Skip to main content
A model directory is the only production composition input, and it is a complete product: it must boot with no Go or React registration.

​
Canonical layout

Only requel.toml, events.star, and an optional home.star live at the root. Everything else has one home: data/secrets.lock belongs to the directory and selects exact immutable secret versions. Secret bytes never belong in Git.
There is no derived-dataset asset and no data/*.star namespace. If something feels like it needs one, it is usually a function.

​
Publishing a change

Publication is a Git operation performed through eclipse, not a runtime capability:
The result is one validated, signed review branch. Merging it publishes the product change. A deployment then loads that exact revision along with the secret-version lock it was built against. Product publication is not a workspace capability, and it never bypasses the plan/review/execute rail for the live world.

​
Connectors and credentials

eclipse connector authorize is the one interactive OAuth installation rail. It performs a single loopback PKCE authorization-code flow, sends the client secret only to the declared token endpoint, stores client ID, client secret, and refresh token as immutable secret versions, and atomically changes their three lock references for ordinary Git review. It creates no runtime connection store and no mutable credential registry.

​
The domain-blindness rule

Business vocabulary lives only in the model — Go, Rust and TypeScript module source, acceptance code, and seed data. It never appears in the Go kernel, the platform schema, the API shape, or the frontend. The test is simple: swapping model directories must yield a different operational product with zero kernel changes.