Skip to content

ADR-0001: CNCF components only

Status: Accepted — product brief (2026-06) Principles served: I, VII; Platform & Security Baseline Source: .specify/memory/constitution.md (Platform & Security Baseline); docs/problem.md (alternatives); docs/design.md (rejected approaches)

Context

Tend's promise is governed AI app building that runs entirely inside the customer's boundary, with no proprietary lock-in. The incumbent answer (Power Platform) delivers governed citizen development but with proprietary lock-in and apps living in a walled garden. The CNCF ecosystem now provides the governance and runtime primitives — admission policy, network policy, GitOps, identity, registry, attestation — off the shelf; five years ago this would have meant building a platform from scratch.

Decision

Tend is built from CNCF components: Kubernetes, Argo CD, Tekton with Tekton Chains, Kyverno, Cilium, Keycloak, Harbor, Backstage, OpenCost, and vLLM-class serving for Tier 2. This is a binding constraint in the constitution's Platform & Security Baseline: any new infrastructure dependency outside this stack must be justified against the portability and no-lock-in promise, and exceptions must be recorded in a plan's Complexity Tracking.

Alternatives considered

  • Resell or integrate Lovable enterprise or similar SaaS with private networking — rejected as the idea's premise: boundary and governance remain the vendor's terms.
  • Power Platform advisory practice — rejected: services revenue on someone else's lock-in, no asset created.
  • Self-hosted low-code OSS (Budibase, Appsmith, ToolJet) hardened or extended with AI — rejected: form-builder paradigm rather than AI-native prompt-to-app; their runtime model is the platform, not Kubernetes, so governance would remain bolt-on and the CNCF differentiator is lost.
  • Pure SaaS control plane managing customer clusters — rejected for v1: contradicts the boundary promise; revisit as a managed offering later.

Consequences

The platform layer carries no foreign jurisdiction and the whole artifact is self-hostable, which is the wedge no US-owned competitor can match. Every capability must be composed from (or built to sit beside) the named stack, so custom build effort concentrates in the Tend operator and thin platform services rather than in infrastructure. New dependencies face a deliberate justification gate, which slows convenience additions by design.