Atlas

VECTOR archive › Governance stack › Atlas

Containment removes capacity from a system that was already under pressure. Something has to decide where the displaced work goes, and the naive answer — spread it evenly — is how a contained failure becomes a general one.

Historical context

Atlas exists because Aegis creates a problem it deliberately does not solve. Isolation is only safe if the work the isolated node was carrying lands somewhere that can absorb it. Without a rebalancing stage, containment displaces load blindly, and the most common outcome is a second isolation shortly afterwards.

Responsibilities

Atlas owns the distribution of work across available capacity, and the judgement of when redistribution is no longer sufficient.

Atlas never owns capacity itself. It does not create nodes, start containers or scale anything — it issues a recommendation that an autoscaler act, and the distinction is deliberate. Provisioning has costs and consequences outside the boundary of this system, and a protocol operating inside a real-time loop is the wrong place to commit to them.

Nor does Atlas decide which nodes are healthy. That determination arrives from Aegis and Sentinel; Atlas distributes across whatever it is told remains.

Inputs

Per-node load figures, the set of nodes still in service after containment, and the stress state from Serpentine.

Outputs

Load redistribution decisions, and an autoscaler activation recommendation when redistribution cannot reach an acceptable state.

Internal behaviour

Nodes above 80% load shed work to nodes below 50%, targeting 65% after the shift.

Three numbers, and the gap between them is the mechanism. Moving from 80% to a target of 65% leaves headroom rather than levelling everything to an identical figure — because a perfectly balanced system at high utilisation has no capacity to absorb the next event, and the next event is what the whole chain exists for.

The 50% ceiling on recipients prevents the obvious pathology: shifting work onto a node that was itself approaching the shedding threshold, producing a cascade of redistribution that does no useful work and consumes budget while conditions deteriorate.

When no recipient satisfies the constraint, Atlas does not relax it. It recommends autoscaling. The system is explicit that this is a capacity problem rather than a distribution problem, instead of pretending it solved something it did not — which is the behaviour a rebalancer with no floor would exhibit.

Interactions

Aegis → Atlas → Punisher

Atlas runs after containment and before repair. It works with the node set Aegis has left it, and its output changes the load figures that Sentinel will observe on the following cycle — which makes it one of the few protocols whose action is visible to the detection stage as a change in the system it is watching.

Failure modes

No valid recipient. Handled by design: the autoscaler recommendation is the defined outcome rather than an error. Atlas has done its job by correctly identifying that it cannot help.

Redistribution thrash. Work moved to a node that subsequently crosses the shedding threshold moves again. The 50%/65% gap makes this unlikely rather than impossible, and a system near saturation across all nodes is where it becomes plausible — which is exactly when the wasted movement is least affordable.

Stale load figures. Redistribution decided from measurements that have aged is redistribution against a system that no longer exists. The tighter Sentinel's budget, the fresher these are; this is one of the less visible benefits of the latency work.

Design tradeoffs

Deliberate under-utilisation. Targeting 65% rather than balancing to a uniform figure leaves capacity unused during normal operation. That is the cost of having somewhere to put the next surge, and it is paid continuously for a benefit that is only visible occasionally — the kind of tradeoff that is easy to argue away and expensive to have argued away.

Load is a proxy. Utilisation percentages do not distinguish a node doing hard work efficiently from one struggling with easy work. Atlas balances the number, not the reality behind it.

Recommendation rather than action. Deferring provisioning means the system can identify that it needs more capacity and be unable to obtain it. Accepted: a real-time loop should not be committing to resources whose consequences extend well beyond it.

Future evolution

Cost-aware placement — accounting for what a particular unit of work actually demands, rather than treating load as fungible — is the natural direction, and would need a richer signal than utilisation. Predictive rebalancing, shifting work ahead of a forecast surge rather than in response to a measured one, would connect Atlas to the intelligence layer, which it currently does not touch. Both are inference.