Architecture that makes ownership executable.
Two planes, two seams and five pillars establish who owns each fact, which contract crosses each boundary, what evidence permits change and how the last accepted state is restored.
A platform is a set of enforced contracts.
Infrastructure matters, but the reusable asset is the ownership model that lets applications, data products, models and agents change independently.
A client deployment supplies naming, sources, business entities, policies, model objectives and agent authority. It does not remove the controls that make those choices governable.
Nothing constructs a name it can resolve, redefines a fact it does not own, or takes an effect beyond its declared and current authority.
Separate the blast radius. Name the cooperation.
The App Plane serves operational work now. The analytical plane preserves and interprets what happened over time. Discovery answers where a capability lives. Events state what happened.
The selected vendors are mappings. These ownership boundaries are the architecture.
Every arrow has an owner and a compatibility decision.
Traceability is not one lineage product. It is the ability to connect the identities and versions across an end-to-end path.
| Boundary | Producer owns | Consumer receives | Failure contained |
|---|---|---|---|
| Discovery | Deliberate capability handle | Stable versioned reference | Generated names and credentials do not spread |
| Events | Typed business statement | Compatible schema and replay identity | Consumer processing cannot rewrite meaning |
| Data | Preservation, entity and semantic contracts | Governed read surface | Route and presentation logic do not become truth |
| ML | Objective, evaluation and promotion verdict | Versioned serving bundle | A file copy cannot silently become production |
| AI | Context authority, grants and policy verdict | Auditable decision and bounded effect | Prompt text cannot grant authority |
One state change, all the way to an authorised effect.
The journey exposes every owner, control and recovery point without pretending one tool should own the chain.
Commit
The service writes business state and an outbox record transactionally.
Publish
A relay emits a typed event with identity, schema and trace context.
Preserve
Ingestion retains original evidence and creates route-independent Bronze.
Reconcile
Declared key, sequence and history behaviour produce a governed entity.
Interpret
Gold grain and semantic measures establish shared business meaning.
Learn
Point-in-time features and evaluation produce an explicit model verdict.
Reason
Governed structured data and current knowledge support a bounded proposal.
Authorise
Policy and required approval create a decision record before the effect.
Observe
Business, trace, model and decision identities connect the complete path.
Recover
Each layer rolls back, replays or restores from its own accepted boundary.
“Production-ready” is not an assurance level.
Every claim is classified by the strongest evidence it has actually earned. Founder-led experience remains a separate origin and is never relabelled as a Substrada client engagement.
See the assurance modelThe boundary and intended control are documented.
Source and tests enforce declarations and selected failures.
A representative integrated path and recovery have run.
Defined behaviour is accepted under production conditions.