Skip to content

ADR-0002: Enforce the contract, never review generated code

Status: Accepted — product brief (2026-06) Principles served: II Source: docs/design.md D2; .specify/memory/constitution.md Principle II

Context

Tend's apps are full generated code, produced by an AI builder from a business user's prompt. No platform team can code-review every generated app, and trusting generated code is not a security model. The platform needs a way to make user-built software safe at enterprise scale without a static-analysis gate on generated code.

Decision

Security and governance are enforced at the platform layer — never by reviewing or trusting generated application code. Every app, however it was built, runs under the same enforced runtime contract:

  • Kyverno admission policies enforce registry-only images, no embedded secrets, required App CR fields, and resource/cost caps.
  • Cilium network policies enforce default-deny networking with only declared paths permitted.
  • Declared data scopes are enforced at the data gateway, not in app code; undeclared access is denied.
  • Credentials are injected at runtime; apps with embedded secrets are rejected at admission.

The platform team reviews the contract once instead of reviewing every app's code.

Alternatives considered

  • Static analysis or code review of generated apps — rejected: design D2's consequence is explicit that no static analysis of generated code is required for the security baseline; code review is replaced by contract verification.
  • Constrained block composition (widget kit) instead of full code generation — rejected: hits the catalog edge fast and recreates Power Platform's expressiveness ceiling.

Consequences

Code review is replaced by contract verification, so governance cost does not scale with the number of apps. The test discipline follows the same shape — but only one half of it is mechanised. Every Kyverno policy ships with a violating manifest CI rejects, and a discovery gate fails the build when one is missing. Cilium has no equivalent: the policy workflow is path-filtered, a bundle-local network policy is invisible to it until someone adds its directory, and nothing fails when they forget. Two shipped Cilium policies have no counter-example at all. Isolation itself is proven by failing probe tests rather than by inspecting app code, and extending the discovery gate to network policy is open work. The contract's honesty has limits that are stated rather than hidden — for example, the embedded-secrets policy is admission-layer hygiene against obvious embedding, not secret scanning.