Vord

Architecture Decision Record

0009. The admission plane — name and role (Móðguðr)

Context

ADR-0001 named the verification, authorization, and credential planes (Vör, Forseti, Troth) but left the admission / access-decision component name [OPEN]: "Syn" (the hall-door goddess of denial) was the natural choice and was rejected for colliding, spoken, with sync — a word an identity system uses constantly. The component still needs a name, because it is load-bearing and is referenced by the architecture document, every diagram, and several ADRs that follow. Naming it also forces the more important question into the open: what is this plane, and which side of the constitution's line does it sit on?

The answer dissolves the apparent tension between the constitution and the stateful protocols an identity platform must speak (OAuth authorization endpoints, login ceremonies, SAML front-channel, SSO sessions). The constitution (ADR-0001 rule 1) governs the verification hot path — it forbids a core read there. It says nothing against a stateful, core-touching issuance path, because issuance is not the hot path: it happens once per login, not once per request. The admission plane is precisely that issuance side. Naming it cleanly is what lets every future feature be filed against a single seam: front-channel issuance (this plane) versus edge verification (Vör).

Decision

Role

The admission plane is the stateful issuance-and-login plane. It owns:

  • the OAuth 2.0 / OIDC authorization and token endpoints (ADR-0014);
  • the login ceremony — credential verification by the pluggable authentication methods (ADR-0015);
  • the SSO session — the front-channel anchor that lets one login mint many tokens across relying parties (ADR-0016);
  • later, the SAML IdP front-channel and upstream-IdP federation (ADR-0017, ADR-0019).

It may read and write the strongly-consistent core — issuance is exactly the irreducible write rule 2 permits — because it is not the hot path rule 1 protects. Its sole obligation to the constitution is that everything it emits is constitution-conformant: short-TTL, status-list-revocable, edge-verifiable against public key material and a clock (ADR-0003, ADR-0005). It hands those artifacts to Vör and never asks Vör to consult it. This is the seam: issuance is stateful and core-touching; verification is stateless and core-independent.

Name — Móðguðr ("Modgud")

The plane is named Móðguðr (anglicised Modgud), the maiden who guards the bridge Gjallarbrú over the river Gjöll on the road to Hel and challenges every traveller for their name and their business before granting passage. She is, literally, an admission challenge at a threshold — the access decision personified. The identifier form modgud is short, hard-edged, searchable, has no known collision in the software or identity namespace, and pairs tonally with Vör, Forseti, and Troth from the same mythic stratum.

Two well-known gate-figures were considered and rejected, recorded so they are not relitigated under the same screen that removed "Syn" and "Vár" in ADR-0001:

  • Heimdall, the watchman at the gate of Asgard, is semantically ideal but collides heavily with existing authentication and reverse-proxy products already named Heimdall/Heimdallr. It is the Syn-class hazard, sharper because the collision lands squarely in Vord's own domain — an unsearchable, confusing name exactly where clarity matters most.
  • Valgrind, the gate of Valhalla, collides with Valgrind the ubiquitous C/C++ memory-analysis tool — unsearchable in any programming context, the precise defect that disqualified "Vár" (the reserved word var).

Consequences

  • The constitution's scope is now unambiguous in prose and in naming: rule 1 governs Vör; Modgud is the stateful side it explicitly does not govern. A reviewer can file any proposed feature on one side of the seam or the other.
  • The hardest roadmap protocol, SAML (ADR-0017), inherits its home for free: it is a Modgud front-channel concern, and the constitution question "does SAML violate rule 1?" is answered no by construction, because SAML never reaches Vör.
  • [OPEN] from ADR-0001 (the admission-component name) is resolved. Crate/handle availability for modgud (and the other component names) is verified before first publish, per ADR-0001 — availability shapes the handle, never vetoes the name.
  • The name is decided here while this ADR is Proposed: it can still be changed before acceptance, but the architecture document and diagrams may use "Modgud" from now, since changing a Proposed decision is a cheap edit (ADR-0007).