4. Solution strategy
4.1 The shape in one paragraph
Modgud authenticates and issues — the stateful, core-touching front-channel ceremony (login, OAuth/OIDC endpoints, sessions, and later SAML). The core (on Wyrd's metadata tier) holds only the irreducible: issuance, uniqueness, and freshness-critical revocation. Vör verifies at the edge against public keys, a clock, and cached status lists, touching no core. Forseti decides authorization over a Zanzibar-style relation graph, fenced by a consistency token where read-your-writes is required. A thick SDK propagates that token across services. The differentiator is the edge-verification composition, not any single component — and the line between the stateful issuance side and the stateless verification side is the seam every feature is filed against.
4.2 Quality goal → strategy → decision
| Quality goal | Strategy | Recorded in |
|---|---|---|
| Verification correctness & security | A verification contract with no core handle; the edge-independence property test; DST | ADR-0010, ADR-0002 |
| Edge scalability / core-independence | The Modgud / core / Vör split; verification reads only public material + cached projections | ADR-0001, ADR-0009 |
| Revocation freshness & operability | Short-TTL-dominant + signed status list + NATS, as CQRS projections of a core-resident set | ADR-0005, ADR-0022 |
| Scale range | Pluggable backends behind traits, with embedded dev impls | ADR-0013, ADR-0024 |
| Standards interoperability | OIDC-conformant token + a certification target | ADR-0003, ADR-0025 |
4.3 Build strategy
Not bottom-up. A vertical slice through the layers that matter for one operation (a single auth-code+PKCE login ending in edge verification with the core unavailable), then widen by risk. Trait seams exist from day one even where crate boundaries do not. The full ordering is the implementation arc — see section 9 and the proposals.