Deterministic first
The requirement contract distinguishes required, preferred, not required, forbidden, and unknown. The architecture plan keeps deterministic constraints authoritative; AI suggestions will require human acceptance.
AuthWeave
From identity requirements to reviewable architecture decisions.
An identity architecture workspace in development. The live preview collects authentication requirements and exports a JSON profile or Markdown brief. Provider comparison and AI-assisted analysis are planned.
Current state
A public, browser-only requirements preview with six editable sections and JSON / Markdown exports. Answers are not saved after a refresh. The local API implements persistence and validation separately; provider evaluation, AI analysis, authenticated workflows, and architecture-decision exports are not available in the public preview.
The problem
Identity decisions depend on application requirements, provider capabilities, security boundaries, and tradeoffs that are difficult to compare consistently.
Engineering decisions
Contracts at the boundary
The local API checks profile structure and cross-field contradictions, and rejects stale updates. The public browser preview shares the structural schema, but does not run the API’s domain checks.
Evidence before recommendations
Provider comparison is planned around structured, dated source facts and human approval. Provider recommendations and semantic retrieval are not implemented yet.
Technology & scope
Web · live preview
Next.js · React · TypeScript · Tailwind CSS · JSON Schema
Browser-only requirements editor with in-memory answers and downloadable exports. It does not call the Java API.
Core API · local
Java 21 · Spring Boot · PostgreSQL · jOOQ · Flyway
Assessment persistence, structural and cross-field validation, and optimistic concurrency checks. Not deployed as a public API.
Contracts & testing · implemented
OpenAPI · JSON Schema · AJV · Testcontainers · GitHub Actions
Shared contracts, generated browser validation, and PostgreSQL integration tests. CI checks captured API payloads against the schemas.
AI worker · scaffold
Python · FastAPI · Pydantic
The service currently exposes health endpoints; it does not perform AI analysis.
AI & identity · planned
OpenAI Responses API · MCP · ZITADEL / OIDC
Optional model-assisted analysis behind typed contracts and human review, a domain-tool adapter, and authenticated saved workflows.
Operations · planned
OpenTelemetry · Terraform · Azure Container Apps
Tracing and a reproducible, temporary Azure integration environment. pgvector retrieval is conditional on measured benefit; Azure Service Bus is conditional on a demonstrated need for asynchronous processing.
Project notes · September 2026 · Public README