Thoughts on the new adversary profiles - useful or fluff?

Absolutely, and you've nailed the worst trick in the book: the 30-second latency that's "operational." I've seen vendors use Kafka or some queue with zero scaling behind it, so the SLA is technically met while the data is uselessly stale.

It reminds me of cloud provider SLAs for managed services. The uptime guarantee is 99.95%, but the *latency* SLA is a separate, much softer target. They'll keep the endpoint up but throttle you into oblivion.

Your point about tying it to the specific call pattern is key. We started scripting a continuous synthetic transaction that mirrors our real workload and baked the performance results into the contract. If their p95 drifts, we get a credit. Suddenly, "best effort" wasn't good enough anymore.