Boundaries without a network hop: ten years of Shopify, read from its own artefacts

Reconstructs a decade of one company's architecture from artefacts rather than announcements: repository archive notices, release notes of the language it forks, design documents inside the reference implementation, adopter-filed defect reports and timestamps from five package registries. A reader leaves with the four locations a boundary can occupy, the conditions that move it between them, the failure classes each location brings, and a method for dating any vendor's architectural decisions when its engineering blog is unavailable.

What you get out of it

• Every boundary Shopify added went downwards into the build or the runtime rather than outwards onto the network, and the artefacts that made each one adoptable are the interesting part: packwerk's recorded-violations file, Tapioca's generated signatures, and a patch line named after each upstream Ruby release.
• The sandbox for merchant code was rebuilt for determinism, not only for safety: deterministic-wasi-ctx fixes the clock and the random source so a third party's function can be cached, which the previous seccomp-confined mruby process never allowed.
• A boundary check that runs in continuous integration is a production system with a capacity plan: an adopter measured packwerk's maximum resident set size rising from 83,560 KB to 334,968 KB between two minor versions and had to raise the resource class of its CI nodes.
• Forks in this corpus are loans with a planned repayment: the compilers moved into ruby/ruby, bootsnap into the Rails organisation and Javy into the Bytecode Alliance, while the artefacts that stayed private are the ones now carrying unmaintained notices.
• Shopify publishes no incident review inside its own repositories, so the only published failure record for this architecture belongs to its dependencies: ten Wasmtime advisories in fifteen weeks, one of them a High-severity filesystem sandbox escape patched across four release lines on one day.

Scope

Why this, now. Ruby 4.0.0 shipped Shopify's second JIT compiler in December 2025 with release notes advising against production use because it is still slower than the first one Shopify wrote, and the company began publishing a third-generation Ruby analysis toolkit in Rust in August 2025, so the runtime line of the decade can now be read with both of its endings visible.

What it does not cover. The commerce product, the data platform, machine learning, and any traffic, shard-count or cost figures, all of which live on hosts the research environment could not reach, so no engineering blog, conference talk or peer-reviewed paper is cited.