Product intent
Authority boundaries
The phrase “source of truth” becomes misleading when it suggests one artifact owns every kind of state. A live product has several authorities. The contract is that they do not overlap silently.
Product intent
Section titled “Product intent”The Evolutionary Model owns what the product should do: vocabulary, structure, behavior, rules, permissions, experience, and integration contracts.
If a permission rule changes, revise the model. If an endpoint changes but the product contract does not, do not fabricate a model revision merely to move a secret.
Translation
Section titled “Translation”The versioned generator owns how supported model constructs become implementation. A correct model that produces incorrect code is a generator defect. Fixing every emitted application independently would preserve the symptom and abandon the shared cause.
Releases
Section titled “Releases”The release ledger owns the mapping from model revision and generator version to built artifacts, manifests, checks, and promotion state. It answers what was delivered—not what should conceptually exist.
Data and schema
Section titled “Data and schema”The live database owns current rows. Migration history owns the ordered evolution of physical schema and stored values.
The model may express semantic intent such as a rename or split. The generator translates that intent into migration artifacts. Infrastructure plans and executes the transition. No single layer can safely do all three jobs.
Configuration and secrets
Section titled “Configuration and secrets”The control plane owns secret values, environment-specific endpoints, certificates, and operational flags. The model and release declare which values are required and how they are used, never their production contents.
Infrastructure
Section titled “Infrastructure”The orchestrator owns desired and active runtime topology: release instances, routing, capacity, service health, and deployment state. It does not decide product behavior.
Observability
Section titled “Observability”Telemetry owns what is happening now: errors, latency, saturation, queue depth, external failures, and business signals. Observations can motivate a model or generator change, but they do not mutate intent automatically.
Classification table
Section titled “Classification table”| Observation or request | Owning authority | Permanent response | Regenerate? |
|---|---|---|---|
| Wrong permission or rule | Model | New revision | Yes |
| Correct model, wrong output | Generator | Shared fix and generator release | Yes |
| Candidate does not start | Release/config/infra | Keep active release; diagnose | Not necessarily |
| Endpoint, key, or certificate changed | Config control plane | Audited runtime update | Usually no |
| Provider changed its payload contract | Integration model/generator | Update contract or adapter | Yes |
| General traffic increased | Infrastructure | Scale, pool, cache, workers | No |
| Query strategy fails at scale | Model workload/generator | Capture requirement or improve emitter | Yes |
| Stored values are corrupted | Data operations | Repair, replay, quarantine, restore | No |
| Field rename or split | Model evolution + migration | Explicit mapping and migration | Yes |
| Dependency vulnerability | Supply chain/generator | Update base/dependency and rebuild | Often |
The diagnostic question
Section titled “The diagnostic question”When an incident or change appears, ask:
Which fact changed, and which authority owns that fact?
Do not begin with “which file should we edit?” That question already assumes implementation is the authority.