01 · Foundation
One foundation. Many separately deployed applications.
The Gravity Standard isn't a platform that applications are loaded into. It's a foundation they're built on. Applications share code by referencing it at build time. They never copy it, and they never share a runtime.
What the foundation contains
Four parts, owned by the foundation team.
- LibraryA pinned Go module
The code that must be the same everywhere, so security and operational quality don't depend on each author's care: the handler pipeline, authorization, tenant context, domain access, process runtime, sessions, rendering, the outbox, observability and service calls.
A copy of library code inside an application is a defect.
- ToolingSpecs to running code
validate checks a specification. compile produces a definition from it. generate emits Go, schema transitions, queries, state machines, Cedar policies and forms. check reports rule coverage and derives controls. publish records the published definition versions.
- Infrastructure modulesTerraform, versioned with the library
The standard Lambda module, the application stack (CloudFront, function URL, WAF association, DNS and certificate), the process module, the observability module, and the database role module.
- Foundation infrastructureOnce per deployment
One Postgres database with a schema per Data Domain and a private operational schema per application; one shared WAF web ACL; the DNS zone and certificates; KMS keys for per-tenant envelope encryption; and the Verified Permissions policy store.
Every request
The same path, in the same order, in every application.
The library fixes the handler order: authenticate, authorize with Verified Permissions, set the database session context, then execute. An application author can't skip a step, because they never write it.
The function URL accepts traffic only from its own CloudFront distribution, so the WAF can't be bypassed.
What an application is
Specifications, plus the code the specifications can't express.
Generated code
Data access, handlers, queries, schema transitions, state machines, Cedar policies and forms are generated from the definitions. They're regenerated, never edited by hand.
Hand-written code
Real business logic, such as a payroll calculation, is ordinary Go compiled into an automation Lambda that a Step Function calls. It belongs to the application, uses the library, and meets the same bar: 100% statement coverage and the standard module.
A change
A specification change needs no hand-written code and no library change. It regenerates and redeploys that application only.
Foundation applications
What every company needs, built like any other application.
A shared thing becomes an application only if it has its own state, rules or screens. Otherwise it's library code or a static asset. The list stays short on purpose.
| Application | Address | Owns domain | Purpose |
|---|---|---|---|
| Home | the company domain | registry | The front door: a launcher, the slash-command bar, and the registry of applications and their commands |
| Login | login.<domain> | identity | The one central sign-in |
| Tasks | tasks.<domain> | work | Skill queues, dispatch, and the cross-application task inbox |
| Directory | directory.<domain> | directory | Tenants, users, memberships and skill grants |
- A business application calls a foundation application over HTTPS, never the reverse. Foundation applications link to business applications; they don't call them.
- Applications don't call each other except through a declared HTTPS interface. A Lambda never invokes another Lambda directly.
- Service-to-service calls use a second, non-public function URL with IAM authorization. The caller signs with SigV4, and the user's identity travels in a signed header.
Tenants
Tenants vary by configuration, never by fork.
Applications and processes are defined once, at the company level, and shared by every tenant. A process declares its parameters, such as approvers, thresholds and SLAs. A Tenant Configuration binds the process to a tenant and supplies the values.
Each process version compiles to Step Functions once. A tenant's parameters travel as execution input and resolve at run time, so onboarding a tenant never compiles or deploys a state machine.
A tenant that needs a different shape gets a new company-level process or version, not a private copy.