Client-cloud boundary
Deploy identities are short-lived and constrained. The platform does not require a permanent operator credential.
Pillar 01 · App Plane
Change compute without gambling state.
The App Plane gives services a narrow path into shared infrastructure while keeping stateful foundations, credentials and generated deployment details outside the service blast radius.
OwnsOperational runtime
Joins throughDiscovery + events
RecoveryRollback + restore
Hard rule
Discover handles. Pass references.
Non-negotiable
A service takes no shared infrastructure as an input and no credential as a value. It resolves deliberate capability handles and passes secret references.
This prevents a service module from acquiring ownership of networks, databases, keys or account-specific names merely because it needs to use them.
Architecture
Separate by lifecycle and irreversibility.
Stateful substrate changes slowly and carries restore risk. Stateless services change often and should roll back by release. The golden path exposes safe variation points while identity, edge, observability and state protection remain platform policy.
Golden path
A service declares compute and ingress. It discovers the network, database, cache, secrets and event capabilities it has been granted.
State protection
Deletion protection, lifecycle rules and permissions boundaries keep routine service change from reaching shared or irreversible state.
Transactional outbox
Business state and event intent commit together. A relay retries publication without creating a dual-write gap.
Observability
Release, service, request, event and business identities remain linkable across the plane boundary.
Rollback
Service rollback restores the last accepted artifact and declaration. Stateful recovery remains a separate restore procedure.
Validation
Ask the failure questions before the happy path.
Evidence should show that the unsafe change is refused, not merely that the declared deployment renders.
| Review area | Evidence to request | Failure prevented |
|---|---|---|
| Discovery | Consumer contract pins and missing-handle negative tests | Hard-coded names and hidden deployment-order coupling |
| Identity and secrets | Permissions-boundary tests, grant diff and secret-reference checks | Credential copying and privilege expansion |
| Outbox | Commit, retry, duplicate and poison-record fixtures | Lost events and duplicate business effects |
| Recovery | Service rollback plus separately owned state restore exercise | A routine release becoming an unrehearsed recovery event |
Limitation
Structural evidence cannot establish real latency, failover or managed-service behaviour. Those claims require a representative environment and observed exercises.
Next pillar