Producer ownership
The team that owns the state transition owns the event meaning and compatibility decision.
Pillar 02 · Event Backbone
Let producers state facts once.
The event backbone separates business meaning from delivery behaviour. Producers own typed facts; consumers own routing, processing state, retry and replay.
OwnsEvent substrate
Meaning owned byProducer
RecoveryReplay + redrive
Hard rule
Delivery metadata is not business meaning.
Non-negotiable
The producer owns the event schema. Consumers own offsets, retries, idempotency and dead letters without redefining what the event means.
A broker cannot create exactly-once business meaning. Transactional publication at the producer and idempotent effects at the consumer do that work.
Contract anatomy
Identity, time, type, version and trace.
A durable envelope lets a consumer reject incompatibility, deduplicate delivery, reconstruct causality and choose the correct interpretation during replay.
Evolution
Compatibility fixtures distinguish additive change, supported version transition and breaking meaning change.
Access
Publish and consume grants are scoped by resource and identity; a topic name is not an authorisation system.
Routing
Consumers own subscriptions and filters. Producers do not encode a list of downstream workflows.
Replay
A replay names range, schema interpretation, destination and deduplication policy before it starts.
Dead letters
The original evidence, failure reason and redrive decision remain inspectable rather than disappearing into logs.
Failure model
Duplicates are expected. Duplicate effects are a defect.
At-least-once delivery is handled deliberately. A consumer records the stable event identity with its effect, or uses an equivalent atomic boundary, so a retried delivery is observable but harmless.
- Can an incompatible event fixture fail before deployment?
- Can an unauthorised identity be shown failing to publish or consume?
- Does the outbox survive relay interruption without losing intent?
- Can a duplicate event be proven to produce one business effect?
- Can dead letters be inspected, corrected and redriven into a bounded target?
- Can a replay run without overwriting original source evidence?
Next pillar