Engineering
Request
Client transport reaches the guarded dispatcher, then scoped domain work and an authorized response.
Drag to move · Hover to trace. Select to read more. Keyboard: Alt + arrow keys to move.
- Web Client
- API Transport
- Request Boundary
- App Check
- Firebase Auth
- Permission / Capability
- External Provider
- Domain Service
- Firestore
- Storage
- Functions / Jobs
- Response projection
Drag a card to rearrange it. Select it to learn more.
Connections in words
- Firestore supplies scoped source data for Response projection.
- Domain Service returns an authorized Response projection.
- Functions / Jobs attempts effects through External Provider.
- Domain Service persists canonical records in Firestore.
- Domain Service accesses admitted files in Storage.
- Domain Service checks identity using Firebase Auth.
- Domain Service admits background work to Functions / Jobs.
- Domain Service uses scoped adapters for External Provider.
- Web Client calls explicit API Transport.
- API Transport submits requests to Request Boundary.
- Request Boundary establishes identity through Firebase Auth.
- Firebase Auth precedes evaluation of Permission / Capability.
- Permission / Capability admits scoped commands to Domain Service.
- App Check attests application context at Request Boundary.
Transport, authentication, authorization, domain work and response projection remain explicit responsibilities.
Explicit transport
Public, Firebase-authenticated and session-authenticated interactions use defined transport contracts. A feature does not guess the identity boundary from a URL.
Admission and dispatch
The request boundary applies route policy, firewall admission and the declared method contract. Lazy route-group loading keeps unrelated handler graphs out of a request’s initial path.
Scoped domain work
Authentication establishes the principal. Current membership, capability and subject access determine permitted work. Domain commands own transitions; scoped adapters read or write canonical records.
A minimal response
Return only the fields the caller may receive. Serialized UI data, metadata and public projections are disclosure boundaries too. Reaching a route does not establish correct authorized behavior.
Follow each request boundary
- 1Web Client
- 2API Transport
- 3Cloudflare Edge
- 4Request Boundary
- 5Firebase Auth
- 6Permission / Capability
- 7Domain Service
- 8Firestore
- 9Response projection
- 10Web Client
Go deeper
Conceptual architecture. Implementation and release status are assessed separately.
Service
Permission / Capability
Explicit authority to perform an action in a scope.
See this concept connect visually →
Why it exists
Software authority must be evaluated independently of job labels and UI presentation.
Example
A person may view a resource without having permission to approve it.
Connects to
- Permission / Capability authorizes eligible Review
- Permission / Capability controls current access to Resource
- Firebase Auth precedes evaluation of Permission / Capability
- Permission / Capability admits scoped commands to Domain Service
Implementation notes
Authentication establishes identity; authorization evaluates current scoped authority.
Public evidence: Role and audience selection are separate from scoped authority.
Related workflows
No curated journey in this edition.
Related decisions
Technical details
Authentication establishes identity; authorization evaluates current scoped authority.
Conceptual explanation; private implementation details are omitted.
Client
Web Client
The React and Next.js product experience.
See this concept connect visually →
Why it exists
The operational application needs interaction and authenticated domain access.
Example
The web crew directory and production workspaces share server contracts.
Connects to
- Web Client requests application access through Cloudflare Edge
- Desktop Client hosts the experience of Web Client
- Web Client calls explicit API Transport
Implementation notes
This engineering site is a separate static project and does not use the application runtime.
Public evidence: Clients share domain contracts while retaining distinct interfaces.
Related workflows
No curated journey in this edition.
Related decisions
Technical details
This engineering site is a separate static project and does not use the application runtime.
Conceptual explanation; private implementation details are omitted.
Service
Domain Service
Server-owned commands and queries for a bounded domain.
See this concept connect visually →
Why it exists
UI state should not decide privileged transitions or storage authority.
Example
A production command validates context before committing work.
Connects to
- Domain Service returns an authorized Response projection
- Next.js Origin runs Domain Service
- Domain Service persists canonical records in Firestore
- Domain Service accesses admitted files in Storage
- Domain Service checks identity using Firebase Auth
- Domain Service admits background work to Functions / Jobs
- Domain Service uses scoped adapters for External Provider
- Permission / Capability admits scoped commands to Domain Service
Implementation notes
Commands own transitions; queries return bounded authorized projections.
Public evidence: Cloudflare edge and Google Cloud application workloads have separate roles.
Related workflows
No curated journey in this edition.
Related decisions
See the system-wide decisions.
Technical details
Commands own transitions; queries return bounded authorized projections.
Conceptual explanation; private implementation details are omitted.
Provider
Firebase Auth
The application identity provider.
See this concept connect visually →
Why it exists
Identity verification needs a dedicated provider, separate from domain permission decisions.
Example
Sign-in identifies a user before production access is evaluated.
Connects to
- Domain Service checks identity using Firebase Auth
- Request Boundary establishes identity through Firebase Auth
- Firebase Auth precedes evaluation of Permission / Capability
Implementation notes
Authentication is not authorization.
Public evidence: Cloudflare edge and Google Cloud application workloads have separate roles.
Related workflows
No curated journey in this edition.
Related decisions
Technical details
Authentication is not authorization.
Conceptual explanation; private implementation details are omitted.
Provider
Firestore
Canonical application records and scoped persistence.
See this concept connect visually →
Why it exists
Durable records need transactional ownership rather than being reconstructed from the UI.
Example
Membership and production work records retain their own owners.
Connects to
- Firestore supplies scoped source data for Response projection
- Domain Service persists canonical records in Firestore
- Firestore supplies authorized source records for Today
Implementation notes
Public diagrams do not expose collection inventories or production identifiers.
Public evidence: Cloudflare edge and Google Cloud application workloads have separate roles.
Related workflows
No curated journey in this edition.
Related decisions
Technical details
Public diagrams do not expose collection inventories or production identifiers.
Conceptual explanation; private implementation details are omitted.
Provider
Storage
Private and public file storage behind appropriate domain policies.
Why it exists
Knowing a file location must not be equivalent to permission to retrieve it.
Example
A private resource representation is served only after current access is checked.
Connects to
- Domain Service accesses admitted files in Storage
Implementation notes
Resource bytes and website public media have different exposure policies.
Public evidence: Resources have immutable versions and exact-version review.
Related workflows
No curated journey in this edition.
Related decisions
See the system-wide decisions.
Technical details
Resource bytes and website public media have different exposure policies.
Conceptual explanation; private implementation details are omitted.
Service
Functions / Jobs
Background execution of admitted domain effects.
Why it exists
Slow or retried effects need durable processing outside an interactive request.
Example
Process notification intent after the domain change is committed.
Connects to
- Update admits delivery intent to Functions / Jobs
- Functions / Jobs attempts effects through External Provider
- Domain Service admits background work to Functions / Jobs
Implementation notes
Queue admission is not successful delivery.
Public evidence: Cloudflare edge and Google Cloud application workloads have separate roles.
Related workflows
Related decisions
See the system-wide decisions.
Technical details
Queue admission is not successful delivery.
Conceptual explanation; private implementation details are omitted.
Provider
External Provider
A boundary for third-party services and integrations.
Why it exists
Provider behavior and delivery are distinct from application state.
Example
An external communication provider processes an admitted delivery.
Connects to
- Functions / Jobs attempts effects through External Provider
- Domain Service uses scoped adapters for External Provider
Implementation notes
Public provider descriptions do not promise every integration is released.
Related workflows
Related decisions
See the system-wide decisions.
Technical details
Public provider descriptions do not promise every integration is released.
Conceptual explanation; private implementation details are omitted.
Provider
App Check
Application attestation at protected request boundaries.
Why it exists
Identity and application attestation address different request concerns.
Example
A protected request carries application attestation in addition to user identity.
Connects to
- App Check attests application context at Request Boundary
Implementation notes
Attestation complements authentication and scoped authorization.
Public evidence: Cloudflare edge and Google Cloud application workloads have separate roles.
Related workflows
No curated journey in this edition.
Related decisions
See the system-wide decisions.
Technical details
Attestation complements authentication and scoped authorization.
Conceptual explanation; private implementation details are omitted.
Service
API Transport
The explicit client contract for making an application request.
Why it exists
Callers should be clear about which identity and request context they carry.
Example
A client submits a domain command using its declared transport.
Connects to
- Web Client calls explicit API Transport
- iOS Client uses shared server contracts through API Transport
- API Transport submits requests to Request Boundary
Implementation notes
This public example omits internal transport headers and private endpoint details.
Public evidence: Cloudflare edge and Google Cloud application workloads have separate roles.
Related workflows
No curated journey in this edition.
Related decisions
See the system-wide decisions.
Technical details
This public example omits internal transport headers and private endpoint details.
Conceptual explanation; private implementation details are omitted.
Service
Request Boundary
Admission, routing and request policy before domain execution.
Why it exists
Privileged requests must reach a checked server boundary before performing work.
Example
A consolidated dispatcher routes an admitted command to a domain handler.
Connects to
- API Transport submits requests to Request Boundary
- Request Boundary establishes identity through Firebase Auth
- App Check attests application context at Request Boundary
Implementation notes
The diagram describes responsibilities, not exact security-control configuration.
Public evidence: Role and audience selection are separate from scoped authority.
Related workflows
No curated journey in this edition.
Related decisions
See the system-wide decisions.
Technical details
The diagram describes responsibilities, not exact security-control configuration.
Conceptual explanation; private implementation details are omitted.
Projection
Response projection
The minimum authorized output returned by a domain query or command.
See this concept connect visually →
Why it exists
Clients need useful presentation data without receiving private canonical records wholesale.
Example
A response describes the permitted work fields for the current actor.
Connects to
- Firestore supplies scoped source data for Response projection
- Domain Service returns an authorized Response projection
Implementation notes
A response projection does not become permission truth or replace canonical source ownership.
Related workflows
No curated journey in this edition.
Related decisions
See the system-wide decisions.
Technical details
A response projection does not become permission truth or replace canonical source ownership.
Conceptual explanation; private implementation details are omitted.