papers/hanzo-consensus-plugin-platform/figures/pinning.tex

\begin{figure}[t]
\centering
\begin{tikzpicture}[
  font=\scriptsize,
  node distance=4mm,
  box/.style={draw, rounded corners=2pt, align=center, minimum height=6mm,
              inner xsep=3pt, text width=62mm},
  edge/.style={box, fill=hzblue!10, draw=hzblue!70},
  mid/.style={box, fill=hzslate!10, draw=hzslate!60},
  writer/.style={box, fill=hzgreen!12, draw=hzgreen!70, text width=27mm},
  follow/.style={box, fill=hzslate!8, draw=hzslate!55, text width=27mm},
  arr/.style={-{Latex[length=2mm]}, hzslate!80, line width=0.4pt},
  proxy/.style={-{Latex[length=2mm]}, hzblue!70, line width=0.5pt}
]

\node[edge] (client) {client \;$\rightarrow$\; one endpoint};
\node[mid, below=of client] (ident) {\texttt{IdentityMiddleware} \;---\; org from JWT (HIP-0026)};
\node[mid, below=of ident] (pin)
  {placement middleware \;---\; \texttt{shard $=$ (plugin, org)}\\
   look up \texttt{Owners[shard]} in watched map (in-memory, no RPC)};

\node[writer, below left=9mm and -26mm of pin] (w)
  {\textbf{writer node}\\ writes \& read-your-writes};
\node[follow, below right=9mm and -26mm of pin] (f)
  {\textbf{follower node}\\ stale-OK reads / HA standby};

\draw[arr] (client) -- (ident);
\draw[arr] (ident) -- (pin);
\draw[proxy] (pin.south) -- node[left, font=\fontsize{5.5}{6.5}\selectfont, hzblue!70,align=right]
  {serve local\\ or proxy} (w.north);
\draw[proxy] (pin.south) -- node[right, font=\fontsize{5.5}{6.5}\selectfont, hzblue!70,align=left]
  {proxy for\\ stale reads} (f.north);

\node[hzblue!65, anchor=north, font=\fontsize{5.6}{6.6}\selectfont]
  at ([yshift=-1mm]$(w)!0.5!(f)$)
  {pod-to-pod over headless DNS: \texttt{cloud-N.cloud-headless} (no LB, no extra hop)};

\begin{scope}[on background layer]
  \node[draw=hzslate!40, dashed, rounded corners=3pt, fit=(client)(ident)(pin)(w)(f),
        inner sep=4pt, fill=hzslate!3] (b) {};
\end{scope}

\end{tikzpicture}
\caption{Per-connection pinning. The placement middleware mounts immediately
after identity resolution, computes the shard from plugin and organization,
resolves the owner from the watched placement map with no round-trip, and
either serves locally or reverse-proxies pod-to-pod over the StatefulSet
headless service to the shard's writer (writes, read-your-writes) or a
follower (stale-tolerant reads). The client sees one endpoint
(\S\ref{sec:pinning}).}
\label{fig:pinning}
\end{figure}