{
  "architecture": {
    "version": "5.0.0",
    "name": "Roberto Enterprise Cloud Architecture",
    "summary": "Terraform + Pulumi + Moby + Kubernetes + Helm + Argo CD enterprise blueprint",
    "nodes": [
      {
        "id": "git",
        "title": "Git Repository",
        "subtitle": "Desired state",
        "layer": "iac",
        "x": 50,
        "y": 75,
        "w": 165,
        "h": 78,
        "description": "Versioned infrastructure, chart values, application manifests, policies, and runbooks.",
        "facts": {
          "Owner": "Platform Engineering",
          "Control": "Protected branches",
          "Evidence": "Commit + review history"
        },
        "file": "/.github/workflows/validate-cloud.yml"
      },
      {
        "id": "terraform",
        "title": "Terraform",
        "subtitle": "Cloud foundation",
        "layer": "iac",
        "x": 280,
        "y": 35,
        "w": 170,
        "h": 82,
        "description": "Builds and versions the cloud network, encryption, managed cluster, node pools, and backup resources.",
        "facts": {
          "Workflow": "Write → Plan → Apply",
          "State": "Remote + encrypted",
          "Scope": "Cloud foundation"
        },
        "file": "/blueprints/terraform/aws/main.tf"
      },
      {
        "id": "pulumi",
        "title": "Pulumi",
        "subtitle": "Multi-language",
        "layer": "iac",
        "x": 280,
        "y": 145,
        "w": 170,
        "h": 82,
        "description": "Provides TypeScript, Python, Go, and .NET deployment programs for the same workload contract.",
        "facts": {
          "Languages": "TypeScript, Python, Go, C#",
          "Mode": "Preview + update",
          "Scope": "Application infrastructure"
        },
        "file": "/blueprints/pulumi/typescript/index.ts"
      },
      {
        "id": "registry",
        "title": "Container Registry",
        "subtitle": "Signed artifacts",
        "layer": "runtime",
        "x": 510,
        "y": 35,
        "w": 170,
        "h": 82,
        "description": "Stores immutable Moby-built container images, metadata, SBOMs, and signatures.",
        "facts": {
          "Image": "Multi-stage",
          "Tag": "Commit SHA",
          "Policy": "Scan before promotion"
        },
        "file": "/blueprints/container/Dockerfile"
      },
      {
        "id": "helm",
        "title": "Helm Release",
        "subtitle": "Package + values",
        "layer": "runtime",
        "x": 510,
        "y": 145,
        "w": 170,
        "h": 82,
        "description": "Packages Kubernetes objects and environment-specific values into a repeatable release.",
        "facts": {
          "Chart": "cloud-command",
          "Values": "dev/staging/prod",
          "Rollback": "Revision history"
        },
        "file": "/blueprints/helm/cloud-command/Chart.yaml"
      },
      {
        "id": "argocd",
        "title": "Argo CD",
        "subtitle": "GitOps reconciler",
        "layer": "runtime",
        "x": 745,
        "y": 90,
        "w": 170,
        "h": 82,
        "description": "Continuously compares Git desired state with Kubernetes and applies controlled automated synchronization.",
        "facts": {
          "Sync": "Automated + prune",
          "Drift": "Self-heal",
          "Boundary": "AppProject"
        },
        "file": "/blueprints/argocd/application.yaml"
      },
      {
        "id": "gateway",
        "title": "Gateway / Ingress",
        "subtitle": "TLS edge",
        "layer": "network",
        "x": 75,
        "y": 310,
        "w": 170,
        "h": 82,
        "description": "Terminates TLS, routes traffic, and exposes only approved services.",
        "facts": {
          "Exposure": "Public edge only",
          "TLS": "Required",
          "Routing": "Host + path"
        },
        "file": "/blueprints/kubernetes/base/ingress.yaml"
      },
      {
        "id": "cluster",
        "title": "Kubernetes Cluster",
        "subtitle": "Three zones",
        "layer": "runtime",
        "x": 325,
        "y": 285,
        "w": 205,
        "h": 110,
        "description": "Runs containerized workloads across three availability zones with declarative controllers.",
        "facts": {
          "Zones": "3",
          "Base replicas": "3",
          "HPA": "3–12"
        },
        "file": "/blueprints/kubernetes/base/deployment.yaml"
      },
      {
        "id": "data",
        "title": "Managed Data",
        "subtitle": "Private subnet",
        "layer": "dr",
        "x": 610,
        "y": 310,
        "w": 170,
        "h": 82,
        "description": "Encrypted managed database and object backups remain isolated from direct public access.",
        "facts": {
          "Encryption": "KMS at rest",
          "Backup": "Point-in-time + snapshots",
          "Access": "Application identity"
        },
        "file": "/blueprints/terraform/aws/main.tf"
      },
      {
        "id": "observe",
        "title": "Observability",
        "subtitle": "Metrics logs traces",
        "layer": "observe",
        "x": 855,
        "y": 310,
        "w": 180,
        "h": 82,
        "description": "OpenTelemetry, Prometheus rules, and Grafana views provide operational evidence and SLO alerts.",
        "facts": {
          "Signals": "Metrics, logs, traces",
          "SLO": "99.9%",
          "Alerts": "Burn rate + saturation"
        },
        "file": "/blueprints/monitoring/otel-collector.yaml"
      },
      {
        "id": "security",
        "title": "Security Controls",
        "subtitle": "RBAC + policies",
        "layer": "security",
        "x": 325,
        "y": 500,
        "w": 205,
        "h": 90,
        "description": "Default-deny networking, restricted Pod Security, least-privilege RBAC, and encrypted secrets reduce attack paths.",
        "facts": {
          "Network": "Default deny",
          "Pod Security": "Restricted",
          "Identity": "Least privilege"
        },
        "file": "/blueprints/security/security-controls.yaml"
      },
      {
        "id": "backup",
        "title": "Recovery Vault",
        "subtitle": "Cross-region",
        "layer": "dr",
        "x": 610,
        "y": 500,
        "w": 180,
        "h": 90,
        "description": "Encrypted, verified backups and restore drills support regional recovery objectives.",
        "facts": {
          "Database RPO": "15 minutes",
          "Region RTO": "4 hours",
          "Validation": "Scheduled drill"
        },
        "file": "/blueprints/dr/restore-checklist.md"
      },
      {
        "id": "finops",
        "title": "FinOps Controls",
        "subtitle": "Cost guardrails",
        "layer": "observe",
        "x": 855,
        "y": 500,
        "w": 180,
        "h": 90,
        "description": "Resource labels, right-sizing, scaling windows, and ownership reports keep spending accountable.",
        "facts": {
          "Labels": "Owner + cost center",
          "Review": "Weekly",
          "Model": "Assumption-based"
        },
        "file": "/blueprints/cost/assumptions.json"
      }
    ],
    "edges": [
      [
        "git",
        "terraform",
        "iac"
      ],
      [
        "git",
        "pulumi",
        "iac"
      ],
      [
        "git",
        "helm",
        "iac"
      ],
      [
        "git",
        "argocd",
        "iac"
      ],
      [
        "terraform",
        "cluster",
        "runtime"
      ],
      [
        "pulumi",
        "cluster",
        "runtime"
      ],
      [
        "registry",
        "cluster",
        "runtime"
      ],
      [
        "helm",
        "argocd",
        "runtime"
      ],
      [
        "argocd",
        "cluster",
        "runtime"
      ],
      [
        "gateway",
        "cluster",
        "network"
      ],
      [
        "cluster",
        "data",
        "dr"
      ],
      [
        "cluster",
        "observe",
        "observe"
      ],
      [
        "cluster",
        "security",
        "security"
      ],
      [
        "data",
        "backup",
        "dr"
      ],
      [
        "observe",
        "finops",
        "observe"
      ],
      [
        "security",
        "cluster",
        "security"
      ],
      [
        "backup",
        "cluster",
        "dr"
      ]
    ],
    "resources": [
      [
        "Infrastructure",
        "Terraform state + modules",
        "Multi-zone",
        "Encrypted remote state",
        "blueprints/terraform/aws"
      ],
      [
        "Deployment",
        "Pulumi programs",
        "Multi-language",
        "Secret outputs protected",
        "blueprints/pulumi"
      ],
      [
        "Container",
        "Moby/Docker image",
        "Immutable",
        "Non-root + read-only filesystem",
        "blueprints/container"
      ],
      [
        "Orchestration",
        "Kubernetes cluster",
        "3 zones",
        "RBAC + Pod Security",
        "blueprints/kubernetes/base"
      ],
      [
        "Packaging",
        "Helm chart",
        "Revision rollback",
        "Values separated by environment",
        "blueprints/helm/cloud-command"
      ],
      [
        "GitOps",
        "Argo CD apps",
        "Self-healing",
        "AppProject boundaries",
        "blueprints/argocd"
      ],
      [
        "Networking",
        "Gateway + NetworkPolicy",
        "Redundant ingress",
        "Default deny",
        "blueprints/kubernetes/base/network-policy.yaml"
      ],
      [
        "Observability",
        "OTel + Prometheus + Grafana",
        "Replicated collectors",
        "Scoped service accounts",
        "blueprints/monitoring"
      ],
      [
        "Disaster recovery",
        "Snapshots + restore runbook",
        "Cross-region",
        "Encrypted backup vault",
        "blueprints/dr"
      ],
      [
        "Cost optimization",
        "Labels + autoscaling model",
        "Capacity buffers",
        "Policy-based budgets",
        "blueprints/cost"
      ]
    ],
    "pipeline": [
      {
        "id": "source",
        "label": "SOURCE",
        "detail": "Review + signed commit",
        "command": "git verify-commit HEAD"
      },
      {
        "id": "validate",
        "label": "VALIDATE",
        "detail": "Terraform, Helm, manifests",
        "command": "terraform fmt -check && terraform validate"
      },
      {
        "id": "preview",
        "label": "PREVIEW",
        "detail": "Plan + Pulumi preview",
        "command": "terraform plan && pulumi preview"
      },
      {
        "id": "build",
        "label": "BUILD",
        "detail": "Moby container image",
        "command": "docker buildx build --provenance=true ."
      },
      {
        "id": "scan",
        "label": "VERIFY",
        "detail": "SBOM + policy gates",
        "command": "verify image signature and policy results"
      },
      {
        "id": "package",
        "label": "PACKAGE",
        "detail": "Helm chart release",
        "command": "helm lint && helm package"
      },
      {
        "id": "sync",
        "label": "GITOPS",
        "detail": "Argo CD reconcile",
        "command": "argocd app sync cloud-command"
      },
      {
        "id": "observe",
        "label": "OBSERVE",
        "detail": "SLO + rollout checks",
        "command": "kubectl rollout status deployment/cloud-command"
      }
    ]
  },
  "costDefaults": {
    "currency": "USD",
    "disclaimer": "Editable reference assumptions; not live provider pricing.",
    "nodes": 6,
    "nodeMonthly": 92,
    "databaseMonthly": 180,
    "networkAndStorageMonthly": 120
  },
  "pipeline": [
    {
      "id": "source",
      "label": "SOURCE",
      "detail": "Review + signed commit",
      "command": "git verify-commit HEAD"
    },
    {
      "id": "validate",
      "label": "VALIDATE",
      "detail": "Terraform, Helm, manifests",
      "command": "terraform fmt -check && terraform validate"
    },
    {
      "id": "preview",
      "label": "PREVIEW",
      "detail": "Plan + Pulumi preview",
      "command": "terraform plan && pulumi preview"
    },
    {
      "id": "build",
      "label": "BUILD",
      "detail": "Moby container image",
      "command": "docker buildx build --provenance=true ."
    },
    {
      "id": "scan",
      "label": "VERIFY",
      "detail": "SBOM + policy gates",
      "command": "verify image signature and policy results"
    },
    {
      "id": "package",
      "label": "PACKAGE",
      "detail": "Helm chart release",
      "command": "helm lint && helm package"
    },
    {
      "id": "sync",
      "label": "GITOPS",
      "detail": "Argo CD reconcile",
      "command": "argocd app sync cloud-command"
    },
    {
      "id": "observe",
      "label": "OBSERVE",
      "detail": "SLO + rollout checks",
      "command": "kubectl rollout status deployment/cloud-command"
    }
  ],
  "sources": [
    {
      "name": "Terraform",
      "archive": "terraform-main (1).zip",
      "root": "terraform-main",
      "sizeBytes": 8919584,
      "sha256": "e2f818949a8c68139f68b01007f7d8ef59e0820b81a5b2f2a85e5f720727d634",
      "snapshotCommit": "116d525a7242c2beb916f00ccb39ce070f4fac05",
      "files": 5464,
      "role": "Declarative infrastructure lifecycle and state"
    },
    {
      "name": "Kubernetes Dashboard",
      "archive": "dashboard-master.zip",
      "root": "dashboard-master",
      "sizeBytes": 23829809,
      "sha256": "fbd6b6837163da03821c61fd3f864987add372e8197d1d0a9b9c45685290400b",
      "snapshotCommit": "0ba796d9b85f7070dbd4a5c88354fc79f88763bb",
      "files": 1243,
      "role": "Archived dashboard source snapshot retained for study only"
    },
    {
      "name": "Kubernetes",
      "archive": "kubernetes-master (1).zip",
      "root": "kubernetes-master",
      "sizeBytes": 66498793,
      "sha256": "c02f21c6591d70ff67f79f43447d13176f855f7f133af9d5a0a20a0b37a2a7f4",
      "snapshotCommit": "c6d6dd6ef8dd78d63d42d39d9989045ca162c1d5",
      "files": 30830,
      "role": "Container orchestration control plane and workload APIs"
    },
    {
      "name": "Pulumi",
      "archive": "pulumi-master.zip",
      "root": "pulumi-master",
      "sizeBytes": 43719061,
      "sha256": "d565457aed3b67171ddf559c10032b60ea87f8d9a1726faadc70d54539f3db44",
      "snapshotCommit": "356079988074b8aa3c9c41300a428d96649c1e52",
      "files": 41925,
      "role": "Multi-language infrastructure deployment"
    },
    {
      "name": "Moby",
      "archive": "moby-master.zip",
      "root": "moby-master",
      "sizeBytes": 29326818,
      "sha256": "514555a7563087a1f65028bd12ce626170153bf67de145772f715cc20f6826cd",
      "snapshotCommit": "294d1355cd34ee50e94b1f463099a38333225218",
      "files": 12738,
      "role": "Container engine source foundation"
    }
  ]
}