{
  "version": "5.0.0",
  "name": "Roberto Enterprise Cloud Architecture",
  "summary": "Terraform + Pulumi + Moby + Kubernetes + Helm + Argo CD enterprise blueprint",
  "nodes": [
    {
      "id": "git",
      "title": "Git Repository",
      "subtitle": "Desired state",
      "layer": "iac",
      "x": 50,
      "y": 75,
      "w": 165,
      "h": 78,
      "description": "Versioned infrastructure, chart values, application manifests, policies, and runbooks.",
      "facts": {
        "Owner": "Platform Engineering",
        "Control": "Protected branches",
        "Evidence": "Commit + review history"
      },
      "file": "/.github/workflows/validate-cloud.yml"
    },
    {
      "id": "terraform",
      "title": "Terraform",
      "subtitle": "Cloud foundation",
      "layer": "iac",
      "x": 280,
      "y": 35,
      "w": 170,
      "h": 82,
      "description": "Builds and versions the cloud network, encryption, managed cluster, node pools, and backup resources.",
      "facts": {
        "Workflow": "Write → Plan → Apply",
        "State": "Remote + encrypted",
        "Scope": "Cloud foundation"
      },
      "file": "/blueprints/terraform/aws/main.tf"
    },
    {
      "id": "pulumi",
      "title": "Pulumi",
      "subtitle": "Multi-language",
      "layer": "iac",
      "x": 280,
      "y": 145,
      "w": 170,
      "h": 82,
      "description": "Provides TypeScript, Python, Go, and .NET deployment programs for the same workload contract.",
      "facts": {
        "Languages": "TypeScript, Python, Go, C#",
        "Mode": "Preview + update",
        "Scope": "Application infrastructure"
      },
      "file": "/blueprints/pulumi/typescript/index.ts"
    },
    {
      "id": "registry",
      "title": "Container Registry",
      "subtitle": "Signed artifacts",
      "layer": "runtime",
      "x": 510,
      "y": 35,
      "w": 170,
      "h": 82,
      "description": "Stores immutable Moby-built container images, metadata, SBOMs, and signatures.",
      "facts": {
        "Image": "Multi-stage",
        "Tag": "Commit SHA",
        "Policy": "Scan before promotion"
      },
      "file": "/blueprints/container/Dockerfile"
    },
    {
      "id": "helm",
      "title": "Helm Release",
      "subtitle": "Package + values",
      "layer": "runtime",
      "x": 510,
      "y": 145,
      "w": 170,
      "h": 82,
      "description": "Packages Kubernetes objects and environment-specific values into a repeatable release.",
      "facts": {
        "Chart": "cloud-command",
        "Values": "dev/staging/prod",
        "Rollback": "Revision history"
      },
      "file": "/blueprints/helm/cloud-command/Chart.yaml"
    },
    {
      "id": "argocd",
      "title": "Argo CD",
      "subtitle": "GitOps reconciler",
      "layer": "runtime",
      "x": 745,
      "y": 90,
      "w": 170,
      "h": 82,
      "description": "Continuously compares Git desired state with Kubernetes and applies controlled automated synchronization.",
      "facts": {
        "Sync": "Automated + prune",
        "Drift": "Self-heal",
        "Boundary": "AppProject"
      },
      "file": "/blueprints/argocd/application.yaml"
    },
    {
      "id": "gateway",
      "title": "Gateway / Ingress",
      "subtitle": "TLS edge",
      "layer": "network",
      "x": 75,
      "y": 310,
      "w": 170,
      "h": 82,
      "description": "Terminates TLS, routes traffic, and exposes only approved services.",
      "facts": {
        "Exposure": "Public edge only",
        "TLS": "Required",
        "Routing": "Host + path"
      },
      "file": "/blueprints/kubernetes/base/ingress.yaml"
    },
    {
      "id": "cluster",
      "title": "Kubernetes Cluster",
      "subtitle": "Three zones",
      "layer": "runtime",
      "x": 325,
      "y": 285,
      "w": 205,
      "h": 110,
      "description": "Runs containerized workloads across three availability zones with declarative controllers.",
      "facts": {
        "Zones": "3",
        "Base replicas": "3",
        "HPA": "3–12"
      },
      "file": "/blueprints/kubernetes/base/deployment.yaml"
    },
    {
      "id": "data",
      "title": "Managed Data",
      "subtitle": "Private subnet",
      "layer": "dr",
      "x": 610,
      "y": 310,
      "w": 170,
      "h": 82,
      "description": "Encrypted managed database and object backups remain isolated from direct public access.",
      "facts": {
        "Encryption": "KMS at rest",
        "Backup": "Point-in-time + snapshots",
        "Access": "Application identity"
      },
      "file": "/blueprints/terraform/aws/main.tf"
    },
    {
      "id": "observe",
      "title": "Observability",
      "subtitle": "Metrics logs traces",
      "layer": "observe",
      "x": 855,
      "y": 310,
      "w": 180,
      "h": 82,
      "description": "OpenTelemetry, Prometheus rules, and Grafana views provide operational evidence and SLO alerts.",
      "facts": {
        "Signals": "Metrics, logs, traces",
        "SLO": "99.9%",
        "Alerts": "Burn rate + saturation"
      },
      "file": "/blueprints/monitoring/otel-collector.yaml"
    },
    {
      "id": "security",
      "title": "Security Controls",
      "subtitle": "RBAC + policies",
      "layer": "security",
      "x": 325,
      "y": 500,
      "w": 205,
      "h": 90,
      "description": "Default-deny networking, restricted Pod Security, least-privilege RBAC, and encrypted secrets reduce attack paths.",
      "facts": {
        "Network": "Default deny",
        "Pod Security": "Restricted",
        "Identity": "Least privilege"
      },
      "file": "/blueprints/security/security-controls.yaml"
    },
    {
      "id": "backup",
      "title": "Recovery Vault",
      "subtitle": "Cross-region",
      "layer": "dr",
      "x": 610,
      "y": 500,
      "w": 180,
      "h": 90,
      "description": "Encrypted, verified backups and restore drills support regional recovery objectives.",
      "facts": {
        "Database RPO": "15 minutes",
        "Region RTO": "4 hours",
        "Validation": "Scheduled drill"
      },
      "file": "/blueprints/dr/restore-checklist.md"
    },
    {
      "id": "finops",
      "title": "FinOps Controls",
      "subtitle": "Cost guardrails",
      "layer": "observe",
      "x": 855,
      "y": 500,
      "w": 180,
      "h": 90,
      "description": "Resource labels, right-sizing, scaling windows, and ownership reports keep spending accountable.",
      "facts": {
        "Labels": "Owner + cost center",
        "Review": "Weekly",
        "Model": "Assumption-based"
      },
      "file": "/blueprints/cost/assumptions.json"
    }
  ],
  "edges": [
    [
      "git",
      "terraform",
      "iac"
    ],
    [
      "git",
      "pulumi",
      "iac"
    ],
    [
      "git",
      "helm",
      "iac"
    ],
    [
      "git",
      "argocd",
      "iac"
    ],
    [
      "terraform",
      "cluster",
      "runtime"
    ],
    [
      "pulumi",
      "cluster",
      "runtime"
    ],
    [
      "registry",
      "cluster",
      "runtime"
    ],
    [
      "helm",
      "argocd",
      "runtime"
    ],
    [
      "argocd",
      "cluster",
      "runtime"
    ],
    [
      "gateway",
      "cluster",
      "network"
    ],
    [
      "cluster",
      "data",
      "dr"
    ],
    [
      "cluster",
      "observe",
      "observe"
    ],
    [
      "cluster",
      "security",
      "security"
    ],
    [
      "data",
      "backup",
      "dr"
    ],
    [
      "observe",
      "finops",
      "observe"
    ],
    [
      "security",
      "cluster",
      "security"
    ],
    [
      "backup",
      "cluster",
      "dr"
    ]
  ],
  "resources": [
    [
      "Infrastructure",
      "Terraform state + modules",
      "Multi-zone",
      "Encrypted remote state",
      "blueprints/terraform/aws"
    ],
    [
      "Deployment",
      "Pulumi programs",
      "Multi-language",
      "Secret outputs protected",
      "blueprints/pulumi"
    ],
    [
      "Container",
      "Moby/Docker image",
      "Immutable",
      "Non-root + read-only filesystem",
      "blueprints/container"
    ],
    [
      "Orchestration",
      "Kubernetes cluster",
      "3 zones",
      "RBAC + Pod Security",
      "blueprints/kubernetes/base"
    ],
    [
      "Packaging",
      "Helm chart",
      "Revision rollback",
      "Values separated by environment",
      "blueprints/helm/cloud-command"
    ],
    [
      "GitOps",
      "Argo CD apps",
      "Self-healing",
      "AppProject boundaries",
      "blueprints/argocd"
    ],
    [
      "Networking",
      "Gateway + NetworkPolicy",
      "Redundant ingress",
      "Default deny",
      "blueprints/kubernetes/base/network-policy.yaml"
    ],
    [
      "Observability",
      "OTel + Prometheus + Grafana",
      "Replicated collectors",
      "Scoped service accounts",
      "blueprints/monitoring"
    ],
    [
      "Disaster recovery",
      "Snapshots + restore runbook",
      "Cross-region",
      "Encrypted backup vault",
      "blueprints/dr"
    ],
    [
      "Cost optimization",
      "Labels + autoscaling model",
      "Capacity buffers",
      "Policy-based budgets",
      "blueprints/cost"
    ]
  ],
  "pipeline": [
    {
      "id": "source",
      "label": "SOURCE",
      "detail": "Review + signed commit",
      "command": "git verify-commit HEAD"
    },
    {
      "id": "validate",
      "label": "VALIDATE",
      "detail": "Terraform, Helm, manifests",
      "command": "terraform fmt -check && terraform validate"
    },
    {
      "id": "preview",
      "label": "PREVIEW",
      "detail": "Plan + Pulumi preview",
      "command": "terraform plan && pulumi preview"
    },
    {
      "id": "build",
      "label": "BUILD",
      "detail": "Moby container image",
      "command": "docker buildx build --provenance=true ."
    },
    {
      "id": "scan",
      "label": "VERIFY",
      "detail": "SBOM + policy gates",
      "command": "verify image signature and policy results"
    },
    {
      "id": "package",
      "label": "PACKAGE",
      "detail": "Helm chart release",
      "command": "helm lint && helm package"
    },
    {
      "id": "sync",
      "label": "GITOPS",
      "detail": "Argo CD reconcile",
      "command": "argocd app sync cloud-command"
    },
    {
      "id": "observe",
      "label": "OBSERVE",
      "detail": "SLO + rollout checks",
      "command": "kubectl rollout status deployment/cloud-command"
    }
  ]
}