Blast Radius Engineering: Personal Reliability Engineering for Correlated Failure

1.Introduction

In July 2024, a routine content update to a widely-deployed endpoint-security agent synchronized a malformed channel file to roughly eight and a half million Windows machines, grounding flights, idling broadcasters, and taking down hospital systems for days — one shared root, one configuration push, and a casualty list spanning industries. It was, by every account, an organizational-scale event: an SRE-grade postmortem exercise about deployment canaries and staging. Missing from every analysis, then and since, is the observation that the same morning, several hundred million individuals experienced their own correlated failure: the same agent, or the same cloud, or the same ISP also took down their laptop, their files, their video call with the doctor, their ability to authenticate to anything — and none of them possessed a postmortem, a dependency map, or a single instrument for noticing that the event was not an accident of one vendor but a structural property of how their stack had grown. The personal outage and the enterprise outage share a physics; only one of them has an engineering discipline.

The individual's infrastructure is, by now, genuinely critical. A modern household's capabilities — earning, learning, communicating, remembering, transacting, unlocking doors, calling for help — ride on a stack of dozens of services and devices assembled over years, each chosen at signup time by convenience, each marketing its own uptime, and the whole assembly governed by correlations nobody has enumerated. The number is not rhetorical: enumerate one ordinary professional's stack and the shared roots fall out of the enumeration with uncomfortable regularity. One Google-or-Apple-or-Microsoft identity: mail, photos, calendar, documents, app-store logins, and the password manager's own recovery. One phone number: SMS second factors for banking, work, health, government. One cloud region: every photo ever taken of the user's children, three copies of "backed up" data, the seed phrases in a notes file. One browser profile: every session. One email address: the reset path for every other root above. One physical person: the only one who knows where everything is. Each individual product on the list passed its own reliability review; the composition has never been reviewed by anyone, including its owner.

The gap has a shape this program has learned to recognize: a cross-cutting property (here, correlation through shared roots) with no owning layer — not owned by any vendor, because vendors see their own product; not owned by the user, because the graph is invisible from inside any single interface; not owned by any discipline, because SRE was built to serve organizations with budgets, and the individual was assumed to be a user, not an operator. The result is the largest unengineered system class on earth: billions of mission-critical single-person infrastructures, each with a blast-radius profile of a mid-size enterprise and an observability budget of zero.

This paper — series V's closing paper, on the promise independent things fail independently — specifies the discipline. Section 2 formalizes the personal dependency graph and its correlation classes. Section 3 surveys the adjacent worlds that each hold a piece (SRE composite SLAs, failure-domain design, portfolio theory, consumer outage postmortems) and verifies the gap. Section 4 explains why the gap survived. Section 5 specifies the system: the inventory graph, the blast-radius metric, composite-availability arithmetic, decorrelation budgets and placement rules, the failure weather report, and the audit drill. Sections 6–10 close in the program's standard order.

2.The formal model

2.1 The personal dependency graph

Model the individual's digital life as a directed graph G = (C, S, R): capabilities C (the things that must keep working: authenticate, communicate, pay, access medical records, unlock the household, reach emergency services, recover everything after loss), services S (accounts, devices, vendors, credentials — the nodes), and realizes edges (a capability is realized through a chain of services). The graph is typed by roots: each service node carries its correlation class vector — account_family, vendor, region, jurisdiction, credential, browser, network, person, physical_location. A capability's realization chain inherits the union of the classes of its services: the capability "authenticate to my bank" is realized through {bank SaaS, bank's SMS vendor, my phone number, my carrier, my phone's OS, my person}; "recover my photos" is realized through {cloud A, account family A, email A → account family A again, person}. The formal object is deliberately SRE-shaped (realization ≈ request path; class vector ≈ failure domain) because the mathematics transfers, and deliberately personal in its capability set, because the availability targets of a household — "emergency reachable," "medication reminders," "can pay rent" — are nothing like a cluster's and everything like a hospital's.

2.2 Correlation classes, enumerated

The classes are few enough to audit by hand and general enough to cover the observed failure corpus:

1. Identity/account family — one provider is the login for everything (social sign-in, and its subtle maximum: the recovery email for other roots lives inside the same family).
2. Credential store — the password manager: single system holding every secret; its own security and its own recovery path are each a root.
3. Second-factor channel — the phone number: SIM-swap is the canonical casualty (years of documented account takeovers in the security literature; the FBI's public counts are the institutional acknowledgment — figures verification-queued, the class of event is certain).
4. Vendor/organization — one company hosting multiple critical services (the July 2024 event's shape; also the mega-vendor outage shape of 2021's and 2023's regional failures).
5. Region/physical — one data center region, one ISP, one house. The house is a correlation root whose failure mode is not probabilistic but physical — fire, flood, theft — and whose blast radius includes every device, every local credential, and every piece of paper the household trusted.
6. Jurisdiction/legal — account seizure, sanctions, provider exit: the class that materializes abruptly and regionally.
7. Knowledge/person — the operator's own incapacity or absence: the single root whose blast radius is the entire graph, and the one the delegated-operation paper (P-013) begins to govern.
8. Time/epoch — certificates, tokens, subscriptions, and OS support windows expiring on the same calendar; the dormancy paper (P-019) covers the sleeping artifacts; here the calendar correlation across live services is the root.

2.3 Blast radius and composite availability

For a root r (a specific instance of a class — this carrier, this account family), define the blast radius:

B(r) = Σ_c weight(c) · [realizes(c) touches r]

where weight(c) is the capability's criticality (the modality-failover paper's criticality classes, P-014, supply the weighting scheme: life-safety > locks-and-money > irreplaceable-memory > convenience). B(r) is the casualty list, weighted — "if this root dies, here is what stops, ranked." The household's correlation profile is the sorted vector of B over all roots; the profile, not any single number, is the health metric, because the pathology is concentration, not failure of any one node.

Composite availability under correlation: for a capability realized through services with shared root r, the availability of the capability is bounded by the root's availability, regardless of the individual services' SLAs. Formally, if k critical capabilities all route through r, the household's effective availability for the capability set is A(r)^min-dependence, and every "99.9%" the marketing asserted is revealed as the marginal of a joint distribution whose common factor dominates. The arithmetic is the same one portfolio theory built for returns (Section 3) and the one SRE built for composite paths: independence is a design achievement, never a default state. The personal stack, assembled by signup convenience, defaults to the opposite of achievement: maximum common factor, minimum awareness.

2.4 The decorrelation budget

Redundancy is not free, and the discipline's realism lives in its budget. Decorrelation has costs in money (second accounts, second devices), in friction (n+1 recovery paths are n+1 things to maintain), in attention (the P-006 scheduler's economics), and in dormancy risk (a backup path never exercised is not a backup; it is a P-019 artifact — and the audit drill of Section 5.6 is the exercise calendar that keeps decorrelation honest). The specification therefore does not preach "redundant everything"; it computes placement: given criticality weights, root blast radii, and per-class decorrelation costs, place the next unit of redundancy where it cuts the largest B at the lowest total cost — typically: a second credential path for identity (cheap, giant B), an offline+offsite recovery kit (cheap, giant B, but dormant — P-019 governs it), a second factor channel independent of the phone number (moderate cost, moderate B), a second vendor family for irreplaceable data (moderate, large B), and almost nothing else, because convenience's correlation weight is small and the budget is real.

3.The landscape: every piece institutional, no assembly personal

SRE and composite SLAs. The parent discipline: composite availability arithmetic, failure domains, cells and bulkheads, blast-radius as a design constraint in the modern architecture literature. The entire formal apparatus of Section 2 is SRE's, transposed. What SRE never developed is the personal deployment shape: no capability vocabulary for a household, no instrument for an owner-operator with zero telemetry budget, no placement heuristic against convenience-driven graphs (organizations do not acquire their dependencies by signup accident; individuals do — the transposition is not cosmetic). Verdict: the mathematics exists, institutionalized; the object is new.

Portfolio theory. The deepest theoretical neighbor: Markowitz's insight that risk is a property of covariance, not of individual assets, is precisely Section 2.3's insight with different nouns. Diversification's placement mathematics ("maximum diversification per unit cost") is the decorrelation budget's ancestor. The analogy has a hard boundary — markets reward decorrelation, attention does not — but the formalism transfers cleanly, and no consumer product applies it to infrastructure. Verdict: the theory, sixty years old, never ported.

Cloud postmortems and public outage history. The empirical corpus: regional failures, mega-vendor outages, CDN incidents, the endpoint-security event of 2024, certificate expiries that took down fragments of the consumer web. The corpus proves the classes (Section 2.2) with industrial repetition and supplies the weather report's feed (Section 5.5). It is written entirely for organizations; the individual's slice of every one of those events is unrecorded in each postmortem. Verdict: the data exists; the personal interpretation layer does not.

Password-manager and security-vendor guidance. The security industry sells fragments of the discipline: backup codes, hardware second factors, offline seed backups. Each fragment decorrelates one root (usually credential-store or second-factor), none models the graph, and the placement is left to the owner — who cannot place what they cannot see. Verdict: point solutions; no system.

Digital-estate and succession services. The knowledge/person root's commercial fragments: password inheritance features, legacy-contact settings, emergency-access workflows. The delegated-operation paper (P-013) specified the multi-principal protocol properly; this paper's graph model gives those fragments their missing context — succession is the person root's decorrelation move. Verdict: exists as features, untheorized as placement.

Consumer backup products. Solve "vendor" decorrelation for files alone, usually by copying to a second vendor — while the recovery path for that vendor routes through the same email root as the first. The backup exists; the recovery graph stays correlated, which is the property that actually matters at restore time. Verdict: partial by construction; the classic near-miss.

Table 1: the landscape, graded.

Components STRONG in the institutional flanks; composition for the personal object vacant. The falsifiable claim: no deployed product models its user's cross-vendor shared roots, computes a blast radius, or schedules a decorrelation audit. One counterexample refutes it.

4.Why the gap survived

Convenience is a correlation engine. Every signup decision optimizes local friction, and the locally-cheapest identity, inbox, and recovery channel are always the ones already in hand. The graph's common factors are not mistakes; they are the accumulated optimal local decisions of a thousand convenient Tuesdays — the individual-scale instance of the complexity ledger's relocation finding (P-012): the convenience was real, and it was purchased with correlation that never appeared on any invoice. Systems assembled by local optimization hide their global structure from their own assembler; that is why the graph must be made before it can be read.

The observability budget is zero. SRE exists because organizations instrument: dashboards, incidents, postmortems, on-call rotations. The individual's stack emits telemetry to its vendors, not to its owner; personal outages are experienced as bad days, not filed as incidents; nothing aggregates. No instrument, no metric; no metric, no discipline — the same causal chain that kept defaults ungoverned (P-016) and the revocation promise unkept (P-017): visibility precedes governance, and the personal graph has neither.

Each vendor's interface ends at its own root. The password manager shows passwords, not the realization graph they participate in; the cloud console shows storage, not which capabilities die with the region. The composition is nobody's product surface, which is why it is nobody's model — the cross-cutting-property shape again, and this time the property is invisible to every party simultaneously, owner included.

"It has never failed yet." The base-rate argument, in its most seductive costume. It is true, mostly, per-root, per-year — and it is exactly the argument the portfolio investor makes about the concentrated position, right up to the covariance event. The dormancy paper's temporal blindness (failures invisible until catastrophic) recurs here in probabilistic costume: rare-but-correlated feels identical to safe, from inside, until it does not.

The discipline would have to be adopted by its own victim. Organizational SRE was purchased by managers who paid for downtime. The personal equivalent must be adopted by the person who experiences the downtime but has never had a way to price it in advance — the blast-radius metric exists to be that price, and its absence is the gap's market shape: nothing to read, therefore nothing to act on, therefore nothing built.

5.The specification

5.1 The inventory interview and graph construction

The entry point is a structured inventory — twenty minutes, questionnaire-driven, no telemetry required (the zero-observability constraint of Section 4 respected by design): which identity providers, which recovery email for each critical service, which second-factor channel per service, where irreplaceable data lives (vendor, region), which devices unlock the household, who else knows where the recovery kit is. The interview's output is the typed graph of Section 2.1; the questionnaire is the discipline's telemetry substitute, and its question order is the pedagogy: the first ten questions are designed to surprise — "what is the recovery email for your recovery email?" is the graph's root loop, and watching a user meet that question is the entire thesis experienced in four seconds.

5.2 Blast-radius computation and the correlation profile

B(r) over the inventory, rendered as the household's actual instrument: a ranked casualty list per root — if this phone number dies: bank login, work login, medical portal, government ID, and the password manager's own recovery. Weight: critical. The profile across roots, sorted, becomes the stack's health view — not a score to gamify but a reading list: the top of the profile is the next drill's subject (5.6) and the next budget's candidate (5.4). Rendering follows the calibrated display contract's discipline (P-015): tiers, not false precision; B is a weighted count, not a probability, and the interface must not costume it as one.

5.3 Composite availability, honestly

Per capability: the realization chain's roots, the joint availability bound, and the plain-language consequence — "your 'recover the photos' path is only as available as one email account, forever, including the day you most need it." The arithmetic is SRE's composite path math with correlation classes substituting for explicit pairwise covariances (class membership is the covariance model — coarse, honest, and computable from a questionnaire rather than telemetry, which is the personal-scale trade and the spec's deliberate approximation).

5.4 The decorrelation budget and placement rules

A ranked recommendation queue under budget constraints, placement-first by B-remainder per cost unit:

• Credential-path decorrelation — a second, independent path to the identity root (printed backup codes plus a hardware second factor, stored offline, different physical location from the devices). Cost: one device + one envelope; B cut: enormous.
• Second-factor channel decorrelation — at least one critical capability authenticating without the phone number (authenticator-app or hardware-key paths for banking and email). The SIM-swap corpus is the evidence base; the placement is cheap relative to the class's casualty lists.
• Data-vendor-family decorrelation — irreplaceable data copied to a second vendor family (not a second product of the same vendor), with the recovery path for the second copy deliberately routed through a different email root than the first. The recovery-graph routing rule is the counter to the backup industry's near-miss (Section 3).
• Offline + offsite recovery kit — the full-estate recovery artifact: manifest, credentials, succession pointer (P-013), and the P-019 readiness manifest, exercising the dormancy ladder. The kit is where series V's two papers become one product surface.
• House-root decorrelation — the physical-location class: one copy of the recovery kit outside the house, with the same media-diversity rules as P-019.
• What not to do — decorrelating convenience-tier capabilities, redundant everything, or any placement whose maintenance cost (attention, renewals) exceeds its weighted B: the budget is real, and undisciplined redundancy is how personal reliability engineering dies of nagging.

5.5 The failure weather report

A subscribe-once feed that overlays the public outage and lifecycle corpus onto the personal profile: scheduled certificate and OS-support expiries touching your roots; vendor incidents in progress touching your regions; deprecation notices from your dependencies; registrar and domain events. The report's honest form is coarse — classes, dates, likelihood tiers — because the underlying postmortems are organizational documents being re-read for one household. Its real product is calendarization: the time/epoch root (Section 2.2, class 8) becomes a set of dated maintenance events the household can schedule, instead of the current regime in which every expiry is a surprise discovered by failure. The feed is buildable today from public sources (status pages, support-lifecycle pages, certificate transparency, vendor deprecation blogs); the personal-overlay interpreter is the missing piece, and it is a reading layer, not a data layer — the gap is interpretation, not telemetry.

5.6 The audit drill: kill one root

Once a year (or on weather-report alert), the household runs the discipline's chaos day: pick the top-of-profile root, disable it — the phone number's SIM into a drawer, or the primary email's sessions revoked in a controlled window — and observe the casualty list against the B(r) prediction. The drill is the entire system's ground truth loop: inventories rot (P-018's half-life applies to the questionnaire's own facts — the graph decays as services are adopted and abandoned), placements decay (backup paths drift back toward correlation as vendors merge and recovery flows get "simplified"), and the gap between predicted casualty list and observed casualties is the discipline's own error budget. The drill doubles as the knowledge root's succession rehearsal (P-013): the second person runs it, using only the recovery kit, which in turn is the P-019 exercise the kit's readiness manifest demands. One afternoon a year closes three papers' loops.

6.Evaluation design

1. Inventory-constructibility study. N=30 households build the graph via the questionnaire; measure completion time, surprise events (roots the owner could not name), and test-retest stability at 3 months. Success: constructible in under 30 minutes, materially surprising, stable enough to act on.
2. Blast-radius validation. For households that experienced a real root failure during the study window (phone number loss, account lock, vendor outage), compare predicted casualty lists with reported casualties. Success: prediction recall above 0.8 — the metric measures the thing.
3. Placement cost-effectiveness. Retrospective corpus: the public outage history overlaid on sampled inventories; compute casualty-weighted loss avoided by the placement queue versus naive redundancy. Success: budgeted placement dominates naive redundancy at equal cost.
4. Drill adherence and effect. Ten households run the kill-one-root drill; measure pre/post placement changes and the questionnaire's decay rate. Success: drills surface at least one unknown correlation per household, and the graph's measured drift justifies annual cadence.

7.What this is not

Not a security product. Hardening makes roots harder to kill; this discipline makes the casualty list smaller when one dies. The two compose (a hardened identity root with a giant blast radius is still a giant blast radius), but the metrics are orthogonal — compromise-resistance versus correlation structure. Not a backup tool. Backups replicate data; this governs realization paths, including the recovery paths that backups forget (Section 3's near-miss). Not a "digital wellness" product. No screen-time moralizing; the object is availability engineering, and the convenience tier is left undisciplined by design. Not paranoia-ware. The budget's what-not-to-do rules are load-bearing: the discipline decorrelates the criticality classes that matter and explicitly declines the rest, because a discipline that nags dies of its own notifications (the P-006 lesson, imported as a design constraint). Not organizational SRE with a smaller logo. The transposition is real mathematics over a new object: convenience-assembled graphs, questionnaire telemetry, zero-budget audits, and the person-as-root — none of which SRE's institutional shape contains.

8.Objections, confronted

"Nothing fails all at once." The weather report's corpus and every postmortem in it: roots fail on the schedule of their maintenance events, not the household's convenience — and July 2024's single synchronized push was the consumer web's largest simultaneous personal-outage event in history, unmeasured because uninstrumented. Correlated failure is not a hypothesis; it is the documented default state of shared roots. "The average user will never do this." The average user does not run SRE either; the average organization was dragged into it by priced downtime. The household's priced downtime arrives through the same events, and the discipline's adoption path is the drill's surprise density — one forty-second encounter with "what is the recovery email for your recovery email" has converted more owners than any dashboard ever will. The spec's realism is the 20-minute questionnaire, not a telemetry platform. "Vendors already handle redundancy." Vendors handle their redundancy, inside their roots, for their SLAs — and the correlation classes that matter (identity, credential store, second factor, person, house, calendar) are precisely the ones no vendor can see, because they are the ones that live between vendors. "It is too much maintenance." The budget's answer, quantitatively: the recommended placements cost one afternoon a year and one small purchase — the discipline's entire recurring load is one drill and one weather-report subscription, by construction, because anything heavier is a design failure of the discipline itself. "My cloud is 11 nines." Your data objects are 11 nines. Your access path to them routes through one identity, one email recovery, one second-factor channel, and one jurisdiction — and the composite is the minimum of the path, not the maximum of the marketing. Section 2.3's arithmetic is the whole reply.

9.Limitations

The questionnaire is self-report, and self-reported graphs decay — the inventory's own half-life is the study's measured drift, and the honest spec schedules re-inventory rather than promising persistence. The class-vector covariance model is deliberately coarse: within-class correlation heterogeneity (two services on the same vendor with genuinely independent stacks) will overcount some blast radii, and the metric's defense is its rendering as casualty lists rather than probabilities. The weather report depends on the quality of public lifecycle disclosure, which vendors control and minimize — the time/epoch root is the class most likely to surprise even an instrumented household. The drill's ecological validity is bounded: disabling a SIM in a drawer is a rehearsal, and real failures arrive with uncontrolled circumstances (the P-019 doubling, transposed). The person-root's full treatment belongs to P-013's succession semantics; this paper's placement rule only routes around it, and incapacity remains the household's irreducible single point of failure until delegation protocols deploy. And the discipline's evidence base for personal-scale outcomes is thin by definition — this paper's own evaluation design is the instrument that must build it. Domain-knowledge citations carry verification-queued status through the live-source ledger, with the 2024 endpoint-security event's casualty figures the first queued item.

10.Conclusion

SRE's sixty-year arc ran from "hope it works" through "measure it" to "design its failure domains" — and its mathematics, the covariance structure of failure, was finished long before anyone thought to point it at a household. The individual's stack is the last unengineered infrastructure on earth precisely because it was never built; it was accreted, one convenient Tuesday at a time, and accretion optimizes for friction, not for independence. The result is billions of mission-critical single-operator systems, each carrying the blast-radius profile of an enterprise and the observability of a junk drawer. The discipline specified here is small on purpose: a questionnaire that surprises, a casualty list per root that can be read in one sentence, composite arithmetic that tells the truth about marketing's nines, a placement queue that spends one afternoon and one envelope where it cuts the largest radius, a weather report that calendarizes the world's maintenance events, and a chaos day that keeps the whole graph honest. Independent things fail independently — but only if someone engineered them that way. Nobody ever has, for the system that matters most: yours.

References

Verification-queued marks follow the program's citation-honesty convention.

1. Google SRE Team. Site Reliability Engineering; The SRE Workbook (failure domains, composite paths, blast radius, game days). O'Reilly, 2016/2018.
2. Markowitz, H. "Portfolio Selection." The Journal of Finance 7(1), 1952.
3. CrowdStrike. Channel File 219 technical root-cause analysis and Post Incident Review, July 2024. (casualty figure: 8.5M Windows hosts is Microsoft’s estimate, relayed by CISA; verified 2026-10.)
4. AWS. Summary of the AWS Service Event in the Northern Virginia (US-EAST-1) Region, December 7, 2021. (verified 2026-10: AWS’s own post-incident summary; the incident originated in the Kinesis subsystem.)
5. Apple/Google/Microsoft status-page incident archives, 2019–2026. (weather-report corpus)
6. FBI IC3. Public Service Announcements on SIM-swapping. (verification queued)
7. Basel, J. et al. on SIM-swap account-takeover case studies. USENIX Security track, 2020s. (verification queued)
8. Let's Encrypt / ISRG. Certificate lifetime and root-expiry public notices. (verification queued)
9. Adams, C. et al. on account-recovery path weaknesses. (verification queued)
10. De Simoni, A., et al. on distributed system postmortem corpora. (verification queued)
11. Bass, L., Clements, P., Kazman, R. Software Architecture in Practice (availability tactics, redundancy patterns).
12. p-rick research program. P-006 The Attention Scheduler; P-012 The Complexity Ledger; P-013 Delegated Operation; P-014 Modality Failover; P-015 The Uncertain Document; P-016 The Defaults Ledger; P-018 Epistemic Half-Life; P-019 Dormancy Engineering. 2026.
13. Uptime Institute. Annual outage analysis. (verification queued)
14. NIST. SP 800-63B: Digital Identity Guidelines (authenticator redundancy guidance).
15. Redman, T. on the cost of data-quality failure (personal-outage cost analogy; verification queued)
16. Vint Cerf. "Digital dark age" addresses on personal data fragility. (verification queued)