{ "format": "agent-article-v0", "article_id": "EA-268", "canonical_url": "/tools/ea-268-chaos-engineering-fault-injection-for-ai", "page_type": "reference", "claim_ids": [], "evidence_ids": [ "EA-268-CURRENT-APPROVAL", "EA-268-CURRENT-BODY-READBACK" ], "unknown_ids": [ "EA-268-UNKNOWN-01" ], "operational_object_ids": [], "provider": [], "models": [], "plans": [], "surfaces": [], "regions": [], "current_status": "CURRENT", "observation_status": "SPEC_ONLY", "freshness": "CURRENT", "last_verified": "2026-10-06", "supersedes": [], "superseded_by": [], "provenance": [ "V22-CANDIDATE-EA268-FIRST-20261015-C2", "BODY-SHA256:69402ab42678bcc6bef3eaf7c9689b8e714d2f5808a3da38f2c851282064d788" ], "article_sources": [ { "id": "EA-268-CURRENT-APPROVAL", "evidence_class": "RESEARCH", "title": "現行本文の監査・revision対応", "supports": [ "現行台帳のAUDIT_PASSと候補・revision・本文ハッシュの対応を確認しています。" ], "limit": "監査状態と来歴の記録です。外部根拠の最新性や本文の全主張を追加保証しません。", "origin_class": "AUDITED_CANONICAL_RESEARCH_PACKET", "source_or_experiment_ids": [ "V22-CANDIDATE-EA268-FIRST-20261015-C2" ], "supporting_locators": [ "1KqhJtiSb2S84rWmeYVwKcT_76dBwZ_B0ZZuAWQqH0rQ/EA_REVISION_LEDGER!A65:U65", "EA_REVISION_LEDGER!A65:U65", "EA-268-FIRST-20261006" ], "provenance_status": "CURRENT_CANONICAL_APPROVAL_READBACK" }, { "id": "EA-268-CURRENT-BODY-READBACK", "evidence_class": "IMPL", "title": "現行本文の収録照合", "supports": [ "公開生成入力の本文SHA-256が、監査済み候補に結び付いたハッシュと一致しています。" ], "limit": "本文の同一性の検査です。外部システムの挙動や全主張の真偽を実証したものではありません。", "checked_at": "2026-10-17", "origin_class": "IMPLEMENTATION_READBACK", "source_or_experiment_ids": [ "BODY-SHA256:69402ab42678bcc6bef3eaf7c9689b8e714d2f5808a3da38f2c851282064d788" ], "supporting_locators": [ "content/staging/EA-268.md", "69402ab42678bcc6bef3eaf7c9689b8e714d2f5808a3da38f2c851282064d788", "EA-268-FIRST-20261006" ], "provenance_status": "CURRENT_APPROVED_BODY_HASH_MATCH" } ], "research_sections": [ { "heading": "PUBLIC_CLAIM", "text": "AI/AgentへのChaos Engineeringでは、faultを注入できたこと自体をresilienceの証明にしません。\n\n\n実験前のsteady state、resolved target、blast radius、fault/version、stop condition、revert経路を固定し、実行後にservice SLI、data integrity、queue/backlog、tool side effect、Agent task-level invariantをreadbackします。" }, { "heading": "EXPERIMENT_CONTRACT", "text": "各experimentにhypothesis/expected invariant、environment、target selectorとresolved target、fault/action/version、intensity/duration、steady-state SLI/SLO、stop/abort condition、revert path、owner/approver、post-fault acceptance、definition hashを保存します。" }, { "heading": "BLAST_RADIUS", "text": "selector/tag/queryだけを安全境界にしません。shared subnet、gateway、queue、database、identity service等をtargetにすると複数applicationへ影響する場合があります。実行時resolved target setをreadbackしplanned setとの差分を確認します。productionでは小さいblast radiusから開始しpre-productionで先に検証します。" }, { "heading": "STOP_AND_REVERT", "text": "stop conditionはguardrailですが完全復旧の証明ではありません。停止後にfault removal/revert、resource health、data integrity、queue/backlog、retry/duplicate side effectを確認します。revert failure/partial revertをfailure envelopeへ含めます。" }, { "heading": "PASS_CRITERIA", "text": "fault action/job成功、terminal status、Completed表示だけでPASSにしません。pre-fault steady stateとpost-fault acceptanceを比較し、service SLI/SLOとtask-level invariantを評価します。" }, { "heading": "AI_FAULT_MATRIX", "text": "LLM/API 429・5xx・timeout・latency、stream truncation/malformed response、model/provider failover、retrieval empty/stale/permission denial、vector/index lag、tool/MCP timeout/partial success、retry/duplicate side effect、queue delay/backlog、identity/token expiry、context-window pressure、policy/guardrail dependency unavailableを候補化します。\n\n\nprovider-managed hidden backendなど直接injectできない領域はproxy/stub/faulting dependency等で再現可能な境界とUNKNOWNを分けます。" }, { "heading": "SIDE_EFFECT_SAFETY", "text": "決済、通知、削除、署名、外部更新等のtoolを含むexperimentではsandbox/allowlistを使い、idempotency、readback、compensationを検証します。chaos automationが本番副作用を無制御に発火できる権限を持たないようにします。" }, { "heading": "AUTHORIZATION", "text": "fault injection開始権限とtarget resource操作権限をleast privilegeで管理します。production experimentはowner/approver、対象、期間、stop conditionを明示し、自動化経路にも同じauthorization boundaryを適用します。" }, { "heading": "PRODUCT_BOUNDARY", "text": "AWS FISはreal AWS resourcesへreal actionsを行うため、pre-production planningとstop conditionsを前提にします。Azure Chaos Studioはcurrent WorkspacesとExperiments (classic)を区別し、classic固有記述をcurrent Workspacesへ無条件に一般化しません。Google Cloud Fault Injection Testingは2026-10-06時点でPreview/Pre-GAであり、terminal Completedはpremature cancelを含み得るため状態名だけをPASS判定にしません。LitmusChaosではpre-chaos steady-state validation、fault injection、revert、post-chaos status checkを別工程として扱います。" }, { "heading": "OBSERVABILITY_READBACK", "text": "resolved target set、actual fault start/end、stop-condition state、telemetry window、revert state、post-fault SLI/SLO、data-integrity result、queue/backlog state、external side-effect result、Agent task-level invariant、exception/break-glassを保存します。" }, { "heading": "BEHAVIORAL_BOUNDARY", "text": "LLM/Agent出力は非決定的になり得ます。単一文字列一致だけでresilienceを評価せず、task completion、tool correctness、policy violation、latency/error budget等のinvariantをfault hypothesisに合わせて定義します。infrastructure recoveryとAgent behavioral recoveryを別gateにします。" }, { "heading": "FAILURE_ENVELOPE", "text": "wrong target、selector expansion、shared-resource collateral impact、stop alarm不備、telemetry outage、stop delay、revert/partial-revert failure、data corruption、backlog、duplicate side effect、failover bypass、fault path coverage不足、overprivileged experiment identity、approval bypass、model/API drift、nondeterministic oracle、cost runawayを想定します。" }, { "heading": "IMPLEMENTATION_STATE", "text": "本項は2026-10-06時点のAWS FIS、Azure Chaos Studio、Google Cloud Fault Injection Testing、LitmusChaos公開資料に基づきます。organization環境へのlive fault injectionは未実施です。" }, { "heading": "SAFE_WORDING", "text": "AI/AgentへのChaos Engineeringでは、faultを注入できたこと自体をresilienceの証明にしません。実験前のsteady state、resolved target、blast radius、fault/version、stop condition、revert経路を固定し、実行後にservice SLI、data integrity、queue/backlog、tool side effect、Agent task-level invariantをreadbackします。production実行はpre-production検証、least privilege、承認、明示的なabort条件を伴わせます。" }, { "heading": "OPEN_UNKNOWN", "text": "organization chaos platform/version、environment topology、target inventory/selectors、IAM/approval、SLI/SLO、LLM/provider/tool dependencies、side-effect sandbox、stop alarms、rollback/revert implementation、data-integrity oracle、queue/backlog thresholds、failover、experiment cadence、cost/capacity、incident freeze policy、tenant realized stateは未確認です。\n\n\nMANIFEST\nacceptance: separates fault injection from resilience verdict; fixes target/blast-radius/steady-state/stop/revert/auth/readback and AI-specific fault/oracle boundaries.\nrisk: mis-targeted or overprivileged chaos can itself cause outages or side effects; successful injection or terminal status can mask failed recovery or untested paths.\nrollback: new path only; if later integrated and rejected, remove candidate-added path while preserving evidence/revision history.\nlocal_tests: deterministic experiment-policy fixture 11/11 PASS; required sections PASS; READY/AUDIT_PASS absent.\nlocal_payload_sha256: 0dca8e99f270d985f3c25fd9ca5a6cfd99a640c5767e52f2365b5504bddcbefc\nlocal_manifest_sha256: e9619711f35549d120b5817eb7b6357d4f5d0dda4a50b3f5708ae7d7a2baefa3" }, { "heading": "EVIDENCE_DOC_ID", "text": "1wnDmJjwZOy3zYWpkNJjE61smP_9iVTpgYRhk4mrcCTU" } ], "human_url": "/tools/ea-268-chaos-engineering-fault-injection-for-ai", "markdown_url": "/agent/article.md?path=%2Ftools%2Fea-268-chaos-engineering-fault-injection-for-ai", "json_url": "/agent/article.json?path=%2Ftools%2Fea-268-chaos-engineering-fault-injection-for-ai" }