atlas-systems.uk
This is the versioned read surface of the Atlas Systems estate. It publishes the public repository and component topology, the live Worker registry, assurance evidence, semantic search over the estate corpus, and health telemetry from the machine that runs the local models. Runtime state and declared source inventory are separate on purpose: a public repository can exist without pretending to be a deployed service.
curl https://api.atlas-systems.uk/v1/topology
curl https://api.atlas-systems.uk/v1/registry
curl https://api.atlas-systems.uk/v1/search?q=tunnel
curl https://api.atlas-systems.uk/v1/evidence
This document
The canonical public estate map. Rich manifest components remain authoritative for runtime roles, layers, dependencies, routes, and health metadata. Public, non-archived Atlas repositories missing from the manifest are added as source-only repository components. Explicit exclusions such as simple-proxy are never exposed.
Every Worker in the estate with its self-declared /_meta document, rebuilt hourly by atlas-api-index and reshaped here into a stable public form.
Semantic search across the estate's own documentation (decisions, READMEs, case studies). Each request costs a real embedding on local hardware, so the anonymous limit is ten per minute per IP. Client IPs stop at the edge; the corpus never sees them.
q required, 500 chars max · top_k optional, min 1, max 10, default 5
Repository totals, nineteen component verdicts, and uptime measured from the ten-minute estate probe. The additive component_details map preserves healthy, degraded, down, and unknown with evidence source, measurement time, detail, and latency; the original boolean components map remains for compatibility. Uptime accrues from first deploy inside a rolling window rather than inventing history.
The raw per-day ok/total counters behind the uptime numbers, one probe pass every ten minutes, pruned past the rolling window. Successful probes also carry round-trip milliseconds (ms_sum, ms_count) so consumers can show a measured average latency. Targets are deliberately not here; they live with the status page, so tuning a target never touches this Worker.
The current verdict from the specular-sentinel pipeline: Ollama reachability, corpus health, the RAG search path end to end, and WSL2 IP drift. Staleness is recomputed at read time; a silent sentinel reads as down, not as its last good report.
Accepts observation reports from specular-sentinel. Bearer-authenticated; documented for completeness, not for public use.
Counts only, by design: aggregate numbers are safe to publish, fragments of visitor queries are not, and client IPs never entered the pipeline at all.
Accepts hourly query summaries from atlas-corpus. Bearer-authenticated; documented for completeness, not for public use.
Latest conformance and chaos evidence summaries, each tied to a producer timestamp, source commit, and content fingerprint.
Latest estate conformance report
history optional
Latest chaos assurance report
history optional
Conformance evidence ingest
Chaos evidence ingest
Error budgets, day-granular burn rates, coverage, and explicit states derived deterministically from the /v1/slo counters and the published policy. Services without approved objectives appear in the unmeasured list; missing, stale, malformed, or insufficient evidence is a stated condition, never health. The report is served with an explicit stale marker once past its freshness bound.
One service's derived reliability result
service_id required, 64 chars max
Targets, windows, and measurement sources from the canonical atlas-infra policy, plus the explicit unmeasured list. Targets are public presentation data already; no credential or evidence payload appears here.
An atlas-journey-watch/release-baseline/v1 document comparing the recent measurement window against the objective window, using average latency because per-day aggregates cannot support percentiles. Serves an honest 503 when evidence is insufficient, stale, or unavailable.
service_id required, 64 chars max
Reliability policy ingest
A shields-flat badge reading N/M operational across the estate's nineteen probed components. Sixty second cache; embeds cleanly in GitHub READMEs.
| Scope | Limit | Why |
|---|---|---|
| General, per IP | 60 / minute | Edge reads are cheap; this stops basic abuse |
/v1/search, per IP | 10 / minute | Every hit costs a real embedding on local hardware |
Counters are per Cloudflare colo, which is the documented tradeoff of a zero-dependency limiter at this scale. A 429 clears within a minute.
Every public GET endpoint sends access-control-allow-origin: *. The /v1 prefix is the response-shape contract. Additive endpoints and fields can ship within v1; breaking shape changes require /v2.