A trust platform for the space betweena problem and the app that solves it.

Every stateful service has its own database and its own migration chain, starting from its own first version. Where a service needs another’s data, it holds the identifier and a local read model behind a port it defines itself, so the shape it stores is the shape it needs, not the shape the owner happens to have.

The rule is not maintained by discipline. An ArchUnit rule fails the build if a service imports another’s persistence types, and after the physical split there is no shared schema left to reach into even by accident.

Trade-offEvery cross-service read is eventually consistent. Write-path checks like "does this app exist" become converging rather than certain, which is acceptable here and is written down where it applies rather than discovered later.

Queries run against local projections through plain SQL with Postgres full-text search over a GIN index. There are no ORM entities here on purpose: the read side has no domain to protect, so an object mapper would be pure overhead.

Two rules keep paging honest. Sorting is an enum, and the enum is the allowlist: an unknown value is rejected before any of our code runs, because the clause has to be interpolated into a native query and a client string must never reach it. And every ordering ends with the row id, because without a strict total order rows that tie on the sort column silently repeat or vanish between pages.

Trade-offAnything you want to search must first travel on an event. There is no convenient join to reach for when a new field is needed, which is the point, but it does mean a search feature sometimes starts in another service.

Collapsing it into a single criteria object and a single native query deleted nine now-dead repository methods and made the endpoint behave the way its own documentation always claimed it did.

The JSON attributes are queried by whole-document containment rather than field extraction (extraction cannot answer array membership at all), which also means one GIN index serves every JSON axis, present and future.

Trade-offOne larger query is harder to read at a glance than five small methods. In exchange, it is impossible for two filters to disagree about which one wins.

The fix is a per-property override on that one field, not a change to the global default, which is correct for everything else. Absence also got one representation: blank input is normalised to null in the command itself, so no reader ever has to test for two kinds of "no picture".

The part worth remembering is how it was caught. Mock-based tests passed either way: they were asserting on a mapper that was doing exactly what it was told. It took an integration test against a real database to show that the row never changed.

Trade-offEvery future optional-and-removable field needs the same explicit override, and a test that actually clears it. That is a small recurring cost, accepted because the alternative is a class of silent data bug.

A listener that runs before commit appends the event to the owning service’s outbox on the same connection. Rollback publishes nothing. Commit makes the event as durable as the data it describes.

A scheduled relay claims pending rows with SKIP LOCKED, which makes it safe to run several instances, stamps a stable event id used later for deduplication, and publishes keyed by the aggregate id so one aggregate’s events stay ordered.

Trade-offPublication is now asynchronous and slightly delayed, and the relay’s polling interval becomes a real latency knob. Change-data-capture would remove the polling; it is a recorded, deliberate deferral rather than an oversight.

For snapshot events this is a convenience: a consumer sets a value, so a replay converges anyway. For the two topics that carry a change rather than a state (a reputation adjustment, a contribution reward), it is the only thing preventing double-counting.

The reward path carries a second, independent guard at the producer: a once-only timestamp on the content itself. Consumer deduplication stops a redelivery; the producer stamp stops a publish → unpublish → republish cycle from rewarding twice. Two layers because a delta genuinely needs both.

Trade-offEvery consumer pays a small write per event, and the ledger has to be pruned eventually. Cheap, next to the class of bug it removes.

A single error handler serves the whole fleet: three backed-off attempts, then the dead-letter topic. Deserialisation failures skip the retries entirely, because retrying a payload that will never parse is just a slower failure.

Recovery matters as much as containment. The replay endpoint preserves headers, which means the original event id survives, so replaying a batch that was half-applied is safe, because deduplication still recognises what already landed.

Trade-offRetries are blocking rather than routed through retry topics. For low-volume idempotent consumers that is simpler and adequate; the upgrade path is written down for the day the volume argues otherwise.

The first call was built the careful way (typed HTTP interface, transport timeouts, retry, circuit breaker, bulkhead, an anti-corruption mapper and a graceful fallback), and its full breaker lifecycle was proven under a real outage of the dependency.

Then the owner started publishing the same data as an event, two consumers projected it locally, and the client was deleted. The transport library and the internal endpoint were kept rather than removed: they have no consumers today, and they are exactly what the next genuine synchronous need will use. The same stack now carries the moderation service’s publish calls.

Trade-offThe projected read is eventually consistent, so a write-path existence check can briefly disagree with reality. Accepted knowingly, and the affected paths are documented.

Downstream services never see the external provider. A single decoder bean in a shared starter switched all of them over at once, with no per-service code. The internal token lives two minutes, which is short enough that a leaked one is close to worthless.

The subtle part is the role. It is not copied from the external token: the gateway resolves it from the identity service’s own database, briefly cached, so a permission granted inside the product takes effect across the fleet within that window instead of on the user’s next login.

Trade-offThe cost is availability. When identity cannot answer, the edge refuses the request with a 503 instead of trusting the role the external token claims; an earlier version fell open there, and a resilience campaign closed it. Anonymous traffic is untouched and a thirty-second cache carries known users through a blip, so what is actually refused is an authenticated request for someone nobody has seen recently.

Propagation is derive-only: no new event, no read model, no synchronous call. The identity service exposes the derived value, the gateway stamps it as a claim while minting the internal token, and every service reads the claim. Adding a premium-gated feature is reading a boolean.

Entitlement itself is the union of a user’s active grants: a paid subscription, a promotional code, an administrative complimentary grant. A lapsing subscription therefore never downgrades someone who still holds a valid promotion, because the question "is this user entitled" is asked in one place and answered from all the reasons at once.

Trade-offThe claim is only as fresh as the cache window. That is a deliberate choice: a round trip to identity on every request at the edge is a much worse deal.

While the flag is off, checkout, the subscription lifecycle, the payment ledger, the plan list, the provider webhook and the administrative refund surface are all unreachable for everyone: user, administrator, anonymous alike. Two layers on one flag: the security configuration denies the routes, and the checkout use case refuses in-process, so no charge can be started even from inside the process.

The rest of the design assumes it will be turned on one day. No card data is ever stored; the hosted checkout form holds it. The amount is always resolved server-side from a plan identifier, never accepted from the client. Access is granted only from webhook-confirmed state, because a browser callback can be abandoned or forged and is not authority.

Trade-offCode that does not run does not get exercised. The switch order is therefore covered by a test of its own, so the outermost gate cannot rot while it waits.

Where a rule like this lives decides how far it reaches. The only library all fourteen bootable modules already shared was the observability one, and the security starter cannot be added to the gateway at all: it drags in the servlet stack, and a reactive gateway refuses to start when it finds that on the classpath. Opening a new module was better than hiding a security rule inside a jar named for something else.

The sharpest finding was a committed default that worked. The identity provider’s key endpoint defaulted to a live development tenant, so forgetting to set it in production would not fail: it would quietly accept that tenant’s signatures, making anyone who had signed up there a valid user here. When a default is unavoidable, choose one that cannot work — a reserved invalid host — over one that works against the wrong thing.

Trade-offFourteen modules now refuse to start on a missing key, which is a worse first deployment and a better second year. The failure is loud, immediate, and names the key.

Two dependency overrides survive, and each carries its removal condition in a comment rather than in someone’s memory: delete it the day a scan is green without it. Suppressions are held to the same standard. The file requires a statement and an expiry date, and the scanner enforces the date, so an entry stops silencing anything when it lapses and the gate goes red on its own.

Build inputs are dependencies too. A workflow action tag is a movable pointer: if it moves, different code runs against our checkout with our token, and nothing in our diff changes, so actions are pinned by commit. The build wrapper verifies the archive it downloads by hash, because transport security authenticates the server and not the artefact. Image bases are pinned as well, without which scanning them means nothing: one machine had quietly accumulated seven builder images and five run images, and nothing recorded which one any given build had used.

Trade-offOne scanner rather than two. Two would have meant two vulnerability databases, two thresholds and two suppression files to keep in agreement — exactly the divergence this codebase keeps paying for elsewhere, imported into the supply chain.

The account-deletion event had two consumers and both did the same small thing: drop a projected display name. The name vanished and the content did not, so every assistant conversation, with its full prompt and full answer, stayed keyed to the deleted user indefinitely. Deletion now reaches the content, and it reaches the duplicate first: an evaluation record embeds the same material verbatim and has no user column of its own, so it has to go inside the same transaction and before the row that joins it.

Deleting is not the right answer for every class, and saying which is the point. A private conversation is deleted. A public contribution stays and is de-identified when read, because removing it rewrites other people’s pages. A vote stays, because it is an input to a number that has already been published. Payment records stay because the law requires it. Separately, a log line is a second copy with no owner, no retention and no way to honour a deletion request, so what travels there is the pseudonymous identifier — and the worst offender was the default: a stand-in email sender logged one line per recipient, so every broadcast wrote the user directory into the log.

Trade-offDe-identifying at read time costs a lookup on paths that used to join a name directly. It is the only version that leaves everyone else’s history intact.

The first live measurement looked like a regression: an anonymous health request returned a full component breakdown, a leak that had been closed days earlier. It had not regressed. The images were tagged two hours before that fix landed, and none of the five phases after it existed in any container, while every check in the source tree was green. An image repository goes stale silently under a moving tag, so every service now stamps its build and a check refuses a fleet older than the code it claims to run.

Two suites were red or absent and nobody could have known, because nothing ran them. The frontend header suite had neither a script nor a workflow. The deep end-to-end tier triggers only on a release tag, and this repository has never had one; its first real run against a live fleet found two fresh defects that reading the source could not have found, because in both cases the source looks right. A catch-all handler was turning framework-level bad-request exceptions into server errors from an anonymous endpoint, and the one module that cannot inherit the shared error contract turned out to be the internet-facing one.

Trade-offTesting the running system is slow, needs containers, and cannot run on every commit. So it is a tier with its own trigger — and the lesson recorded beside it is that a trigger nobody pulls is the same as no test.

The domain is plain Java with no framework in it, which is what makes the score engine testable as arithmetic rather than as a Spring context. The persistence model is separate from the domain model on purpose: an ORM annotation is a storage concern and has no business shaping a business rule.

Transaction boundaries live only in interactors, errors are RFC 7807 problem documents, and each service owns its own migration chain. The layering is checked by ArchUnit rather than by review, so it stays true on a tired Friday.

Trade-offMore files per feature than a pragmatic three-layer service. Worth it at thirteen services; likely over-built at one.

So there is only one gate: the existing status lifecycle answers "is this publicly visible". What changed is when events fire. The public streams no longer publish on creation, when the entity is not public yet, but on approval, and unpublishing emits the removal tombstone instead. Downstream consumers added no filter at all; they simply now receive events only for things the public can see.

That shift exposed a whole bug class. Every write path that changes visibility has to emit the event, and one administrative endpoint did not, so an item rejected through it stayed live in the search index and in the assistant’s corpus. The fix emits on the visibility transition itself rather than trusting each caller to remember.

Trade-offApproval is a human bottleneck, and bulk actions had to be built for it, with honest partial-success reporting, because a batch that reports "done" when eleven of twelve succeeded is worse than no report.

The asymmetry is the whole design. The application reaches the broker and the database through the proxy; the test’s own consumer connects directly. So a test can take Kafka away from the application, watch the outbox accumulate with its retry counts, restore the broker and assert that it drains, all while its own verification path stays alive.

One non-obvious detail makes it work at all. A Kafka client bootstraps against one address and is then handed the broker’s advertised address, which it connects to directly, so proxying only the bootstrap address proxies nothing. The broker is therefore started advertising the proxy’s own host port, which puts both bootstrap and data path through it. Without that, cutting the proxy cuts nothing and the test passes for the wrong reason.

Trade-offThese tests deliberately spend real seconds inside outages, so the tier is tagged and excluded from the default build. The fast inner loop stays fast; chaos runs under its own profile.

The corpus is the app, problem and match triangle, projected into the AI service from the same events every other service consumes. Retrieval is approximate nearest neighbour over multilingual embeddings, with the index tuned so recall does not quietly collapse when filters narrow the candidate set.

The application layer never knows which provider is answering. Two lessons are baked into that boundary. Asking a model to "return JSON" is not a contract: it wraps output in a code fence and the parse fails; prefilling the opening brace passes the first test and then dies on an unescaped quote inside a string value, a failure prefill structurally cannot prevent. The permanent fix is constrained decoding against a schema, which makes invalid output unrepresentable rather than merely discouraged.

Trade-offGrounding strictly in our own content means the assistant will say it does not know rather than guess. That is the correct behaviour here and it is still, occasionally, a worse demo.

Four layers run in order at the top of every spending use case: a rolling short window, a weekly ceiling, a global daily cap and a cumulative fuse. Reads fail closed, so the wallet never opens because a database was briefly unreachable, and a window only opens on a request that passed every layer, so a refusal never starts someone’s clock.

Cost is computed in exactly one place, the provider adapter, and a model with no price entry refuses to boot: something whose cost cannot be computed must never serve traffic. Separately, an expensive automated path was not gated but removed: the safest budget guard is not having an unattended spender.

Trade-offSumming a ledger on every request costs a query. It is cheap next to the model call it protects, and it is the only version of the number that is true.

Harvested public data is normalised into neutral platform content and written through the owner’s normal write API, where it lands pending review like anything else. The seeder does not reimplement moderation; it feeds it. Re-run safety comes from a provenance ledger keyed by source and external id, not from event deduplication: it consumes no events and produces none.

It also has no public surface at all: no gateway route, no external API, only a network-isolated operator endpoint. A component that writes on everyone else’s behalf should be reachable by as few people as possible.

Trade-offA seeded catalogue with no scores looks emptier than one with invented ones. That is the honest state of a platform before it has users, and showing it is the point.

Three choices carry it. A Bayesian prior pulls thin samples toward the middle, so three enthusiastic ballots do not produce a perfect ten. Recency decay weighs old opinions less, because software rots, but it has a floor, because an old assessment is not a worthless one. And the per-axis breakdown is published alongside the headline, because one number never answers "why".

The engine takes ballots and a timestamp and returns a result. No repository, no clock, no configuration lookup, which means it is tested as arithmetic, and the same inputs always produce the same output. The scores that other services cache arrive as events carrying the computed value, so a redelivery converges instead of accumulating.

Trade-offRegularisation makes new matches look unremarkable for a while. That is honest: a score from three ballots should not look like a score from three hundred.