Vord

Architecture Decision Record

0024. Deployment substrate and edge topology

Context

The constitution is, at bottom, a statement about where things run: verification at the edge, the irreducible core somewhere central, and a clean line between them. That has a deployment shape, and fixing it now keeps the architecture document and the operational story honest. Vord also inherits Wyrd's substrate posture (pluggable, no orchestrator lock-in — Wyrd ADR-0010 — and a single-binary profile for dev/eval only — Wyrd ADR-0014) and must say how its planes map onto real nodes at the three scales it targets, up to the global, millions-of-users end (ADR-0012).

Decision

  1. The topology mirrors the plane model.

    • Edge verification nodes (Vör): stateless, horizontally scalable, holding only public key material (cached JWKS) and cached status lists. The rule-1 hot path; deployable anywhere, close to relying parties, worldwide.
    • Regional admission nodes (Modgud): stateful issuance/login, near the user, holding the edge-local session (ADR-0016) and talking to the core for the irreducible writes.
    • The core: issuance/uniqueness/revocation on Wyrd's metadata tier — the strongly-consistent identity domain (ADR-0001 rule 2).
    • The authorization engine (Forseti): SpiceDB/OpenFGA as a service (with its own strongly-consistent backing store — the second consistency domain, ADR-0026), or embedded Cedar in dev (ADR-0006).
    • NATS: the urgent revocation/event transport (ADR-0005, ADR-0022).

  2. Three profiles, one codebase (the Wyrd ADR-0010/0014 idiom): single-binary dev (embedded keystore + embedded Cedar + in-memory directory and core behind the seams — the M0 profile, dev/eval only, no production promise); small multi-node (real KMS, a Zanzibar engine, a Wyrd metadata deployment, real NATS); global edge fleet (worldwide Vör nodes, regional Modgud, the core on Wyrd multi-region).

  3. Per-tenant residency is placement-over-subtree (Wyrd ADR-0018 §2, ADR-0012): a tenant's core data pins to a region; edge verification stays global because it is core-independent. Residency constrains the core's location, never the edge's reach — the deployment expression of the constitution.

  4. Apply the ADR-0008 selection criteria to the substrate. No coupling to Kubernetes APIs (the same binary runs under systemd, compose, or k8s — Wyrd ADR-0010); recommend operator-controlled, self-hostable orchestration; and flag the control-resilience wrinkles — managed KMS (ADR-0023) and managed k8s are convenient but operator-captured, named as such rather than defaulted to.

Consequences

  • The constitution becomes a deployment diagram: stateless Vör fans out to the edge, stateful Modgud sits regional, and exactly one component (the Wyrd core) is strongly-consistent — the picture an operator and a reviewer can both check.
  • Scale range (goal 4) is two-backends-behind-a-seam, as in Wyrd: the dev laptop runs the whole thing in one binary; the global fleet is the same code with distributed concretes wired in vord-server (ADR-0013).
  • The edge fleet is the late "widen" milestone (M8); single-binary is M0. Because the seams are fixed from the start (ADR-0013), moving along the profile range is composition, not rewriting.
  • Residency, edge reach, and the managed-substrate wrinkles are stated, so an operator with data-sovereignty obligations can deploy Vord correctly without reverse-engineering the constitution from the code.