Prompt & Configuration Registry  ·  View 07 of 21  ·  Structure

Platform Components

Five planes inside the registry, and the edges that are absent on purpose.

Editable source SVG draw.io All views
Registry platform — Kubernetes (self-hosted) Authoring plane — transactional, may be unavailable Registry Console React Config API Go Review service Authoring store PostgreSQL / Patroni Build plane — everything happens here, nothing at resolve time Build controller Argo Workflows Validator schema · policy · lint Secret scanner Signer OpenBao transit Release plane — the only writer of pointers Gate engine Pointer controller Experiment controller Audit writer Distribution — read-only to everything downstream Artefact registry OCI, content-addressed Object store MinIO, Object Lock Pointer store etcd, 3-node quorum Change bus NATS JetStream Evidence plane — droppable telemetry, durable audit Exposure collector Buffer Kafka Exposure store ClickHouse Audit ledger WORM, 7 years AI feature service resolver SDK inside Git repository Forgejo Evaluation service Keycloak SPIRE build version pointer write pull by digest Platform Components — Container View Application we own Interface / broker Data store Security / platform Decision point Queue / topic External / third party synchronous event / async Omitted for legibility: the Git webhook into the Config API, the gate's call to the evaluation service, and the signer's push into the artefact registry — all drawn on views 08 and 09. Absent by design: any edge from the authoring store downstream, or from the application into the control plane. v 1.0 · owner Platform Architecture · d 2026-09

The boundary, drawn

  • There is no edge from the authoring store to anything downstream, and none from the application runtime back into the control plane. Those two absences are the architecture (ADR-01).
  • The distribution tier is the only thing the fleet touches, and everything in it is read-only to a consumer: content addressed by digest, a pointer, and a notice.
  • The signer is in the build plane but holds no key: it calls OpenBao under a sign-only role, so a compromised build controller can sign but cannot exfiltrate (ADR-12).

Assumptions

  • Argo Workflows is already the organisation's job runner; the build plane is a workflow, not a new scheduler.
  • An OCI registry is available and content-addressed storage is idiomatic here, so a bundle is an OCI artefact rather than a bespoke blob format (ADR-06).

Deliberate omissions

  • The Git webhook, the gate's call to evaluation, and the signer's push into the artefact registry are on views 08 and 09 — drawn here they made four arrows share one run and said nothing extra.
◀  Layered Architecture All views Integration Surface  ▶
Solution Architecture v1.0 · open source, self-hosted on Kubernetes · Platform Architecture · 2026-09 · 21 views · 17 architecture decision records07-platform-components