Shielda — Public Status Page

_Gate ID: G-2 / P3.3-A1 / P2.14a / PH-3 · Last reviewed: 2026-04-23._

Gate ID: G-2 / P3.3-A1 / P2.14a / PH-3 · Last reviewed: 2026-04-23.

What we ship

The Shielda public status page lives at https://shielda.io/status and is implemented at control-plane/src/app/(marketing)/status/page.tsx/status/page.tsx). It is:

Publicly reachable — lives in the (marketing) route group, bypasses auth middleware, and is served without cookies. Server-rendered with revalidate = 60 so the edge cache refreshes every minute. Accessible — WCAG AA (verified by the axe-playwright CI gate); the operational-dot has an sr-only companion label (Phase 4 a11y sweep). Machine-readable — /trust/incidents.json and /trust/sub-processors.json feed the same page; third parties (e.g. enterprise Customers) can poll them directly.

Components reported

The page groups into seven surfaces, each with independent state:

Component Source of truth --- --- Control plane API /api/healthz (edge) Auth0 Auth0 status feed (proxied) Database (RDS) internal health probe S3 evidence bucket internal probe Agent bearer auth synthetic request every 60 s LLM providers upstream status (Anthropic + OpenAI) Scheduler / workers queue-depth + heartbeat check

A component is reported Degraded when its probe p95 exceeds 5 × baseline and Outage when three consecutive probes fail.

Incident workflow

PagerDuty fires on any SEV-2+ alert → on-call creates an incident stub in incidents.json (appended via scripts/status-incident.mjs — see scripts/status-incident.mjs). Updates posted at 30-minute cadence until resolution; each update is an entry under updates[] with at, status, summary. Resolved incidents keep their history for 90 days; rolled up into the 90-day uptime percentage displayed in the page header. Post-mortem (SEV-1) published as a linked doc under docs/postmortems/ within 5 business days.

90-day uptime

Computed locally from incidents.json:

Baseline 99.95 % (matches the SLA in infra/STATUS.md).

Third-party dashboard (optional)

For enterprises that require an Atlassian Statuspage or StatusGator feed, the /trust/incidents.json schema matches Statuspage's import format. We keep the in-house page as the canonical source and mirror to external dashboards via the scripts/status-mirror.mjs cron (future work).

Monitoring & verification

Availability monitor: external check (Cloudflare healthcheck) pings /status every minute from three regions; page alerts if the page itself is unreachable. Content check: the axe-playwright run hits /status anonymously on every PR; drift in the heading or missing role attributes fails CI. Schema test: pnpm --filter control-plane test src/app/\(marketing\)/status guards the Component and incident shapes.

Launch-gate claim

This document + the already-shipped public page at /status + the incidents.json publication channel satisfy gate G-2.