Engineering handoff · Northwind Ingestion

Take ownership without rediscovering the failure boundaries

This handoff gives the incoming owner the current runtime path, safe controls, in-flight decisions, and the first week of proof.

As of: 2026-08-18 From: Platform To: incoming owner Scope: gateway through warehouse landing

Current status in one minute

The production path still uses one queue, ingest, with no failover.
RFC 014 is proposed and not shipped; ADR 009 is accepted for its partition key.
The 2026-07-30 incident recovered through consumer scaling and remains the representative failure.
Release candidate sha-8132c3 is go-with-waivers for the current architecture.

Prove the local service before changing it

15 min

Run the committed test path
```
bashmake ingest-test
```
Success: gateway contract and consumer tests pass without production credentials.
Start the local gateway
```
bashmake ingest-run
```
Success: logs contain listening on port 8443.

Send one synthetic event

bashcurl -k https://127.0.0.1:8443/events \
  -d '{"id":"evt_handoff","type":"handoff.ping"}'

Success: response is 202 and repeats evt_handoff.

Where truth lives

owners

Behavior

`openapi/events.yaml`

Producer contract. It wins over the HTML companion.

Runtime

Deployment manifests

Replica counts, queue URI, health checks, and environment names.

Operations

Ingestion / lag

Lag, queue depth, request p99, shed count, and runbook link.

Tripwires and in-flight work

do not break

Do not claim the split path is live. The dispatcher, two queues, and INGEST_SHED response remain proposed.

Never change the event-ID idempotency rule without an API review.
Never delete a queue as rollback or incident mitigation.
Reliability owns approval of shed-versus-block behavior.
The catalog backfill is the explicit opportunity cost if RFC 014 is funded.

First-week checklist

proof

Run the local proof above.
Shadow one Platform on-call review and locate the escalation policy.
Read RFC 014, ADR 009, the API companion, and the latest postmortem in that order.
Reconcile the dashboard queue name with the deployment manifest.
Write down any access gap; do not place credentials in this document.

Handoff is complete when: the incoming owner can explain the current and proposed paths, run the local proof, identify the safe incident control, and name the two unresolved RFC decisions.