The constitution

Tend's governance baseline is written down as a constitution (.specify/memory/constitution.md, v1.0.0, ratified 2026-06-27). It is binding on every feature, plan, and pull request: where a principle and a feature spec conflict, the principle wins. Every implementation plan must pass a Constitution Check against all seven principles before design work starts and again after it finishes; deliberate deviations must be recorded in the plan's Complexity Tracking table. Two principles are non-negotiable and admit no deviation at all.

This page summarizes the principles and what enforces each one. The constitution file itself is authoritative.

The seven principles

I. Governed Boundary Integrity — non-negotiable

No prompt, generated code, application data, model input/output, or telemetry may leave the customer-controlled boundary defined by the configured tier. Any feature that opens a network path off-boundary is rejected by default; the only exception is egress explicitly declared by an app and enforced at the platform layer.

Enforced by: the generated Cilium perimeter (gateway-only egress, default deny), the Tier 1 inference gateway, and CI isolation probes. Those probes run on pull requests touching the paths the policy workflow filters on, not on every pull request; the filter has been wrong three times, twice letting a policy change merge green with no policy job run.

II. Contract-Not-Code Governance

Security is enforced at the platform layer — admission policy, network policy, the data gateway — never by reviewing or trusting generated application code. Every app runs under the same contract: declared data scopes, default- deny networking, registry-only dependencies, runtime-injected credentials, enforced resource and cost caps.

Enforced by: the Kyverno admission baseline (deploy/policies/kyverno/), the data gateway, and per-namespace ResourceQuota/LimitRange rendered by the operator.

III. Evidence Chain & Attestation — non-negotiable

Every artifact carries a verifiable attestation chain from prompt to production — prompt hash, model identity and version, the source commit, and the artifact digest — as cosign-signed in-toto/SLSA v1 attestations stored beside the image.

Test results are in the rule and not in the chain

The constitution names test results as part of that chain. They are not in it. The build pipeline has three tasks — fetch source, build image, sign and attest — and none of them runs a test, so no test result is attested. The evidence index's tests category compounds this: it reports passed: true for any artifact that merely carries an attestation digest, which means a green tests entry today records that the supply-chain gate passed, not that any test ran. Closing the gap is open work; until it closes, read that category as "attested", never as "tested".

Unattested artifacts are refused at admission in every environment, including sandbox. Every app's full history is queryable. Purpose classification (including the decisions-about-people flag for EU AI Act triage) is captured at promotion; Tend records and surfaces, it does not adjudicate conformance.

Enforced by: Tekton Chains + cosign, the Kyverno verifyImages gate, and the evidence index.

The rule above is quoted from the constitution. What enforces it has a scope worth stating in the same breath: the admission policy selects on the tendtech.io/app namespace label, which the operator applies to every workload namespace it provisions. In a namespace without that label the policy does not select the workload, and an unsigned image is admitted. Every environment the platform governs is covered, sandbox included — and "governed" means "carries the label".

IV. App CRD as Single Source of Truth

Each app is exactly one App custom resource carrying owner, expiry, declared scopes, purpose classification, environment state, and references to its repo and attestation chain. All platform behavior reconciles from it; no authoritative app state lives anywhere else. Access logs and assembled evidence are read-time projections, not authoritative state.

V. Platform-Enforced Lifecycle

Every app has a named owner and an expiry, enforced by the platform rather than by convention: ownerless apps are flagged and eventually frozen, expired apps freeze, frozen-past-retention apps are retired. No app may be immortal and no app may be unowned. See App lifecycle.

VI. GitOps Delivery & Promotion

All change — app code, promotion, and the policy baseline itself — flows through git and Argo CD. Promotion to production is a platform-raised pull request with the evidence record attached; approval is the merge. The builder and end users never deploy directly.

Recorded deviation: cost-cap suspension acts operator-direct (pause Argo sync, then scale to zero) rather than via a git commit, because enforcement is time-boxed (≤15 min) and must work even if the git path is degraded. See ADR-0012.

VII. Replaceable Builder & Single Artifact

The AI builder sits behind a narrow contract — talk to the inference gateway, commit to the app repo, never deploy — and two candidate builders must stay viable. The deployed artifact is identical for managed and self-managed operating models; behavior never branches on operating model in the codebase.

Platform & security baseline

Beyond the principles, the constitution binds every feature to:

• CNCF stack only — Kubernetes, Argo CD, Tekton (+Chains), Kyverno, Cilium, Keycloak, Harbor, Backstage, OpenCost, vLLM-class serving for Tier 2. Anything else must be justified against the no-lock-in promise.

• Hard sandbox isolation — sandbox and production are separate clusters, or hard-isolated virtual clusters only with a documented threat model; sandbox uses synthetic or masked data exclusively and has no route to production.

  Shipped deviation from this baseline

  What ships today does not meet that bar. The sandbox deploys to a Cilium-isolated namespace on the same cluster as production, not to a separate cluster and not to a hard-isolated virtual cluster. The deviation is recorded at deploy/argocd/sandbox.yaml and in the 007 plan's Complexity Tracking, and the separate sandbox cluster is deferred work rather than a change to the rule.

  The rule above is quoted as the constitution states it. It is not restated to match what shipped — a page that softened it to fit the implementation would put the documentation in conflict with the constitution, which the constitution forbids.

  • Declared v1 data sources — Postgres, S3-compatible object storage, internal HTTP/REST, and one identity-governed warehouse connector, all through the data gateway. What ships accepts synthetic, postgres and s3; REST and the warehouse connector are not built.
  • Per-app cost attribution — OpenCost per namespace, fed to App status, with suspension on cap breach. The constitution permits throttle or suspend; only suspend is built.
  • Internal-only scope — Tend governs internal apps for business power users; it is not for customer-facing software and does not build models.

How compliance is proven, not promised

The constitution's test discipline pairs every claim with an executable proof:

Claim	Proof
Operator reconciliation is correct	envtest suites
Each policy actually blocks	a violating manifest per policy, rejected in CI — two per-app Cilium policies are still uncovered
Sandbox cannot reach production	failing probe tests from sandbox toward production
Unattested images can't run	admit/refuse demonstration. The refuse half runs in CI; the admit half needs a signed fixture and runs only in the full quickstart

The two non-negotiables (I and III) must run live — never disabled, never simulated. That is the standing requirement, and the proofs are live rather than simulated — with the one carve-out named in the table above: the attestation gate's admit direction is not exercised in CI.

What is not true is the "on every change" half. The workflow carrying those proofs is path-filtered: it runs when a change touches one of the directories it lists, and a change elsewhere runs none of it. The filter has been wrong three times, and twice a policy change merged green having run no policy job at all. Closing that gap is open work, and until it closes, a green pull request is not by itself evidence that either non-negotiable was exercised.