Phase 0: architecture spikes and ADRs
Status: planned; completion evidence not yet recorded in this documentation.
These spikes must finish before substantial production implementation.
Sandbox bake-off
Compare Kata/Firecracker and gVisor against:
- Escape/threat model
- KVM requirements
- Cold start
- Nuxt memory/build performance
- Workerd startup
- Network policy
- Debuggability
- Upgrade path
- Per-app cost
Exit: selected RuntimeClass and documented fallback.
Nuxt/workerd compatibility spike
Build representative Nuxt applications exercising:
- SSR
- API routes
- Static assets
- Streaming
- Cookies
- Authentication context
- DB binding
- KV binding
- Common packages
- Error handling
Exit: versioned supported Nuxt template and unsupported-package list.
DB binding spike
Implement:
prepare
bind
first
all
run
batch
over an internal RPC service backed by isolated SQLite.
Test concurrency, transaction semantics, WAL, backup, recovery, and multiple runtime replicas.
Exit: documented DB contract and performance envelope.
Entra spike
Create a test tenant integration representative of a pilot organization:
- OIDC code flow
- PKCE
- app roles
- assigned groups
- group overage
- JIT
- session revocation
- app login redirect
Exit: finalized claims/mapping design.
MCP spike
Connect both representative OpenAI and Anthropic clients:
- OAuth
- user/org selection
- read tool
- write tool
- scope denial
- deployment request
- revocation
- audit
Exit: stable remote MCP transport and OAuth design.
Source spike
Provision and operate hidden Forgejo:
- repo create
- branch
- commit
- diff
- merge
- export
- optional SSH
- backup/restore
Exit: source service adapter contract.
Routing/TLS/domain spike
Validate:
- Separate runtime apex
{app}.{org}hostnames- Per-org wildcard certificate
- Preview hostname scheme
- Cloudflare tunnel/origin protection
- trusted client-IP derivation
Exit: production routing/certificate ADR.
Artifact/signing spike
Build, sign, upload, fetch, verify, and activate an artifact.
Exit: manifest and key-management format.
Evidence to record
Record implementation revisions, test reports, relevant ADRs, unresolved findings, the accepting owner, and acceptance date. Leave this phase planned until its exit criteria are demonstrated.