Security Testing, Load Testing, SLA, and Control-Tower Templates

This appendix collects operational templates for red-team exercises, synthetic load tests, SLO-as-code reviews, and board-level quantum reporting.

Red-team exercise charter

Illustrative listing · yaml

red_team_exercise:
  exercise_id: qrt-2026-q3
  objective: test evidence integrity and broker policy bypass resistance
  scope:
    included:
      - quantum gateway
      - broker
      - evidence writer
      - plugin sandbox
    excluded:
      - provider-owned infrastructure
  rules_of_engagement:
    destructive_testing: false
    provider_contact_required: true
    data_classes_allowed: synthetic_only
  success_criteria:
    - no unsigned evidence accepted
    - no unauthorized backend route created
    - all privileged actions attributable

Diagram loads as you read

Red-team exercise charter · Figure 1

View diagram source

flowchart TB
    Charter[Charter] --> Scope[Scope]
    Scope --> Tests[Tests]
    Tests --> Findings[Findings]
    Findings --> Controls[Control updates]
    Controls --> Retest[Retest]

Synthetic load test plan

Illustrative listing · yaml

load_test:
  name: reservation-spike-test
  duration: 2h
  users: 200
  workload_mix:
    smoke: 10
    research_batch: 60
    regulated_priority: 5
    training_sandbox: 125
  thresholds:
    admission_p95_seconds: 2
    evidence_lag_p95_minutes: 10
    failed_submission_rate: 0.01
  abort_conditions:
    - provider_api_error_rate > 0.05
    - evidence_queue_age_minutes > 30

Diagram loads as you read

Synthetic load test plan · Figure 2

View diagram source

flowchart LR
    Load[Load generator] --> Gateway[Gateway]
    Gateway --> Broker[Broker]
    Broker --> Queue[Queue]
    Queue --> Provider[Provider adapter]
    Provider --> Evidence[Evidence]
    Evidence --> Report[Capacity report]

SLO review worksheet

Field	Value
SLO name
User-facing promise
SLI definition
Measurement source
Good event
Bad event
Time window
Error budget policy
Alert thresholds
Exclusions
Review owner

SLA caveat register

Illustrative listing · yaml

sla_caveats:
  - caveat_id: q-sla-001
    promise: quality-window execution
    dependency: provider backend availability
    exclusion: provider emergency maintenance
    customer_visible: true
  - caveat_id: q-sla-002
    promise: L3 provider replay
    dependency: compatible backend availability
    exclusion: retired hardware without equivalent target
    customer_visible: true

Illustrative listing · markdown

# Quantum Portfolio Control Tower

## This-period decision summary
- Continue:
- Pause:
- Kill:
- Fund:
- Escalate:

## Portfolio movement
- Workloads advanced:
- Workloads downgraded:
- Workloads killed or parked:

## Risk movement
- Technical:
- Vendor:
- Security:
- Claims:
- Talent:

## Economics
- Spend:
- Cost per accepted evidence package:
- Reservation utilization:

## Required board decision
- Decision requested:
- Consequence of no decision:

Diagram loads as you read

Board control-tower one-pager · Figure 3

View diagram source

flowchart TB
    Portfolio[Portfolio movement] --> OnePager[Board one-pager]
    Risk[Risk movement] --> OnePager
    Economics[Economics] --> OnePager
    Evidence[Claims and evidence] --> OnePager
    OnePager --> Decision[Board decision]