LAYER · VALIDATE · ACTIVATE
Startup validation: fail closed on invalid settings
Edit real JSON layers. Trace each winning value and compare the candidate with the configuration that is actually active.
Scroll the diagram horizontally to compare candidate and active values. The table below gives the same fields as text.
Edit candidate layers
Use synthetic values only. Do not paste credentials. Request overrides allow only timeoutMs, maxTokens and temperature.
Validation report
Your experiment
Choose the invalid-environment example and switch to startup mode. Confirm that there is no active revision. Repair the JSON and step through validation, binding and activation.
Explicit teaching schema
timeoutMs: integer 50–60,000; maxTokens: integer 1–8,192; temperature: number 0–2; retries: integer 0–5. timeoutMs × (retries + 1) must not exceed 90,000 ms. Model: atlas-lite or atlas-pro. Secret reference: fixture:team-a:v1/v2 or fixture:team-b:v1/v2, matching the selected tenant.
Defaults apply first and request overrides last. The middle layers use the selected precedence. All fields are validated, even when a later layer would overwrite them. A rejected candidate changes nothing in the active revision.
Value provenance and active revision
| Field | Candidate value | Winning source | Currently active value |
|---|
Applied-field history
Offline teaching model, not an ADK/Gemini configuration API or a security boundary. Precedence, validation ranges, allowed keys and retry budget are explicit lesson policies. Environment JSON is manually entered: this page never reads process environment variables. Secret references resolve to synthetic metadata; there are no secret values, network requests, cloud credentials or real IAM checks. Unknown fields, invalid types, forbidden request overrides and failed bindings reject the complete candidate. Production reload semantics depend on the application and must be tested separately. Configuration separation · Secret-reference and version guidance.
Choose Startup to see fail-closed behavior
Activation mode decides what an invalid candidate means. In Reload mode a known-good revision 1 keeps serving while a candidate is checked. In Startup mode there is no previous revision: a process that cannot validate its configuration must remain stopped. Select Startup and keep the valid example. Defaults, the environment layer, the tenant patch and the request override combine into timeoutMs 2500, maxTokens 1024, temperature 0.2 and retries 2; the candidate validates, binds its pinned secret reference and activates as revision 1.
Make startup fail for four different reasons
Choose each example in Load a complete example; loading an example resets every input, so select Startup again after each one. Invalid environment string sets timeoutMs to "5 seconds" and is rejected because environment numbers must be unit-free decimal strings. Cross-tenant reference points team-a at fixture:team-b:v2 and fails binding. Forbidden request override tries to change secretRef per request. Retry budget too large sets timeoutMs 60000 with five retries, a worst case of 360,000 ms, above the 90,000 ms cross-field limit. Each ends with startup blocked and no live configuration.
Find an exact boundary
Restore the valid example, select Startup, open the Tenant tab and edit the tenant patch to {"timeoutMs":15000,"retries":5}. The worst case is 15000 times six, exactly 90,000 ms, and startup activates. Change 15000 to 15001 and startup is blocked by the retry-budget rule. Every error is collected and reported, and nothing activates partially: there is no mixed state in which some fields are new and others are missing. Synthetic pinned version adds a binding failure after schema validation: disabled or denied versions also block startup.
Precedence is checked before validity
Middle-layer precedence chooses whether the tenant patch or the environment wins between those two layers. With environment winning, maxTokens comes from the environment as 512 instead of the tenant value 1024; the request override still wins for temperature. Tenant selects team-a or team-b, which also changes which secret references belong to the caller. The three JSON editors are the actual inputs; Restore valid example resets them. Switching to Reload with any failing example keeps revision 1 serving instead of stopping.
Playback and limits
Play, Next stage, Restart inspection, Speed and the Inspection time slider step through eight recorded stages from start to activation. The model validates six fields with fictional model names and secret references; no secret value, cloud secret manager, network probe or real ADK configuration class is involved. Production startup validation also checks reachable dependencies with bounded probes and must avoid printing secret values in its error messages.