One system, drawn ten ways. Each view answers a different question, and none of them tries to answer all of them — a single diagram of this stack would be a wiring photograph rather than an explanation.
Colour means the same thing on every page, position means ownership, and an arrow is spent only where position cannot say the thing. How to read thisis the key, and it is the one to read first.
1 · The factoryEvery repo plays one of three roles: what the factory consumes, what it produces, or the factory itself. The deploy substrate sits between them.2 · Cloud substratelanding-zone, by layer. Organization components run once in the management account; everything below them is per-environment.3 · NetworkOne component, two modes. In create mode it owns a VPC; in adopt mode it builds nothing and re-exports someone else's through the same outputs.4 · Cluster addonsOne ApplicationSet per group, ordered by sync wave. A cluster opts in with a label; the generators do the rest.5 · Control planeOne binary, nine reconcilers, one leader-election lease. Each zone below is a reconciler; what sits inside it is what that reconciler creates and keeps true.6 · Request pathOne invocation, app to model and back. The app holds no AWS credential and signs nothing — the gateway does, as the tenant.7 · Identity & isolationIsolation is a spectrum, not a boolean. Two orthogonal dials — where the control-plane CRs live, and how hard the workload boundary is.8 · ObservabilityOne neutral waist. Producers emit OTLP to a stable alias; which backends exist behind it is a property of the cluster tier.9 · Governance loopsBudget, SLO, and eval each close a loop that can stop a tenant. Recovery from the budget one is exclusively human.10 · LifecycleTwo vending lines, one layer apart. Both write manifests to git; the cluster always wins on read. Where they come from
The diagrams are generated from a model, not drawn. Each perspective is a declaration of zones, nodes and edges; layout is deterministic, so the same model always produces the same geometry, and a change to the model that is not re-emitted fails its own CI. The captions on these pages come from that same model — a diagram and its description are one artifact.
