Architecture

Architecture

How Redgold builds, runs, and evolves fully managed pipeline applications.

Redgold brings application authoring and operation into one managed platform. Describe the behavior you need, review the proposed application change, and use the deployed result. Redgold operates the routing, execution, typed storage, builds, and deployment behind it. Persistent agents help create and maintain the application; issues and workstreams keep that work connected to an outcome.

Fully managed describes who operates the infrastructure. Pipeline applications are currently a managed preview: account setup, datasets, application publication, and environment provisioning are coordinated during onboarding.

Two connected paths

An application has a delivery path that changes its behavior and a request path that serves its users. An agent finishing a task changes neither the live route nor the stored data by itself; the reviewed change must pass through publication and deployment.

flowchart TB
  Goal[Application objective] --> Work[Workstream and issues]
  Work --> Agent[Managed agent workspace]
  Agent --> Git[Reviewed schemas, pipelines, transforms and tests]
  Git --> Release[Managed build and publication]
  Release --> Runtime[Deployed application revision]
  User[App user or API client] --> Edge[Authenticated edge]
  Edge --> Executor[Pipeline executor]
  Runtime --> Executor
  Executor --> Data[Data engine and typed storage]
  Executor --> Integration[Authorized external services]

The application contract

The durable application definition lives in Git. Rust serde schemas describe records; pipeline TOML describes routes and execution stages; transforms supply domain behavior; tests and example requests define the expected result. Managed publication validates these artifacts together and deploys the supported runtime configuration. The support-triage walkthrough shows this contract in code.

AreaYour application decisionRedgold's managed responsibility
BehaviorWhat requests mean and which outcomes are correctExecute the reviewed pipeline and transform
DataRecord shape, identity, access requirementsProvision datasets and operate storage and scoped access
DeliveryScope, acceptance criteria and required approvalBuild, validate, publish and reconcile deployment
Agent workObjectives, priorities and review feedbackProvide workspaces, tools, session history and assigned capacity
IntegrationsWhich external repository or service to connectUse the configured connection within its granted permissions

Read the architecture through an event

Why these boundaries exist

The edge authenticates and relays requests; application code runs in executors. This keeps route handling separate from the compute that can fail or need more capacity. The data engine owns durable writes and scoped reads, so an application uses the managed data boundary instead of operating a separate storage stack. Git records intended application changes; runtime evidence tells you what is actually serving. Keeping both is essential when a build passes but a rollout has not reached the expected revision.

Shared infrastructure also means applications follow explicit schema, capability, and publication contracts. A new external dependency or runtime requirement may need onboarding work. The runtime placement guide describes which execution choices are available and which remain previews.

External systems fit around the managed application

A managed pipeline application can integrate with authorized external services and data sources. Agents can also work on an external repository whose CI and hosting stay elsewhere. The model API can be used independently by existing applications. These connections do not automatically move external deployment, storage, or access policy under Redgold management.

See GitHub repository automation, and the model API for their supported boundaries.

Current capability matrix

Status verified 2026-08-14 against the executor conformance test and the Git-authored route inventory.

CapabilityStatusAccess boundaryDetail
pipelines/routes/<domain>/*.toml route manifestspreviewDeveloper onboarding; publication is managedBuild a vertical
In-process built-in operatorsavailablePlatform-managed operatorsPipeline Apps runtime placement
Trusted native transforms (NATIVE_DYLIB)availableReviewed, trusted code in managed pipelinesPipeline Apps runtime placement
Firecracker UDF sandbox (MICROVM)availableOnboarded workloads on opted-in KVM nodesPipeline Apps runtime placement
Server request-handler WASM hostcomponent previewFeature-gated host and local fixtures; production route selection is not wiredPipeline Apps runtime placement
Dataflow UDF WASM tiercomponent previewDefault-on Wasmtime backend is implemented in the executor; capability-limited, bounded, no WASI, first route staged for publicationPipeline Apps runtime placement
GPU executor tierstubModel serving uses a separate GPU laneAI and agents
Copyright © 2026