Architecture
Clear ownership boundaries, enforced by the backend.
Each layer has one job. The public site can explain the platform because the platform, not the page, holds the truth.
Payload
Decides what the public property says: pages, navigation, metadata, changelog, and documents. It never owns operational truth.
Astro
Decides how the interface is rendered: public routing, SEO, server rendering, and the shell around interactive surfaces.
Crescevo kernel
Decides operational truth and legality: sessions, artifacts, evidence, decisions, commands, effects, authority, and audit.
Execution runtime
Executes approved work through capability-bounded workers, durable jobs, supervision, sandboxing, retries, and receipted execution.
Data flow
One request path, one authority.
The architectural rule
- Payload decides what the public property says.
- Astro decides how the interface is rendered.
- The Crescevo kernel decides operational truth and legality.
- The execution runtime executes approved work.
Consequences
The interface never becomes the authority. It renders backend-supplied legal actions, and the kernel revalidates every write against authentication, tenant, environment, workflow state, authority, evidence requirements, policy, approvals, idempotency, and version preconditions.
Tenancy isolates every record. Real-time state uses a resumable event model with cursor resume and gap detection, so a client can always rebuild a consistent projection. See the security model →
Architecture Center
Complete, governed reference architectures.
How Crescevo primitives combine into complete systems, with trust boundaries, failure modes, and when not to use each pattern. Not a catalog of imaginary products.
Reference architectures
Evidence-gated external execution
Only let an external effect run after evidence, a decision, and policy allow it, with a receipt.
Human-approved artifact
Turn sources into a grounded, reviewed artifact that ships only after an authorized decision.
Multi-tenant controlled workflow
Isolate every tenant's work at the data layer and enforce authority and policy on every write.
Durable integration and receipts
Turn an inbound webhook into a governed session and an idempotent, receipted outbound effect.
Versioned blueprint promotion
Validate, test, promote, and roll back a blueprint version deliberately across environments.
Patterns
Security guides
FAQ
Architecture questions
Why keep Payload out of operational logic?
So the public property can never become a second, drifting source of truth. Payload owns content; the kernel owns operational truth.
How does the console reach the kernel?
Through a same-origin backend-for-frontend that resolves auth, tenant, and policy server-side. Internal services are never exposed to the browser.