Six layers. One rule.
The architecture · Structure 1 / 5
The system has a small number of layers, each with one job. A layer may depend on the one below it through a public contract and may never reach into its internals. That single rule is what keeps a large system replaceable in parts.
The layers
- Substrate
Compute, storage, network, secrets, and the delivery mechanism that puts workloads where they belong. Everything above assumes it and nothing above depends on which vendor provides it.
- Record
Systems of record, the event backbone, the registry of shapes, and the derived stores. This layer holds what happened, and it is the layer built to outlive the rest.
- Domain
Services that own a subject and its rules. A domain is the smallest thing that can be replaced without renegotiating the whole system.
- Composition
The shared vocabulary that turns domains into experiences: interface tiers, view declarations, event dispatch, navigation, and the shell that makes many services feel like one place.
- Surface
Where people and delegated software actually meet the system: applications, conversational surfaces, terminals, devices, physical interfaces, and integrations.
- Governance
The contracts, versioning, conformance, and change process that hold the other five to their word. It is drawn at the top because it constrains everything beneath it, not because it is optional decoration.
The bands that cross every layer
Identity
The same answer to "who is asking" at every layer, whether the asker is a person, a service, a device, or a delegated agent. One answer is what makes an audit trail readable.
Policy
One place where "may this actor do this" is decided, consuming rules contributed by each domain. Distributed enforcement with centralized definition, never the reverse.
Audit
Important actions and the reason they were permitted, recorded where the acting layer cannot quietly edit them.
Migration
Every layer states how what it holds leaves it. A layer without an export story is an unfinished layer, not a fast one.
Why boundaries are contracts
An internal call is a decision to merge two things forever. A contract is a decision to keep them separable. The cost shows up early, as ceremony, and the benefit shows up late, when one part has to be replaced and the rest survives. Communities live on the late side of that trade, so the architecture pays the early cost on purpose.