Calm, tenant-aware clients
Web and sync experiences keep navigation immediate while every workspace request carries explicit tenant context.
System design
Architecture that makes confidence inspectable.
Cinch is a working proof of concept for a resilient, multi-tenant collaboration system—and for the disciplined operating model used to build it.
Public edgeMarketingCookie-free boundary
Intentional handoff→
Account planeSign-in + discoveryHost-only session
↙Scoped exchange↘
Workspace planeTenant appLocal authority
Sync planeReal-time serviceShort-lived token
Infrastructure as codeHealth signalsRecovery drills
System map
Four layers. Explicit responsibilities.
Each layer has one job, a visible trust boundary, and evidence that can fail independently.
Narrow service responsibilities
Account discovery, workspace traffic, and synchronization are separate surfaces with explicit contracts and independent health signals.
Isolation before convenience
Tenant identity is enforced through the read, write, and sync paths; durable records preserve the context behind team decisions.
Evidence at every boundary
Infrastructure as code, release gates, external checks, and recovery drills turn operating assumptions into reviewable artifacts.
Resilience model
Design for the whole failure loop.
Resilience is the ability to prevent avoidable failures, notice real degradation, recover deliberately, and retain the lesson.
Prevent
Host isolation, scoped sync tokens, least-privilege deployment identities, and repository boundaries reduce the blast radius before failure.
Detect
External checks cover the public root, demo journey, sync path, and operations surface—not just whether a process is running.
Recover
Restore, rollback, and replica resynchronization paths are treated as executable procedures and rehearsed independently.
Learn
Incidents and meaningful tradeoffs feed tests, operating notes, and ADRs so the system retains what the team learned.
BoundariesExecutable, not decorative
SignalsIndependent at critical surfaces
RecoveryVersioned and understandable
LearningPreserved in tests and decisions
Deployment strategy
One approval. A bounded, evidence-backed release.
The target operating model lets the operator approve a defined outcome, then allows an agent to build and deploy independently inside that authorization.
- 01Frame
Agent turns demand into scope, risks, acceptance criteria, and an ADR when the choice is consequential.
- 02Authorize
The operator approves the delivery envelope and release authority before implementation begins.
- 03Build
Agent implements within a bounded repository, preserving system and trust boundaries.
- 04Prove
Automated gates assemble build, test, security, journey, and recovery evidence.
- 05Release
The exact validated revision is promoted as a versioned deployment with rollback retained.
Approved architecture evidence
The public architecture record follows the proof.
Only operator-reviewed application claims appear here, with their exact maturity and remaining limits intact.
Health-gated blue/green application releases
Application releases use a blue/green strategy. The complete replacement web fleet and fresh SBOM-backed image policy must pass before traffic is promoted, the prior image is retained as rollback evidence, and routine application releases leave the real-time sync service unchanged.
Why it matters
Health-gated promotion reduces release risk for authenticated customers while separating routine product delivery from maintenance on the stateful real-time sync tier.
Scope and limits
Releases on 2026-08-10 exercised healthy replacement Machines, immutable identity, public checks, the private Zero hop, and unchanged Zero. On 2026-08-11 refreshed vulnerability data blocked two candidates without an exception or promotion. Later, evidence-backed OpenSSL dispositions yielded zero blocked findings; source 70e27f0ffa484fc0964f0672fc08a567d058adb0 passed the same gate, promoted two healthy Machines, passed all twelve public checks, and left Zero unchanged. Active-session continuity remains an evidence gap, so zero-interruption wording is not approved.
Infrastructure components
Small surfaces. Clear ownership.
Public edgeCinch marketing
Cookie-free public content with an independent build and rollback history.
Account hostapp.cinchme.app
Central sign-in and workspace discovery with host-only sessions.
Tenant hosts{tenant}.cinchme.app
Workspace-local sessions and explicit tenant routing.
Sync surfacesync.cinchme.app
Short-lived, tenant-scoped access for real-time synchronization.
DeliveryVersioned infrastructure
Isolated identities, preview releases, immutable revisions, and controlled promotion.
EvidenceAutomated gates
Boundary tests, security checks, health probes, benchmarks, and recovery records.
Code principles
Maintainability is an operating control.
Make boundaries executable
Critical architecture rules belong in tests and deployment policy, not only in diagrams.
Prefer boring failure modes
Small interfaces, explicit state, idempotent operations, and reversible changes make recovery understandable.
Optimize the path users feel
Local-first feedback and optimistic updates are paired with authoritative reconciliation and measurable sync behavior.
Keep decisions near the code
ADRs record the context, alternatives, decision, consequences, and evidence for consequential changes.
Bound agent authority
Agents work within named repositories, scopes, and acceptance criteria; the operator controls intent and release authority.
Prove the release
A passing build is necessary, but production readiness also includes isolation, security, journey, and recovery evidence.
Next: trust model