Start here
Decisions and open gates
Locked v1 architecture decisions and implementation selections that still require validation.
v1 design baseline. This page specifies intended behavior. Delivery and validation are tracked in the implementation plan; it is not a claim that the platform is already implemented.
| Decision | Locked v1 position |
|---|---|
| Deployment topology | Central SaaS control plane; separate runtime clusters; the pilot organization gets a dedicated intrnl-operated cluster. |
| Execution isolation | All customer code is untrusted; disposable sandboxed builds; workerd runs inside an OS/VM-level sandbox. |
| AI integration | Organization-aware remote MCP endpoint; users bring approved AI clients/accounts; intrnl does not proxy consumer subscriptions. |
| Identity | intrnl acts as identity broker; the pilot organization uses Entra OIDC first, JIT provisioning, group/app-role mapping, and later SCIM. |
| Source management | Managed source defaults to hidden Forgejo; external Git is optional; exactly one writable source of truth. |
| Runtime contract | Nuxt first, Workers-compatible workerd runtime, explicit bindings, no arbitrary Node/container environment. |
| Data operations | Isolated SQLite database per app environment; controlled migrations, backups, previews, restore, and export. |
| Governance/economics | Capability- and risk-based governance; creator/developer pricing plus platform capacity; application consumers are not paid seats. |
These decisions are sufficiently settled to build against.
A few implementation selections remain deliberate Phase 0 validation gates rather than architectural ambiguity:
- Kata/Firecracker versus gVisor as the actual sandbox RuntimeClass.
- The infrastructure vendor and region.
- Exact request, build, storage, and retention quotas.
- The final separate domain used for customer application origins.
- The exact commercial price points.
Recording decisions
Phase 0 produces ADRs for the sandbox, runtime compatibility, DB semantics, Entra mappings, MCP client compatibility, source adapter, routing/TLS, and artifact signing. Each ADR records context, alternatives, evidence, decision, consequences, owner, and review date. Track unresolved selections in the decision register.
Pilot retention proposals and the 128 MiB compatibility test profile are inputs to validation. Final contractual limits, retention, and prices remain open.