Current State and Target State

This page is the status key for the architecture section. Architecture pages describe the intended complete platform, but a capability is operational only when this page marks it Implemented and cites implementation evidence.

Status date: 9 August 2026. The platform is pre-first-release; the GitOps repository describes desired environments, but no production environment currently serves users.

architecture_status · current evidence and target gates

current / partialidentity & controltarget capabilityin development / planneddelivery state

Status vocabulary

Status	Meaning
Implemented	Code and its primary verification evidence exist. This does not by itself mean the capability is deployed.
Partially implemented	A useful path exists, but a named correctness, coverage, resilience, or deployment gap remains.
In development	Active implementation exists but has not reached its acceptance gate.
Planned	The target behavior is approved or directed, but implementation has not started.
Deferred	Intentionally outside the current delivery sequence.
Legacy only	Reserved status for material outside this documentation set; it is not used for the Go architecture.
Superseded	Replaced by a newer decision and not valid guidance.

Platform status summary

Capability	Current state	Target state	Status
External authentication	Keycloak OIDC/JWT validation at the gateway; required, optional, and public route modes exist	Operation-owned authentication declarations compiled from service OpenAPI	Partially implemented
Workload identity	Audience-bound Keycloak client-credential tokens, caller allowlists, subject-asserter controls, and GitOps configuration exist	Required on every internal HTTP and gRPC call, with request binding and no alternate internal credential path	Partially implemented
Relationship authorization	dx-authz-go evaluates OpenFGA relationships through /v1/check	Composite Authorize decision over relationships, context, delegation, trust, and obligations	Partially implemented
Contextual authorization	Closed constraints are stored but not comprehensively evaluated	OPA evaluates contextual and attribute policy through the composite PDP	Planned
Decision obligations	Individual services enforce local rules; no common decision artefact exists	Integrity-protected decision carries row filters, field rules, quota selection, expiry, and reason codes to enforcement points	Planned
Policy lifecycle	Policy records, outbox events, RabbitMQ projection, and OpenFGA consumer exist; model/projection alignment needs correction	Normalized, versioned grants with durable projection, reconciliation, tombstones, and policy revisions	Partially implemented
Internal transport	Shared gRPC server/client foundation and identity interceptors exist	All Go service-to-service calls use gRPC; public surfaces remain HTTP/REST	In development
Control Plane	Core services and primary APIs exist	Complete organization, catalogue, marketplace, policy, governance, and supporting-service workflows	Partially implemented
NGSI-LD Data Plane	Latest, entity, temporal, geo, aggregation, bulk, and CSV query paths exist	Complete ingestion/admin path plus carried authorization obligations	Partially implemented
OGC Data Plane	Features Parts 1–4, CQL2, CRS, Tiles, Coverages, Processes/jobs, and Records-lite exist	Hardened authorization plus operational scaling; EDR, Maps, Routes, DGGS, Styles, and full STAC remain optional evolution	Partially implemented
File Exchange	Multipart upload, downloads, object storage, processing jobs, cleanup, and ownership scoping exist	Streaming aggregate downloads, full worker recovery, and carried obligations	Partially implemented
Agentic Plane	Registry, runtime, MCP gateway, delegation, token exchange, kill switch, HITL, and local smoke flow exist	GitOps deployment, cross-replica leases, side-effect idempotency, provenance controls, sender-constrained tokens, and failure-injection proof	Partially implemented
Shared Go platform	Bootstrap, configuration, HTTP, persistence, cache, events, health, and observability foundations are adopted across the core fleet	Tagged SDK, complete conformance gates, stable gRPC contracts, and measured operational SLOs	Partially implemented
Central Kubernetes deployment	Shared Helm chart, ApplicationSets, environment values, workload credentials, NetworkPolicy, and External Secrets patterns exist	Every service routed, configuration boot-tested, metrics scraped correctly, and agents deployable	In development
Federated deployment	Trust, envelope, proxy, and certificate components exist behind configuration gates	Reviewed cross-domain topology with dynamic trust, mutual TLS, federation contracts, and operational SLOs	Deferred

Current and target invariants

• Authentication and authorization are separate decisions. A valid identity is never an authorization grant.
• Missing, invalid, expired, unknown, or unsupported authorization state denies by default.
• A workload may assert an end-user identity only when the receiving service explicitly lists it as a subject asserter.
• Organization and resource ownership predicates belong in datastore queries, not only in middleware.
• A data plane enforces a decision and its obligations; it does not independently recreate policy state.
• The model and LLM output are never authorization authorities in the Agentic Plane.

Evidence sources

Status is reconciled from the implementation roadmap, the active implementation handover, service repositories, and the decision records listed in Architecture Decisions.