10. Quality scenarios, risks, and glossary

10.1 Quality scenarios

Shape now, numbers (the budgets) set during implementation — the same posture Wyrd takes. Each traces to a quality goal (section 1.3).

V1/V5/V6/V7/V9 attach in deterministic simulation; V2/V3/V4 are load/fault tests on real backends (V3/V4 under login-storm write load); V8 is the certification run (a credibility artifact like Wyrd's Jepsen result).

Provisional budget targets — order-of-magnitude anchors, explicitly provisional until M2 measurement: access-token TTL 5–15 minutes; status-list max-age, and with it the composed kill-now bound, single-digit minutes; JWKS cache staleness minutes-order; edge verification latency sub-millisecond local compute (excluding network); and the session-termination bound is the revocation bound. They exist to make V2 testable, not to preempt tuning: ADR-0039 owns the invariants between the budgets, and operators own the final numbers.

10.2 Risks

• Silent verification bugs — mitigated by Rust + DST + conformance vectors (ADR-0002, ADR-0003).
• Revocation-propagation latency — the hardest primitive; bounded, budgeted, instrumented (ADR-0005).
• SAML's front-channel statefulness leaking onto the hot path — closed by the seam (ADR-0017) and the V1 re-run.
• Re-monolithization gravity — the standing risk ADR-0001 names; mitigated by V1 and V7 as mechanical CI checks.
• KeyCustody as a new critical failure domain — KMS unavailability hits issuance only, not verification (ADR-0023, ADR-0008).
• SpiceDB-vs-OpenFGA timing — deferred behind the trait, decided at M3 under the ADR-0008 criteria.
• The write path, not verification, is the CIAM ceiling — issuance and grant writes are strongly-consistent and must be proved distributed under login-storm (V3/V4), or the scale claim is only half-true (ADR-0012).
• Two strongly-consistent domains — the Forseti store is a second domain with its own residency and fence; cross-domain read-your-writes uses the composite token, and the single-domain collapse (a Wyrd-backed store) is reserved (ADR-0026).
• The bearer-token validity window — a stolen access token is valid until expiry or the status-list refresh: the deliberate security cost of edge-statelessness, bounded by short TTL and DPoP-reserved (ADR-0005, ADR-0014).
• NATS outage — the urgent push is lost; the backstop is the status-list poll cadence, bounded by max-age (ADR-0005, ADR-0032).
• Status-list size at CIAM scale — edge cache and bandwidth grow with the realm; mitigated by per-realm list partitioning plus monitoring, with the numbers set at M8.
• Cold-edge warm-up during a core outage — fails closed by design; mitigated by projection mirrors / peer warm-up (ADR-0043).
• Wyrd substrate readiness — Tier 1 from M1 needs a runnable Wyrd metadata deployment, and M4 needs distributed Wyrd — a cross-project schedule coupling; hedged by the MetadataStore seam and single-process Wyrd first.
• The full adversarial view — assets, trust boundaries, the attack catalog, and abuse-case tests — is the threat model (§12, ADR-0027); this list is the engineering-risk view, not a substitute for it.

10.3 Glossary

• Vör — the verification plane (the goddess from whom nothing is concealed).
• Forseti — the authorization plane (the god whose judgments all accept).
• Troth — the credential primitive (a sworn pledge; SD-JWT VC).
• Móðguðr / Modgud — the admission/issuance plane (the bridge-warden who challenges every traveller for their name and business).
• Principal — the subject an identity is bound to; a stable internal id plus mutable external identifiers.
• Realm — an issuer boundary within a tenant; tenant — the shard, isolation, and residency boundary.
• The hot path — the verification path rule 1 governs; the core — the strongly-consistent store of the irreducible (rule 2).
• Edge-independence property — verification completes with the core unavailable.
• Consistency token (zookie) — opaque fence for read-your-writes (ADR-0004).
• Composite token — a consistency token carrying one fence per strongly-consistent domain it spans, composed conjunctively (ADR-0026).
• Status list — signed, edge-cached revocation projection (ADR-0005).
• Freshness budget — the stated bound within which a revocation or projection update is visible at every edge (ADR-0039).
• Projection — a derived, eventually-consistent read model (the CQRS sense) of authoritative state; the JWKS and the status list are the canonical ones (ADR-0022).
• Home zone — the region/zone holding a tenant's strongly-consistent authority; fenced reads route there when replicas lag.
• DST — deterministic simulation testing (madsim): seed-reproducible, single-threaded simulation of time, network, and fault (ADR-0028).
• Login ceremony — the interactive authentication-method exchange Modgud runs before a session exists (ADR-0015).
• Bounded staleness — the default read mode: eventually-consistent within a stated age bound, no fence presented.
• Distribution key — the dedicated key, distinct from token-signing keys, that signs every edge-consumed projection (ADR-0043).
• Refresh-token family — all rotations of one refresh grant; the browserless session anchor (ADR-0044).
• sid — the session-id claim every token carries; one sid-keyed status-list entry kills everything a session minted (ADR-0044).
• amr / acr — authentication-method / assurance claims carried in the token (ADR-0015).
• The seam — front-channel issuance (Modgud) versus edge verification (Vör).