Vord

Architecture Decision Record

0022. The identity event stream (CQRS) and the Wyrd-ADR-0018 boundary

Context

Wyrd ADR-0018 reserved hooks for this identity consumer but left one boundary explicitly open, to be settled "when the identity layer is designed": the boundary between Wyrd's append-only audit log and an identity CQRS event stream (ordered, replayable, projected) — i.e. which side owns ordering and replay. That moment is now. Identity is intrinsically event-shaped: issuance, permission grant, revocation, login, provisioning (ADR-0018), and admin action (ADR-0021) are all events, and Vord already treats two of its most important reads — the signed status list and the NATS revocation channel (ADR-0005) — as derived projections of an authoritative set. This ADR generalises that into a single decision about who owns the stream.

Decision

  1. Vord owns the identity event stream — its ordering and replay are a Vord concern, not pushed into Wyrd. This is constitution rule 4 (ADR-0001) as the decisive constraint: an accommodation that makes sense only for identity (CQRS ordering/replay semantics for principals, grants, and revocations) belongs in Vord's crates as a consumer of Wyrd's traits, never pushed down into Wyrd's core to avoid making Wyrd grow toward a "god component" for a second consumer.

  2. The whole identity model is CQRS-shaped. Generalising ADR-0005's status-list and NATS pattern: the events are issuance, grant, revocation, login, provisioning, and admin actions; the projections are Vör's verifiable inputs (status list, JWKS), Forseti's relationship state, SCIM-outbound feeds, the audit view, and billing/metering. Projections are eventually-consistent and edge-distributable; the event stream is the source of truth for ordering.

  3. Wyrd's append-only log is the durable backstop, not the event store. Vord builds the ordering and replay semantics in its own crate (the EventSink seam, ADR-0013); Wyrd's durable watch/append truth (Wyrd ADR-0007/§0018) underwrites durability and urgent fan-out (the NATS-with-Wyrd-watch-backstop division of labour ADR-0005 already adopts). Vord owns replayability; Wyrd owns durable truth.

  4. One stream, many consumers. Audit/compliance, billing/metering (the open item Wyrd ADR-0022 flagged), and the operational security/freshness signals are all projections of the same stream, not separate logs — so "who did what, when," "how much did this tenant use," and "is revocation propagating" read from one ordered source.

Consequences

  • The Wyrd ADR-0018 open boundary is settled: Vord owns identity event ordering/replay; Wyrd remains the durable backstop. Rule 4 is honored — Wyrd does not grow an identity-only CQRS engine.
  • Audit, billing, and revocation stop being three mechanisms and become three projections, which is cheaper to build and impossible to drift out of sync, because they derive from one ordered truth.
  • The EventSink emit-points exist from M0 (ADR-0013) even though the projections are built at a later milestone — the same "emit telemetry from the custodian milestone, build dashboards later" discipline Wyrd uses, applied to identity events.
  • Replay determinism (rebuilding a projection from the stream and getting the same result) is a testable property and a milestone definition-of-done, the CQRS analog of the conformance vectors elsewhere. That property forces event schema versioning from the first emitted event: every event carries its schema version (the ADR-0003 versioning rule applied to events), and projections replaying a years-old stream upcast old versions through registered migrations rather than guessing — otherwise the first schema change silently breaks the definition-of-done. Emitting versioned events costs nothing at M0; retrofitting versions onto an unversioned durable stream is a migration.