Docs

Declared gaps

An architecture document that names its gaps is reporting engineering; one that does not is marketing. These are the open items in the reference implementation, each with a holder and a trigger in the design record.

  • Wildcard certificates are not provisioned. A publishing cluster mints hostnames a third party resolves, which costs a certificate the platform does not yet obtain; the managed cluster in the reference is handed one by hand.
  • The CDN harness's control-plane half is not built. A page needs /api fronted at its own origin, so the page is declared absent in the environment that lacks it rather than deployed broken.
  • Local TLS trust in the web dev loop. The minted host is https by convention and a local cluster's certificate is its own, so the dev server meets a certificate nothing on the machine trusts. Either verification is declined for a loopback base, or the platform places a local authority.
  • No variant kind fits "somebody else's image with a layer of ours." The gateway image is the public Kong image plus two plugins, one of which is built from Curity's proprietary sources and so cannot be vendored into a repository. It stands in as a registry reference, pinned by content digest, until a variant kind fits the shape. This is the concrete friction the Curity licence imposes, and it is the only build in the stack that is not reproducible from the repository alone.
  • A self-referencing origin must be dialable from inside the pod. The token handler exchanges the authorisation code server-side, resolving the endpoint from the configured base URL — so that value names both the origin a browser uses and the origin the process dials itself at. Where the two disagree the login fails late, and nothing earlier in the flow shows it.
  • Nothing reports an object that arrived from outside the platform. The deploy records per-object ownership and reconciles its own artifacts, deliberately never touching a stranger's — which is correct behaviour and leaves a question unanswered: what is in this namespace that we did not put there? Every refusal §4 lists rests on somebody answering it, so an unowned object applied by hand silently defeats the mechanism it evades. The owned set is already enumerable from the deploy record's labels, so this is a report that does not exist rather than a subsystem that is missing.
  • The blueprint facility is designed and not built. What guides an agent through a change — parameterised plans over inert templates, each carrying a mandatory review step that has to return satisfied before the step counts as done — is designed and deferred. Today's editing surface is the declaration files plus validate, so what disciplines an agent's work is the small surface it writes and the checks above, not a blueprint's own gate. The claims in §5 are about the first of those, not the second.
  • There is no streaming driver. §6.4 recommends Redpanda for event streaming, and a broker can be declared as an ordinary online-service component — but nothing generates a client for it, and there are no constructs that declare topics and their shapes the way endpoints and state variables are declared for the surfaces and stores. Until there are, a system that streams writes that part by hand, outside the guarantees the rest of the document claims.
  • No cross-component atomicity — by design rather than by omission, restated here because it is a property an architect must plan around. See §7.2.