The Project path
Git repository
↓
Source Space and Project View
↓
Workspace and Change Revision
↓
Run and Evidence
↓
Landing to a canonical Project Revision
↓
Build and immutable Artifact
↓
Release
↓
Target and Promotion
↓
Health, rollback, and reconciliationSource and disclosure
The Project is the managed unit. A Source Space owns one source lineage, visibility policy, and processing policy. A Project View composes the Source Spaces that the current Actor may see.
The hybrid video-player example uses one public player Source Space and one protected codec Source Space. The public projection is a separate Git lineage. It does not hide a private directory inside a shared repository.
Collaboration and authority
The Realm coordinator serializes semantic mutations for a Project. A Change has a stable identity across revisions and rebases. A Workspace is bound to an exact Project Revision and Source Space set.
Principal → Actor → Session → Task → Capability Grant → resource operationExecution and Evidence
A declared Action runs against immutable inputs. The trusted Runner records the terminal Run, Evidence, and Artifact together after validating the signed result and the exact Attempt binding.
Output ingestion rejects source overlap, special files, symlink escapes, and oversized objects. The authority ledger stores digests and observable events, not credentials or private model reasoning.
Delivery
A Release closes over the exact Project Revision, Artifact digests, configuration and dependency digests, migration plan, Target profile, and required Evidence. The Promotion service resolves provider identities from the authoritative Target record.
Preview strategy is explicit. A simple Worker may use a version URL. An application with Durable Objects or stateful bindings uses an isolated Target with isolated data resources.
Cloudflare-first mapping
| Responsibility | Default implementation |
|---|---|
| Request routing and identity edge | Workers |
| Serialized Project authority | Durable Objects and SQLite-backed state |
| Searchable catalogue | D1 |
| Git and large objects | Repository Driver and R2-backed storage |
| Delivery events | Queues |
| Durable workflows | Workflows |
| Linux execution | Sandbox or Containers |
| Evidence and build outputs | Content-addressed R2 objects |
| Provider deployment | Target adapter and customer-owned executor |
Recovery and export
Exports contain repositories, Project and Change lineage, review and policy records, Evidence metadata, Artifact indexes, Releases, Audit Events, and schema versions. Large objects retain a digest and a customer-controlled location.
Recovery is a separate ceremony. A signed export, an integrity checkpoint, quarantine reconciliation, and owner activation are required before restored authority becomes active.