Infrastructure

Small surfaces with named ownership.

The working pilot is intentionally more complete than a single-container demo, but each component exists to preserve a specific boundary or operating behavior.

Last verifiedAugust 10, 2026
ScopeCinch application and public-marketing repositories
PostureCurated public engineering snapshot

Working topology

Six layers. One explicit constraint.

Provider account details, credentials, internal addresses, and recovery commands stay private. Responsibilities, trust boundaries, maturity, and known limits are public.

01Exercised
Public edge

Independent marketing runtime

Serves cookie-free public content and the feature board without product sessions, product secrets, or tenant data.

Boundary

Independent source, database binding, deployment identity, versions, and rollback history.

02Exercised
Account plane

Stateless web pair

Provides sign-in, workspace discovery, and authenticated application traffic with host-local authority.

Boundary

At least two serving instances; immutable, readiness-gated blue/green replacement.

03Exercised
Workspace plane

Tenant-routed application

Carries explicit workspace context through reads, mutations, browser state, and synchronization authorization.

Boundary

Host-only sessions, tenant-aware data policy, and short-lived scoped exchange.

04Exercised
Data plane

Authoritative relational store

Preserves durable collaboration state and tenant policy while feeding a rebuildable synchronization replica.

Boundary

Managed primary, logical replication, scoped roles, restore and replica-rebuild procedures.

05Known constraint
Sync plane

Stateful real-time service

Maintains the pilot real-time path and local working set without joining routine web releases.

Boundary

Currently a volume-backed singleton; multi-node view sync is a planned resilience milestone.

06Exercised
Evidence plane

Release and operating controls

Turns source identity, image policy, readiness, security, journeys, recovery, and cost into reviewable artifacts.

Boundary

Least-privilege identities, automated gates, immutable evidence, and operator release authority.

Tradeoffs

Enterprise foundations without enterprise theater.

The topology is assessed by the failure behavior it enables—not by the number of services in the diagram.

KEEP

Independent public delivery

A marketing change cannot receive product credentials or rebuild the application.

KEEP

Two-instance web floor

A complete candidate fleet can become ready before authenticated traffic moves.

IMPROVE

Stateful sync availability

The current singleton is transparent; multi-node view sync requires its own staged failure proof.

MEASURE

Recovery behavior

Restore, rollback, rebuild, reconnect, and hydration need separate signals and budgets.

Next chapter

Follow a reviewed revision through blue/green promotion.

Delivery discipline