MeshWeaver is a distributed platform for building data-driven applications with AI capabilities. A handful of principles hold the whole system together:

Platform overview

Core concepts

Topic map

Each theme starts with its introductory page, followed by related architecture topics.

Reactive core

• Start here: Asynchronous Calls — the no-await rulebook
• Actor Model
• Turn-Loop Arrival Order — a hub has TWO queues and a delivery moves between them at turn time, so a turn can be in neither when the last gate opens; the permutation names which message straddled the window, never which defect is live
• Controlled I/O Pooling
• Subscription Ownership — a pending timer is a GC root
• Silent Completion — an empty completion is invisible to every timeout
• AsyncLocal Across Scheduler Hops
• Initialization Gates
• Aggregating Providers
• Hub Disposal Model
• Transient Node Probes — a probe hub's own address is not a node
• Executive Assistant Credential Reads — a turn that waits for a mesh read holds the queue that read's reply must travel through, and the timeout was rendered as "you never connected"
• Bounds Must Be Ordered
• Message-Based Communication
• No Static State
• Observable Hub Pipeline (migration design)
• Per-Hub TaskScheduler — Actor Isolation Across the Mesh
• Removing Hand-Woven Concurrency Gates
• Removing Observable-to-Task Bridges
• JSON Serialization

Reading & writing nodes

• Start here: CQRS — Queries vs. Content Access
• MeshNode Stream Cache
• Update Queue Ownership — one published queue per path, retained until accepted work settles
• Request via Stream Update
• Data Access Patterns
• Node Identity and Path Keying — (namespace, id) is the key and path is derived, so splitting a path positionally leaves the path identical while re-keying the node into a second row
• Workspace References
• Content Chunk Navigation
• Moving Nodes — a move relocates the node and everything that belongs to it, or it refuses
• Copy Completeness — a copy asserts a set equality it never established; the two readings that turn a short enumeration from a silence into a number, and why the failure stops instead of rolling back
• Moved-Node Redirects — keeping links alive after a move
• MainNode and Rebasing — a with { Namespace = … } copy un-lists a node with nothing logged
• Write Verdict Totality — a write whose base read ends empty answers nobody, and arms no deadline either
• The Phantom Base After Owner Disposal — the owner echoes a merge BEFORE it flushes it, so a "never applied" NACK's re-attempt can find its own unpersisted write in the mirror, diff to nothing and report success
• Conditional Writes Across Hubs — on a node you do not own the lambda runs on YOUR mirror and ships a diff, so a field it decided not to write is absent from the patch and a concurrent write to it survives
• Live Mirrors and the Change Feed — a write must not end its own streams
• Stream Liveness and the Hub Reference — a stream outlived the hub it held, and the contract said it could not
• The sync/ Hub Population — a sync/ hub is one field of a stream and a subscription makes two of them; the only reaper of a Started one is an idle sweep the traffic keeps re-arming
• The Evicted-Stream Retention — a change-feed eviction parks a remote stream and ReclaimIfUnheld refuses to dispose one that carries no lease entry, so every unleased call site retains one stream, and two sync/ hubs, per change event
• The Read Path Minted a Hub Per Read — a live in-process census decomposed a replica's sync/ hubs into their holders and pinned the growth on the read path: a constant configuration took GetDataRequest out of the stream cache, so every read left a permanent hub behind (six reads, six hubs, measured on the running portal)
• The Recursive-Delete Drain — the plan is a snapshot the removals may exceed, the completion check must include the ROOT, and the stage bound measures progress, not duration
• Business Rules & Calculations
• Data Versioning Strategies
• Mesh Graph Architecture
• MeshNode Versioning
• Query Provider Parity
• Query Result Scoring
• Reading a Write Verdict
• Satellite Entity Patterns
• Satellite Node Patterns
• Repairing a Stale MainNode — When the Broken Field Guards Itself
• Synced Mesh Node Queries
• Update Validators See Typed Content

Storage & partitions

• Start here: Postgres Schema Architecture
• Partition Storage Routing
• Partition Teardown — deleting a partition ROOT drops its backing store; keyed on the node's SHAPE, never its NodeType
• Partition Storage Hubs
• Partitioned Persistence
• Storage Adapter Implementation
• Change-Feed Isolation — one throwing subscriber must never starve the others
• A Container Registry in Memex — PROPOSAL: serving OCI images from the mesh, and the bootstrap circularity that keeps the boot image on ACR
• Static Repo Import
• The Prune Requires a Complete Listing — an import prunes on "absent from the source ⇒ deleted"; a truncated GitHub tree arrives as HTTP 200 and turns every unread file into a deletion
• Import Write Ordering — a NodeType lands before the instances that name it
• Vector Search
• Durable But Unreadable — a write that is acknowledged, versioned and invisible
• Instance-Key Resolution — the registry reads an instance key through live mirrors, never a per-request point read
• Cross-Schema Fan-Out Elimination — an unanchored query is a lock bomb; the census and the per-caller plan
• Addressed Notifications — plan 1 worked out: deliver a notification to its addressee so the bell reads two schemas, not 199
• Content Indexing Activation
• Cross-Instance Mirror
• Data Synchronization and CRDT
• Setting Up Data Sync
• DatabaseBackups
• Declarative export and import
• Syncing a Space with GitHub
• What a Green Build Costs a Synced Space — one field decided whether a delivery was free or a full clone, and it is deliberately frozen while an import does not converge; the second, weaker pointer that makes a settled source free again, and why the skip needs the verdict to be FINAL and not merely recorded
• When a Publication Seal Stops Advancing — a Space converges on a green build only while the publication sealed for THIS instance's framework identity keeps reaching the built commit; when the instance's identity and the lane that publishes for it drift apart that condition stops being satisfiable, and until the hold was recorded on the node a held source was byte-identical to a settled one
• The Import Marker Records Convergence
• Instance Sync — bi-directional space replication between MeshWeaver instances
• Managing Partition Sync (Admin Guide)
• Static Node Providers

Security

• Start here: Access Control
• Granting Access
• AccessContext Propagation
• Query Identity — an unstamped read answers as Anonymous, which reads as absence
• Owner Injection
• Permission API
• Invitation-Only Onboarding
• Logon Actions — per-user work at logon, run as the user
• Unanchored Security Reads — why the permission fold reads mesh-wide, and why pinning it to the viewer's partition is a silent revocation-fails-open bug
• A Denial Is an Answer — a check on a hub with no evaluator grants Permission.All, and a refusal the mesh decided is rendered, never raised
• Who Owns a Partition's Access Shape
• OWASP ZAP Scan — 3.0.0 (6 September 2026)
• OWASP ZAP Scan — Every Release

Threads, activities & AI

• Start here: Thread Operations
• Thread Execution Streaming
• Activity Control Plane
• Activity Mirror Release Lifetime
• Activity Operations
• Notifications
• Notification Retention — the platform's first data-retention pass, and why it is a logon action
• Agentic AI
• Script Execution
• Agent Framework Stores — mesh nodes behind Microsoft's abstractions
• Centralized speech — Whisper Swiss German as a container
• Email Ingestion, Channels and Notifications
• Event Subscriptions — the durable 'when THIS fires, run THAT' engine
• Foreign-Language Bridge (Python, Bun/Node) over gRPC
• Foreign-Language & Cross-Platform Integration
• Model Providers and BYO Credentials
• On-device voice — Whisper + Swiss German
• Voice model distribution — where a 547 MB CC BY-NC model may live
• Python Code Nodes
• Script Execution — Try It
• Sending Email

UI

• Start here: User Interface
• Blazor Data Binding
• Per-Tab Session State — a node is shared by every tab of one account, so "which page is this viewer on" and "navigate ME there" can never live on one
• Blazor Async
• Available Controls
• Menus as Data — re-word a menu without a build
• The Menu Contribution Boundary — what may be data, what stays compiled
• Markdown Fence Extensions — the platform emits a marker, the clients hydrate it; a new fence is always a two-repo change
• Localization — the viewer's language, resolved explicitly, never from ambient culture
• Chrome and Content Language — ownership decides the language, and in-flow chrome minimises words
• Localized Refusals — a *Response.Error is a wire field and stays English; the activity transcript is the surface a viewer reads
• The Supplied Navigation Rail — a module supplies its own left-hand index, and core renders it in the order the module gave
• The Apps Home
• Content Favicon Rasterization
• Controls That Cannot Fail
• Catalog Action Identity — a retained click keeps its package when the catalog refreshes
• Link Previews
• Public Web Presence — one public host, a body in the first response, a sitemap that descends to every page a stranger may open
• Local-First Client & Bootstrap
• PDF Export — one browser, two fidelities
• UI Extensibility

Node types

• Start here: Adding a New Node Type
• Creatable Types — what may be created under a node: the one provider the Create form asks, what a parent NodeType restricts, what it extends, and why a parent that declares nothing must never narrow the menu
• Retiring a NodeType — the prune keeps the definition and deletes its sources
• Dangling NodeTypes — a node whose type resolves to nothing, and the two write paths that allowed it
• Node Type Compilation
• Compile Cache Input Freshness — verify the captured input before reusing a DLL that finished after a source edit
• Execute-Time Interlock — a build proven stale is never armed
• Emit Reference Capture — bounded, opt-in CI evidence for runtime compiler failures
• Graph / Compiler Layering — the four assemblies, the cycle, and the full-MVID size rule
• Toolchain Re-evaluation Lane — why a toolchain change stopped rebaking the world
• The Dependency Record Floor — a record's module entry says "I need at least X", not "I need exactly this build"; the MVID pin that could not converge because Roslyn hashes absolute source paths, the two-replica recompile ping-pong it produced, and the four things the floor deliberately does not relax
• Producer Determinism of the Dependency Record — the same content must stamp the same record however the producer reached its bytes; the disk-cache hit that shipped a weaker guard, and why the digest is persisted beside the bytes rather than recomputed
• Rebake Waves — why a roll rebakes the world anyway, and what one rebake writes
• Source-Set Establishment — a resolved source set of ZERO is ambiguous, and only the type's own persisted snapshot tells "owns no Code" from "the discovery pass came back short"; the boot that resolved 91 fewer Code nodes than its neighbours and held a portal out of rotation for the startup probe's full three hours
• Missing Declared Sources — emptiness measured on the UNION is invisible for any type that also draws on a shared library; the NodeType whose own Source subtree was gone, reported itself as broken C#, and had the identical doomed compile taken again on every boot for four days
• Install-Time Prebuilt Adoption — the only lane that serves a package installed AFTER boot, and the four answers its zero must keep apart because a silent non-adoption reads exactly like a successful one
• Adoption and the Sweep Count Different Things — the cold boot that adopted 78 prebuilt assemblies and then reported 5, with nothing wrong on the share: what each instrument counts, why the sweep could not see its own process's writes, and the node-version ordering that keeps the fix from becoming a stale serve
• Import Write Ordering — type before instance, and what a foreign type does
• Language Services
• Extensible Defaults
• Build coordination — the Build node protocol
• Build Identity Admission
• The Build Process — compile and test as a dependency cascade
• What a Pull Request Rebuilds
• The Build Server
• The Compile Program — State of Record
• Content-Type Registration
• NodeType Catalogs (shipping instances of a NodeType)
• NodeType Release Redesign

Plugins & content delivery

• Start here: Plugins — node repos from git, no NuGet
• Plugin Manual — author · publish · install · own registry
• Plugin Registry — memex re-serves plugins over REST
• Webhook Inbox — external services deliver into /_Inbox
• Plugin Packaging — bundles, the framework identity, and the Release node that links a release to its assemblies per architecture
• Install Readability — the two doors an install can open, and the cover-grant deadlock detector
• A Module's Static Web Assets — a module's CSS/JS ride the bundle in their own folder and must land MODULE-RELATIVE beside the entry assembly; anything that copies only the closure loads perfectly and 404s every asset behind one Debug line
• Static Repo Import
• The Sync-Ref Contract — an UNATTENDED import reads a commit CI proved; only a person clicking Update may read a branch tip, and resolving the ref twice put sources no build had compiled onto two production portals for five hours
• Node Type Compilation
• The Platform Image's Closure — the image IS the reference set every satellite's modules compile against; the two invariants, and why every consumer used to discover them by failing to compile
• Sealed Publication Reads — a publication is unreadable for ~90s per target per publish and the plugins prefix has two writers; the three answers (404/503/412), the generation that pins one instance, and the mix no reader can detect
• Sealed Publication Generations — the layout that makes that mix UNREPRESENTABLE (a directory per publication plus a pointer swapped last), the reader contract, the retention rule, and the ordered migration that avoids a new-writer/old-writer half-state
• Install Completeness — what an install RECORD declares landed, compared against what is actually in the mesh; the comparison nothing made until #3485, and why only one of its five verdicts is a pass
• CI Content Bake
• Prebuilt Bundle Retention — the sweep that prunes what CI bakes: where it is registered (and why "zero callers" was measured twice and wrong both times), the deletion default that is true in code and false in the chart, the report that names its denominator, and the pinned satellite gate the protected set cannot see
• Deploying a plugin change — merging is not shipping
• Module Adoption Policy
• Module Build Architecture
• Module Closure Accounting
• The Module Identity Anchor
• Module-Owned Siblings Ride
• The Module Platform Link Gate
• The Module Publication Gate — a bundle used to reach the live registry from inside its own pack leg, before the sibling suites, the portal-host shards, the compile-check and the Tests-area gate had reported; the hand-over moved downstream of the full source verdict, and what it refuses (failed, skipped, cancelled, missing, foreign-lane, substituted)
• Module Generation Substitution — Assembly.LoadFrom does not promise to load the path it is handed: a byte-identical copy the load context already holds is returned instead, silently, so the loader recorded the generation it ASKED for while the process ran another; the three answers that replace two
• Module Set Convergence
• Module Versioning
• Modules
• Package Mark Inheritance
• Pin-Boundary Contracts
• Platform and content — two layers, two cadences
• Platform Build Identity
• The Platform-Shipped Witness
• The Plugin Build Contract
• Plugin Bundles in the Registry
• Plugin Publication Provenance — the signed publication callback names the CONTENT commit that was built and the platform version read from the selected portal image, never the calling workflow's commit or event; core CD building Plugins used to announce a core sha as a Plugins commit
• Plugin Update on Green Build

Reliability & wedges

• Start here: Error Propagation & Wedges — drive wedges to 0
• Action-Block Wedge Prevention
• Riding Out a ShuttingDown Address — the one transient NACK, and the two axes a ride-out must bound separately
• Hub Initialization Failure
• Orleans Stream Pub-Sub Durability — a publish with no subscriber succeeds, so a cross-silo reply can vanish with nothing logged
• Durable Streams Are Mesh Nodes — the design that retires the memory stream without a provider
• The Pod-Hub Claim Must Be Re-Asserted — a claim asserted once into a directory that is re-partitioned on every membership change is lost silently, and forever
• Oversized Delivery Refusal — a message too large for its transport destroys the connection carrying it; refuse at the producer, never raise the limit
• Content Sync Visibility — a Space whose assets the transport refuses says so, on the Space itself, naming the file, its size and the limit
• Out-of-Band Content Transfer — a content file too large for one delivery travels through the content store behind a content-addressed handle, never on the message
• An Unreachable Store Is Not a Refusal — one classification, three consumers; reporting an availability failure as a verdict is how a retried create becomes a duplicate
• Undetermined Is Not No — a read that did not answer is a THIRD state; the second door that shared the first door's failure domain, and the rule for what a gate does with "I could not determine"
• Reading a Silo Eviction — a heartbeat newer than the suspect votes is not proof the silo was healthy; the control arm that tells a correct eviction from a false positive
• Dead-Circuit Fan-Out Storm — a closed tab's owner pushed to the corpse for 46 minutes because the only verdict the eviction acts on could not be said; the release tombstone that says it
• Bake Seal — NodeOps Saturation — the mesh's ONE node-CRUD hub stops draining under a bulk burst, and every consumer then reports its own bound
• The /api/content 503 — three causes with different fixes, why the third wears the first's signature, and the black-box discriminator that needs no log line
• Refused Replies During Teardown — every failure route answers the SENDER, which for a reply is the responder; the answer the caller is parked on is dropped with nobody told
• Refusing a Lost User Action — a click whose stream is gone is refused out loud instead of dropped as churn; why "deliver it anyway" is not implementable as stated
• Guards and Unknown States
• Mesh Admission
• Mesh Lifecycle — Build Up & Tear Down
• Pod-Hub Delivery — the Transport Swap and its Roll Plan
• The Portal Heap Is Hubs
• SignalR Mesh Participant — joining the mesh over a WebSocket
• Teardown Layers — work finishes, nothing is forced
• Teardown Verdicts Are Causal, Not Timed

Testing & debugging

• Start here: Writing Tests
• Negative Controls — a pin is only a pin if it fails against the defect
• Reactive Test Assertions
• Test State Isolation
• Disposable-mesh e2e
• Debugging Message Flow
• Debugging Disposal & Leaks
• Departed Platform Assemblies — an assembly that leaves the platform for a module breaks every OTHER module that binds it, at LOAD time and invisibly to every compile gate; why "those are the platform" is one answer per host
• Detached Response Continuations — why a hub.Observe(...) continuation runs on the RESPONDING hub's action block, what that cost on the mesh's one node-CRUD hub, and the six invariants that make the hop an opt-in rather than the default
• Reading a Disposal Stall Verdict — what each field of the disposal snapshot actually measures, the three that were read as evidence while measuring nothing, and the verdict hole that sent 47 reports to children that were not the problem
• Ambient Test-Host Hangs — what decides whether a killed test host can be diagnosed at all, and the readings of it already falsified
• In-Mesh Tests and the Seal — a Tests area no required context executes is a latent trunk red the seal detonates fleet-wide; how to measure a gate before requiring it
• Cancel and Join Are Two Questions — a deadline that asks work to stop and a deadline that waits for it to have stopped must not share one clock
• Collection-Scoped Test Fixtures
• Debugging Native Crashes (core dumps)
• Debugging Postgres in Prod / Test
• Decentralised Tests
• Gate Content Assets
• In-Mesh Build and Test
• Orleans Test Routing Pattern
• Reading CI Signals
• Workflow Permission Pairing — a job-level permissions: in a shared lane is a requirement on every caller; an unpaired one is startup_failure with zero jobs

Deployment & ops

• Start here: Deployment (the router)
• AKS
• Database Migration Procedure — the schema moves before the image, every roll; the 2026-09-03 wedge behind a 200, the recovery, and why a migration deadlocks under load
• Container Apps
• Local Dev Workflow
• Onboarding a New Environment
• Unclaimed Control-Plane Requests — an InstanceAction at version 1 with an empty log means "queued", "nobody is listening" and "the operator died holding it" in the same bytes; the 2026-09-10 measurement, the Ops/Status staleness that DOES discriminate, and the acceptance signal that does not exist
• Release & Self-Update Strategy
• Release Support Policy
• Released Artifact Retention — retain artifacts for at least 30 days, supported releases for their support lifetime, and every artifact still needed by a published set or consumer
• Self-Update Target Selection — candidates are ranked by the CD run number, not the version string; a mislabelled line outranked every sealed set for ever, and an install on a withdrawn tag could never see anything newer
• The Continuous Delivery Contract — all-or-nothing publication; verify the image, never the tick
• The Self-Update Schema Wall — every schema-bumping release is un-takeable by self-update, the stall is invisible, and a promoted tag is not a deployable tag
• Bake Identity Mismatch — why a green CD can publish a bake no portal adopts, and the one rule that keeps two images of one commit on one address
• Release Availability Gates — one predicate; never roll or build into a release a package cannot survive
• Combo Gate Wiring — the roll consults the combo verdict; Red refuses, and "could not find out" is neither
• Roll Selection — completeness as a SELECTION criterion: pick the latest release that ships all of an environment's plugins, refuse an empty denominator, and never roll backwards
• Release Process
• NuGet Package Retirement — two packages survive (the Aspire integration and the dotnet new template) and the other forty-three are unlisted; what unlisting does and does not break, the derived retirement sweep, and the ground rule that startup dependencies become Aspire options rather than new packages
• Repository Dependency Direction — the platform never depends on a plugin repo; the inventory of every edge that still does
• The Cross-Repo Pair Gate — a removal here reds a plugin repo's trunk hours later; the deleting half lands LAST
• Platform Script Resolution — a repo runs the platform's gate scripts, never a copy; the local runner must resolve the ref the LANE resolves, which is per-script, so a loader copied from another repo refuses on every call (one repo demands one lane sha, another pins four and the pin gate calls that consistent)
• Keeping the Platform Source Pin Current — a satellite pins WHICH core commit its src/ compiles against, the image set had a mover and the source ref had none, and a bump PR opened with GITHUB_TOKEN is a PR no CI ever runs
• Transitional Allow Entries — an allow entry is written for ONE merge and expires with it by mechanism; the instruction that was ignored once cost every C#-touching PR in the fleet ~40 minutes of red
• Pinned Image Retention — registry retention deletes what CI pins, and republishing frequency is what destroys a pin rather than what protects it; the guard that names a dead pin, and the retention design that stops the deletion
• The Image Tag Contract — which image tags the promotion actually publishes, why the portal has no latest, and the two-writer history of the one that had no producer at all: retired lane, then retention, and every check green throughout
• Pin Set Consistency — every pinned digest EXISTING is not every pinned digest naming the same BUILD; the invariants that red a half-moved set, three written deliberately weaker than the obvious version, and the falsification that found the vacuity trap inside the gate itself
• Duplicate Keys in Workflow YAML — a duplicate mapping key is accepted silently and the LAST one wins, so a pin can move in the diff and not in the job; the near-miss, why every existing gate was blind, and the guard that names the file, the key and both lines at the first job
• Image Pair Skew — a promoted image pairs a core commit with a Plugins head resolved hours later; each half green, the pair never run (the 2026-09-03 sign-in outage)
• The Merge Queue — one entry built at a time so nothing churns, and a steward that re-queues an ejected PR on evidence and never re-runs
• Carving Projects Out Of Core — what a SOURCE move costs and what it does not
• Red-Log Watching & Ticketing — every fail:/crit: becomes exactly one triaged issue
• Log Entries Are a Query Result, Not a Feed — Hosting/LogEntry is the output of one Logs action, so an absence in it is evidence of nothing; the denominator printed on every row, the level that lives on a different node, and how to ask for a line that carries an answer
• Verifying Chart Values — a key can be set, reach the render, and still not be read; why the obvious gate was vacuous for the one component it existed to guard, and the binary check that closes it (the drain that erased every namespace's log history)
• Measuring a Live Portal Read-Only — /health first (public, past RLS, a different replica each call), the incident store, the four break-glass instruments, and why an absence needs a coverage fact before it counts as evidence
• Chart Ownership and the Runner Pool — why the chart's gate is here, what a relocation must carry, and why path-filtering it is unsafe
• Sharding the Node-Repo Gate — a cap cut reports as cancelled, so the fan-out that removes it, and the fold that keeps ONE required context and ONE gate log
• Applying Is Not Rolling Out — helm applies, the caller observes; the fixed fifteen-minute --atomic --wait that reverted a correct upgrade mid-startup-gate, and why a bigger timeout only moves the cliff
• Probe Semantics — readiness, liveness and startup ask three different questions with three different remedies; why they get three paths and three tags
• What a Synthetic Probe May Assert — a probe naming one deployment's installed content is broken by construction; the platform floor, the negative control that tells "absent" from "down", and reading the target's own declaration
• Why a GC-Bound Pod Stays in Rotation — the GC's hard limit sits below the container limit, so a portal short of memory is defended rather than restarted
• Self-hosted CI runners on AKS — ARC beside the portals on one pool; three brakes, a negative priority class, and the reserve arithmetic that decides the cap
• Candidate Release Protocol
• Chart Drift — what a deploy actually does
• Configuring an instance from Aspire
• The Dependabot Secret Store
• Deployment env layers — what a record must be able to hold
• DeploymentInventory
• Deployment Options (AKS)
• Environment Composition
• Feature Flags
• First-Run Setup
• Image Cleanup
• Instance Identity and Setup
• Instance Lifecycle — State of Record
• Instances
• Local memex on Colima k3s (Mac)
• Mac local stack — on-device AI + local observability (M-series)
• Memex Cloud Deployment
• Merge Queue Mechanics
• Operating from the portal, not the cluster
• The Payment Provider Contract
• Pre-Boot Service Substitution
• Project Templates
• Registry-key rotation — two phases, at the registry that holds the instance
• The Release Event Bus
• The Release Gate's Denominator
• Release to Production — the whole path
• Renaming a Required Status Check
• Repository Topology
• The Release Wave — one emitter, and who resolves the digest

Contributing docs

• Start here: Authoring Documentation
• Docs Follow The Functionality — which repo a page belongs in, and what pins the rest here
• Specifying Software
• Glossary
• Developing from within MeshWeaver
• Shared Rule Blocks

Licensing

• Start here: Dependency Licensing — Apache-2.0/MIT compatible only; the CI gate that enforces it
• Dependency Major Upgrades — the five things a green -warnaserror build cannot see at a major boundary (in-mesh source, authored content, the satellites that import this repo's package list, behaviour behind an unchanged signature, and rules an analyzer would have enforced had the build actually loaded it), the differential method that replaces them, and the ledger of boundaries actually crossed

Getting started

New to the platform? Read Specifying Software to learn how to write iterative specifications closely aligned with implementation, skim the Glossary for the vocabulary, then explore the full catalog of architecture topics above.