Example: service tin on platform nitroso · Bun API + worker · Postgres + queue
One service, from repo to cluster
A team writes one repo. CI publishes one image and two charts at one version. Kargo moves a pointer; Argo CD draws the rest.
- People write 4 places: the service repo, the platform repo (carbon), Infisical (for app-only secrets) and, for new landscapes or clusters only, fleet. DECIDED · OD D3
- Two charts per service: the app chart goes to every cluster of a landscape; the primordial chart goes once to Primordial. DECIDED · OD D3 #5; R20
- Nothing about the service is written into fleet by hand. Machines write its row files. DECIDED · OD D3; FLEET
Example: tin is a Bun API (api) plus a queue worker (worker) on platform nitroso. It has one Postgres database and one queue.
Read this first: diene has no Bun API template yet. The worker side comes from bun-consumer; the API side follows the decided app-chart list and the PoC. OPEN · T1
On a phone: tap a box. Solid outline = where it goes; dashed outline = where it comes from.
- template or tool
- repo people write
- secret store
- published / pinned
- deploy machinery
- runs in a cluster
- open / not built
Nothing picked. Try App chart or Deployment: api.
diene templates
The templates the repo is made from: nix root → workspace → shared → bun-base (+ observability) → bun-consumer.
Who writes it: diene (the factory). Today a template is a git branch; cyanprint templates come at finalize.
Where: ProtoDurian/ branches; mirrors ProtoDurian/
The trace stops at Argo CD, Kargo Freight and the row pin; tap one of those to see everything it deploys.
DECIDED · CHAIN-REFERENCES §2 BUILT · no cyan.yaml on any bun branch OPEN · T1, T2
nix-registry tools
Command-line tools the repo's dev shell loads: problemgen (Problem code + record), chart-checks (render checks), releaser (versions), later obs.
Who writes it: AtomiCloud nix-registry.
Where: AtomiCloud/, loaded through flake.
The trace stops at Argo CD, Kargo Freight and the row pin; tap one of those to see everything it deploys.
DECIDED · problemgen.md; chart-checks.md BUILT · chart-checks v5.13.0 OPEN · problemgen PR 104 open; obs not built
policies stand-in
A stand-in repo with the cluster rules: labels required, reload label required, live-reload inputs. Chart checks run against it.
Who writes it: Factory, by owner ruling D75. Later replaced by the vanadium chart.
Where: ProtoDurian/, pinned by commit in chart-checks.
The trace stops at Argo CD, Kargo Freight and the row pin; tap one of those to see everything it deploys.
DECIDED · OD D75; workspace §1 BUILT · workspace:chart-checks.yaml CONTRADICTION · K1
nitroso.tin
Code, config, problem files, signal files and two charts: infra/ (app) and infra/ (records).
Who writes it: The tin team. Creating the repo is the registration.
Where: GitHub, one repo per service
The trace stops at Argo CD, Kargo Freight and the row pin; tap one of those to see everything it deploys.
DECIDED · ARCH §8; OD D3 #5 BUILT · bun-consumer branch
nitroso.carbon
The platform repo: platform. (landscapes, promotion order) and charts for the platform namespace and secret store.
Who writes it: The nitroso platform team.
Where: GitHub <platform>.
The trace stops at Argo CD, Kargo Freight and the row pin; tap one of those to see everything it deploys.
DECIDED · goals/charts/carbon.md BUILT · charts/carbon
fleet
Landscapes and clusters (registry/, people) and the deploy rules: fleet-root and the compiler chart diene-platform (machinery/).
Who writes it: People, only for landscapes and clusters. DECIDED · OD D3
Where: One repo fleet
The trace stops at Argo CD, Kargo Freight and the row pin; tap one of those to see everything it deploys.
DECIDED · OD D2 CONTRADICTION · FLEET still puts machinery under registry/ PoC TESTED · spike A, PoC
sulfoxide charts
Base-layer charts every cluster gets: cobalt (secret sync), chlorine (Reloader), platinum (gateway), sulfur + zinc (certificates), aluminium (Alloy), xenon (metrics-server).
Who writes it: Platform engineering (factory nodes charts/).
Where: One repo per chart, built from helm-wrapper
The trace stops at Argo CD, Kargo Freight and the row pin; tap one of those to see everything it deploys.
DECIDED · OD D49; goals/charts/* BUILT · charts/* branches OPEN · K2 how they are promoted
Infisical
The secret store. One project per platform; one environment per landscape; folders like / and /.
Who writes it: T3 writes database passwords. People write app-only secrets (who may: not written).
Where: Runs on Primordial
The trace stops at Argo CD, Kargo Freight and the row pin; tap one of those to see everything it deploys.
DECIDED · secrets-chain OPEN · O8 which instance; S8
Image
One container image. api and worker are two commands of the same image.
Who writes it: CI/CD on a release tag.
Where: ghcr.io (exact path open)
The trace stops at Argo CD, Kargo Freight and the row pin; tap one of those to see everything it deploys.
DECIDED · R9; lens-repo-cicd §2 BUILT · cd.yaml docker job CONTRADICTION · P2 image name; P4 v1.4.3 vs 1.4.3
App chart
The packed infra/, with config/ copied in at build time.
Who writes it: CI/CD on a release tag.
Where: OCI registry on ghcr.io
The trace stops at Argo CD, Kargo Freight and the row pin; tap one of those to see everything it deploys.
DECIDED · ARCH §8; HW BUILT · cd.yaml helm job CONTRADICTION · S1 config copy step missing
Primordial chart
The packed infra/: dependency records, Problem record, Grafana alerts and dashboards.
Who writes it: Should be CI/CD. The built CD does not publish it; the PoC does.
Where: OCI registry on ghcr.io
The trace stops at Argo CD, Kargo Freight and the row pin; tap one of those to see everything it deploys.
DECIDED · OD D3 #5; ARCH §8 CONTRADICTION · P1 built cd.yaml has no job PoC TESTED · PoC release.yml
Kargo Freight
Kargo's Warehouse watches the registry and makes Freight only when image + both charts exist at the same version.
Who writes it: Kargo, on Primordial. Rendered from carbon's platform. by fleet's compiler chart.
Where: Primordial, Kargo project nitroso
DECIDED · FLEET L520 PoC TESTED · spike A; PoC
Row pin
One file per service per landscape with pin: {primordial, chart, image}. Kargo pushes the version into it.
Who writes it: T3 writes the empty row; the Kargo bot writes the pin.
Where: fleet/ (layout open)
DECIDED · FLEET L111 OPEN · G2 layout, own repo CONTRADICTION · G3 pin keys
Argo CD
Reads the row, renders both charts with Helm, applies them: primordial chart → Primordial, app chart → every cluster of the landscape.
Who writes it: Argo CD, from AppSets rendered by fleet's compiler chart.
Where: Primordial
DECIDED · OD D53, D54; ARCH §8 PoC TESTED · spike A
Records on Primordial
The primordial chart's objects: Database tin, KeyValue tin (the queue), Problem tin., Grafana alerts and dashboards.
Who writes it: Argo CD applies them; operators act on them.
Where: Primordial, namespace nitroso or nitroso-pichu (open)
The trace stops at Argo CD, Kargo Freight and the row pin; tap one of those to see everything it deploys.
DECIDED · OD D4; OD D66 CONTRADICTION · X1 five kinds vs PlatformDependency OPEN · K6
T3 operator
Reads Database and KeyValue, makes the Neon database and the Upstash store, and writes the passwords into Infisical.
Who writes it: The dependency operator (fleet-operator).
Where: Primordial
The trace stops at Argo CD, Kargo Freight and the row pin; tap one of those to see everything it deploys.
DECIDED · dependency-operator BUILT · CRDs only, no controllers PoC TESTED · PoC played it
Neon + Upstash
The real database and queue store, outside Kubernetes. One per landscape.
Who writes it: T3 creates them.
Where: Vendor accounts
The trace stops at Argo CD, Kargo Freight and the row pin; tap one of those to see everything it deploys.
DECIDED · OD D12, D14 PoC TESTED · PoC: Neon
Error portal (erbium)
Watches every Problem record, builds one Cloudflare Worker site, and serves a page per problem type.
Who writes it: erbium operator; T3's cf-deploy promotes the site.
Where: Primordial + Cloudflare
The trace stops at Argo CD, Kargo Freight and the row pin; tap one of those to see everything it deploys.
DECIDED · error-portal.md OPEN · X7 not built
Base layer
What every cluster runs before any service: secret sync, Reloader, gateway, cert-manager, Alloy collectors, metrics-server.
Who writes it: Argo CD, from the sulfoxide charts.
Where: Every app cluster, their own namespaces
The trace stops at Argo CD, Kargo Freight and the row pin; tap one of those to see everything it deploys.
DECIDED · OD D49 OPEN · K2
Admission rules (VAP)
The same rules as the stand-in, enforced inside the cluster: 4 labels, reload label, live-reload inputs.
Who writes it: Not written who installs them.
Where: Every app cluster (cluster-scoped)
The trace stops at Argo CD, Kargo Freight and the row pin; tap one of those to see everything it deploys.
DECIDED · workspace §1 OPEN · K1
Deployments
Two Deployments from the app chart, each pod labelled durian. (or live). Plus Service + HTTPRoute for the api.
Who writes it: Argo CD applies; Reloader restarts on change.
Where: Every cluster of the landscape, namespace nitroso
The trace stops at Argo CD, Kargo Freight and the row pin; tap one of those to see everything it deploys.
DECIDED · R20; OD D59 BUILT · bun-consumer worker; workspace reload helper
ConfigMap tin-config
The app's config files, from inside the app chart. Includes errorPortal..
Who writes it: Argo CD applies.
Where: namespace nitroso
The trace stops at Argo CD, Kargo Freight and the row pin; tap one of those to see everything it deploys.
DECIDED · HW; OD D102 CONTRADICTION · S1, S2
Secret tin
Made by ESO from the app chart's ExternalSecret, reading Infisical through the platform store.
Who writes it: ESO (cobalt).
Where: namespace nitroso
The trace stops at Argo CD, Kargo Freight and the row pin; tap one of those to see everything it deploys.
DECIDED · secrets-chain CONTRADICTION · S3, S4
db-init Job
Runs the schema migrations and seed before the pods update (Helm pre-upgrade + Argo PreSync).
Who writes it: Argo CD, as a hook.
Where: namespace nitroso
The trace stops at Argo CD, Kargo Freight and the row pin; tap one of those to see everything it deploys.
DECIDED · R20 BUILT · bun-consumer dbinit-job.yaml
Repos
- diene templates: The templates the repo is made from: nix root →
workspace→shared→bun-base(+ observability) →bun-consumer. - nix-registry tools: Command-line tools the repo's dev shell loads:
problemgen(Problem code + record),chart-checks(render checks),releaser(versions), laterobs. - policies stand-in: A stand-in repo with the cluster rules: labels required, reload label required, live-reload inputs. Chart checks run against it.
- nitroso.tin: Code, config, problem files, signal files and two charts:
infra/(app) androot_chart infra/(records).primordial_chart - nitroso.carbon: The platform repo:
platform.(landscapes, promotion order) and charts for the platform namespace and secret store.yaml - fleet: Landscapes and clusters (
registry/, people) and the deploy rules: fleet-root and the compiler chartdiene-platform(machinery/). - sulfoxide charts: Base-layer charts every cluster gets: cobalt (secret sync), chlorine (Reloader), platinum (gateway), sulfur + zinc (certificates), aluminium (Alloy), xenon (metrics-server).
- Infisical: The secret store. One project per platform; one environment per landscape; folders like
/anddatabase/ main /.tin
Published and pinned
- Image: One container image.
apiandworkerare two commands of the same image. - App chart: The packed
infra/, withroot_chart config/copied in at build time. - Primordial chart: The packed
infra/: dependency records, Problem record, Grafana alerts and dashboards.primordial_chart - Kargo Freight: Kargo's Warehouse watches the registry and makes Freight only when image + both charts exist at the same version.
- Row pin: One file per service per landscape with
pin: {primordial, chart, image}. Kargo pushes the version into it.
In the clusters
- Argo CD: Reads the row, renders both charts with Helm, applies them: primordial chart → Primordial, app chart → every cluster of the landscape.
- Records on Primordial: The primordial chart's objects:
Database tin,KeyValue tin(the queue),Problem tin., Grafana alerts and dashboards.api. pichu. v1 - T3 operator: Reads
DatabaseandKeyValue, makes the Neon database and the Upstash store, and writes the passwords into Infisical. - Neon + Upstash: The real database and queue store, outside Kubernetes. One per landscape.
- Error portal (erbium): Watches every
Problemrecord, builds one Cloudflare Worker site, and serves a page per problem type. - Base layer: What every cluster runs before any service: secret sync, Reloader, gateway, cert-manager, Alloy collectors, metrics-server.
- Admission rules (VAP): The same rules as the stand-in, enforced inside the cluster: 4 labels, reload label, live-reload inputs.
- Deployments: Two Deployments from the app chart, each pod labelled
durian.(orcloud/ reload: restart live). Plus Service + HTTPRoute for the api. - ConfigMap tin-config: The app's config files, from inside the app chart. Includes
errorPortal..url - Secret tin: Made by ESO from the app chart's ExternalSecret, reading Infisical through the platform store.
- db-init Job: Runs the schema migrations and seed before the pods update (Helm pre-upgrade + Argo PreSync).
The words, once
- Landscape = one environment with its own data. Example:
pichu(dev),pikachu(staging),raichu(prod Singapore),ampharos(prod US). DECIDED · ENV §1 - Cluster = one Kubernetes cluster of a landscape, named landscape + mark. Example:
pichu-opal(PoC name). DECIDED · ARCH §2 PAPERS SILENT · real names - Primordial = the control cluster. It runs Argo CD, Kargo, Infisical and the operators. No app pods run there. DECIDED · ENV §1.3
- Platform = a product team's space. Example:
nitroso. Its home repo isnitroso.. DECIDED · carboncarbon - Fleet = the one repo that lists landscapes and clusters, holds the deploy rules, and holds the row files. DECIDED · OD D2, D3
- Row file = one small file per service per landscape that says which version runs there. Kargo writes it. DECIDED · FLEET
- Kargo = moves a version from landscape to landscape. Freight = one release Kargo found (image + 2 charts). DECIDED · OD D3
- Argo CD = makes clusters match git; it renders our Helm charts. DECIDED · OD D53, D54
- T3 = our own operator (the dependency operator). It makes databases and writes their passwords. DECIDED · dependency-operator
- Sulfoxide = the base layer on every cluster: secret sync, Reloader, gateway, certificates, Alloy. DECIDED · OD D49
The tags
- DECIDED = written in a design paper or an owner ruling.
- BUILT = a real file on a branch of ProtoDurian/diene.all (or the real primordial repo).
- PoC TESTED = ran in the whole-system PoC (a hand-built test, not template output).
- OPEN = the owner has to pick, or nobody wrote it down.
- CONTRADICTION = two sources say different things.
- PAPERS SILENT = the papers say nothing.