Skip to content
Nyl
Domain modelingRoadmapPlanned

Roadmap

Domain modeling ships as milestone M9 of the orchestration roadmap, in slices that each deliver something usable. The first slice needs no orchestration at all. This page is where the milestone is tracked. The design holds the contract and its open decisions, and issue #173 holds the discussion.

Done when: Colocated team declarations feed independently registered units. Local and CI runs produce identical bundles and execution keys. Moving a declaration without changing its membership or admission re-runs nothing. Schema, policy, and missing-evidence failures block only the consuming units, before any effect. Releases select their manifests and are selected by label or path, read the same bundles in every render, and render identically with and without the cache. The guide runs end to end.

M90 of 49 deliverables done#173

Prerequisites

Section titled “Prerequisites”

The slices build on these orchestration milestones.

  • M2Release inputs without orchestrationDone
  • M3Orchestration core with a constrained command unitDone
  • M4Container image and Terraform unitsDone

Slices

Section titled “Slices”

A slice is in progress once one of its deliverables has shipped, and done when all of it has. The line between slices fills as the slice above it progresses.

  1. R1

    Definitions and the catalog

    Planned

    Teams can declare typed resources and validate them, without orchestration.

    5 deliverables
    • Not done: ResourceDefinition loaded only from the [resources] paths of nyl.toml
    • Not done: Discovery of literal declarations with project-wide identity and Git provenance
    • Not done: Schema validation with defaults, and x-nyl-reference checks
    • Not done: nyl validate covering definitions and declarations
    • Not done: nyl get resources and nyl schema resources
    0 of 5 doneNeedsM2
  2. R2

    Collections and the bundle

    Planned

    Units collect declarations and receive them as one tool-neutral bundle.

    8 deliverables
    • Not done: The collections unit field with membership, ordering, and allowEmpty
    • Not done: Ownership claims with access: own and access: read, with removal and transition guards only for owners
    • Not done: fromUnit references inside declarations
    • Not done: The versioned ResourceBundle and its provenance in desired state
    • Not done: The bundle digest in the execution key
    • Not done: fromCollection references and the Command unit’s collections input
    • Not done: nyl prepare with fixture outputs
    • Not done: Referenced resources in the bundle: the x-nyl-reference closure, read-only and part of the digest
    0 of 8 doneNeedsM3R1
  3. R3

    Policy admission

    Planned

    Policies restrict what each folder may declare.

    3 deliverables
    • Not done: Kyverno validating policies loaded from [resources] policies
    • Not done: Trusted source-path annotations and a CRD derived from each definition
    • Not done: Rejection of mutating policies
    0 of 3 doneNeedsR1
  4. R4

    Native adaptation

    Planned

    OpenTofu and Terraform consume bundles, with or without orchestration, and removals wait for approval.

    6 deliverables
    • Not done: The driver prepare capability and nyl prepare --native
    • Not done: OpenTofu and Terraform adaptation, checked by the driver conformance suite
    • Not done: Approval before collection members are removed
    • Not done: nyl exec with deployed and worktree bundles
    • Not done: nyl prepare --native and nyl exec for a unit outside any Environment, and prepare --check
    • Not done: --worktree, --source, and --deployed with warnings and refusals for relevant uncommitted changes
    0 of 6 doneNeedsM4R2
  5. R5

    Transition rules

    Planned

    Definitions guard changes between versions, such as an account email, by denying them or requiring approval.

    6 deliverables
    • Not done: x-nyl-validations CEL rules with self and oldSelf, and the deny effect
    • Not done: --base comparing against another revision, and an explicit --no-base, required outside orchestration
    • Not done: The bundle of the current receipt as the baseline when a unit runs
    • Not done: oldObject and the operation for Kyverno policies
    • Not done: Tracked last-applied refs with exec --advance: permission preflight, compare-and-swap, recovery steps, and --bootstrap
    • Not done: The approve effect for guarded changes, with removed members as one of them, and --allow-change outside orchestration
    0 of 6 doneNeedsR3R4
  6. R6

    One unit per resource

    Planned

    A unit instantiates once per matching declaration with forEach.

    4 deliverables
    • Not done: forEach scanned statically and expanded from the catalog
    • Not done: resource in the structural pass, with only YAML-safe values printed
    • Not done: Instance names with the clash check
    • Not done: Instances leaving the ownership set under the teardown gate
    0 of 4 doneNeedsR2
  7. R7

    The worked guide

    Planned

    The AWS, GitHub, and Bao walkthrough becomes runnable.

    2 deliverables
    • Not done: The development, testing, and breakglass guide for AWS accounts and access grants
    • Not done: The guide validated as a tier-2 reference scenario
  8. R8

    The Release catalog

    Planned

    Releases point at their manifests and ApplicationGroups select them by label as well as by path.

    6 deliverables
    • Not done: Literal Release metadata.labels, scanned and verified after rendering
    • Not done: spec.manifests under the local path rule, with spec.include deprecated
    • Not done: Several Releases in one file, next to other Releases or control resources
    • Not done: The Release catalog keyed by path and document, and nyl get releases
    • Not done: ApplicationGroup source selector combined with path membership, guarded by an AppProject that derives nothing
    • Not done: --release for shared files in direct commands
    0 of 6 doneNeedsM2
  9. R9

    Release admission

    Planned

    Policies decide which folders may declare which Releases, so label membership cannot widen a generated AppProject.

    2 deliverables
    • Not done: Kyverno validating policies over rendered Releases and their manifests, per target
    • Not done: Trusted repository, source, target, and ApplicationGroup annotations, and the effective namespace
    0 of 2 doneNeedsR3R8
  10. R10

    Collections in Releases

    Planned

    Releases read declaration collections as template data, without orchestration.

    5 deliverables
    • Not done: The pure nyl-collections crate with membership, the reference closure, and bundle assembly, shared with R2
    • Not done: Release spec.collections, read-only, with ${ … } selector values
    • Not done: collections and referenced template variables with YAML-safe output
    • Not done: Bundle digests in the dependency recorder and the ownership index
    • Not done: Rejection in remote sources and of unresolvable references
  11. R11

    One Release per resource

    Planned

    A Release instantiates once per matching declaration with forEach.

    2 deliverables
    • Not done: forEach on Releases with the resource context
    • Not done: Instance names with the clash check, and instance bindings over base bindings
    0 of 2 doneNeedsR10