7. Deployment view
The deployment shape is the constitution made physical: stateless verification at the edge, stateful issuance regional, and the strongly-consistent domains — the Wyrd-backed identity core and the Forseti relation store (ADR-0026) — kept central, off every hot path. The full decision is ADR-0024; the diagram is diagrams/deployment-topology.mermaid.
7.1 Topology
- Edge verification nodes (Vör) — stateless, horizontally scalable, holding only public key material (cached JWKS) and cached status lists; deployable worldwide, close to relying parties. The rule-1 hot path.
- Regional admission nodes (Modgud) — stateful issuance/login, near the user, holding the region-local session (sessions live at Modgud regions; the edge is Vör, everywhere else).
- The core — issuance/uniqueness/revocation on Wyrd's metadata tier. With Forseti deployed there are two strongly-consistent domains, not one: the Wyrd core and the Forseti relation store (its own backing database), each tenant-sharded with its own residency and fence (ADR-0026).
- The authorization engine (Forseti) — SpiceDB/OpenFGA as a service, or embedded Cedar in dev.
- NATS — urgent revocation and identity-event transport; its connections are mTLS/workload-identity authenticated (ADR-0035), and edges hold subscribe-only credentials.
7.2 Profiles
| Profile | Composition | Use |
|---|---|---|
| Single-binary dev | embedded keystore + embedded Cedar + in-memory directory/core behind the seams | development and evaluation only — no production promise |
| Small multi-node | real KMS, a Zanzibar engine, a Wyrd metadata deployment, real NATS | a single-region production issuer |
| Global edge fleet | worldwide Vör nodes, regional Modgud, the core on Wyrd multi-region | the global identity substrate |
The binaries are per-plane: the edge deployable is a verifier-only binary —
the reserved vord-edge split
(ADR-0013) — that never links the
core client, so the edge's blast-radius story stays "no capability", not merely
"no credentials".
7.3 Residency and substrate
Per-tenant data residency is placement-over-subtree (Wyrd ADR-0018 §2, ADR-0012): a tenant's core pins to a region; edge verification stays global because it is core-independent. The substrate is pluggable with no orchestrator lock-in (the same binary under systemd, compose, or k8s); the ADR-0008 control-resilience test recommends operator-controlled orchestration and flags managed KMS and managed k8s as convenient-but-captured.