The brain
`donad` owns durable names, resources, identity issuance, placement intent, rollout state, and audit history.
How it works
A service name resolves into a complete trust decision.
Dodona treats discovery, identity, authorization, execution, and audit as one path instead of separate systems that exchange ambient credentials.
The request path
Resolve the name. Pin the peer. Decide the method.
The object namespace returns endpoints and expected identity patterns. The client refuses the wrong peer, and the server enforces ACL and delegated authority in process.
01 Name /t/acme/tools/refunds
02 Resolve endpoint + expected identity
03 Prove mTLS binds both workloads
04 Authorize ACL + attenuated authority
05 Record hash-chained audit decision
Deployment shape
A durable brain, one agent binary on each worker.
“One system” means shared contracts and one control plane. Dodona ships several control-plane and edge helpers; it is not one executable for an entire deployment.
The node agent
One `donalet` binary per worker reconciles local workloads, obtains SVIDs, reports capacity, and drains registrations before stopping.
The data path
Native gRPC clients resolve and enforce identity directly. Ingress, xDS, and compatibility surfaces serve callers that need another path.
State ownership
Durable intent and live churn are deliberately separate.
Registered resources and namespace objects are the source of truth. Endpoint leases, relay uplinks, health, and in-flight load are churn state: they can disappear and be reconstructed without pretending to be durable configuration.
Progressive rollout uses the same endpoint view
Release intent, placement, endpoint health, and request outcomes feed one rollout state machine. This is an implemented capability inventory, not an uptime or production-readiness claim.
Observability is a named service
First-party exporters discover the collector through the process namespace and preserve its expected SPIFFE identity. Request outcomes and latency can persist to the Observe store without blocking ingress.
Next step
Bring an agent access or small-platform problem.
The public installer is not live. Current evaluation starts with a directly shared signed checkpoint and its artifact-only PLAY instructions.