Historical dogfood proof. Until its 2026-07-13 decommission, the hey.ad cluster served the public web, docs, and pitch sites as static workloads through Dodona's own ingress. There is currently no production deployment.

// open application substrate

Dodona

Dodona is a sovereign, gRPC-native substrate for services and agents — with a Kubernetes-compatible surface when you need one.

Pronounced doh-DOH-nah. Dodona brings progressive delivery, provable sovereignty, first-party observability, and the Directory product path into one gRPC-first control plane. The dated dogfood proof is narrow: Dodona previously served the Dodona website through its own ingress.

See captured output Read the showcase docs

Audited baseline on 2026-07-07: 23 Rust crates; 285 Rust tests passed, 0 failed, 3 ignored in the recorded workspace run; phase0 Go remains the conformance peer. Known gaps stay labeled below and in the docs.

current proof

What exists in this checkout

These are narrow, testable claims tied to the audited tree and the current docs. They are not usage metrics or market claims.

dogfood Before decommission on 2026-07-13, the website, docsite, and pitch properties were served as Dodona workloads through Dodona ingress on the hey.ad cluster. No production deployment exists now.
deployment pipeline Artifacts, immutable releases, deployments, rollout actions, manual holds, and deployment mutation audit are implemented and documented.
ingress / edge / auth Public routes, route auth, Cloudflare DNS reconciliation, ACME DNS-01/file certificate materialization, and the auth helper exist.
console The operator console exposes dashboard, JSON API, and MCP surfaces; its own HTTP listener still relies on ingress auth in public use.
observe dona-observe has gRPC ingest/query APIs, memory and ClickHouse stores, spool handling, and an agent collect stream.
sovereignty Audit entries are hash-chained and signed; exported reports verify offline, with the documented tail-drop anchoring gap still open.

product line

One control plane, four connected stories

progressive delivery

Artifact to release to deployment, then request-level rollout control

Dodona's deployment model records the build artifact, the immutable release, and the deployment event history before the canary controller shifts traffic. Flags, sticky percentage rollouts, canary, rolling, and blue/green strategies all resolve through the same per-request routing pipeline.

The current environment driver field is metadata, not a placement actuator. Scheduling tags gate StartDeployment against currently registered endpoints; the scheduler and full placement loop are later blueprint work.

artifact -> release -> deployment -> rollout actions/events

request path:
context -> constraint -> selection -> balance
              |             |
              |             +-- flag or canary choice
              +-- residency / tenancy deny before routing

current operator model, from docs/deployments.md

sovereignty

Hard constraints stay above soft traffic choices

Residency and tenancy are hard filters. If a request cannot be served inside the allowed endpoint set, Dodona denies and audits it instead of falling through to a flag, canary, or load-balancer decision.

Under mTLS, the serving process can key enforcement to the authenticated SPIFFE peer identity. The audit chain and signed report format are built; external head anchoring remains the honest mitigation for whole-log tail truncation.

soft choices cannot override hard policy

allowed endpoint set empty
  -> PermissionDenied
  -> audit event
  -> signed report can be verified offline

constraint -> deny -> audit, never misroute

observability

Observe is a product boundary, not a dashboard skin

dona-observe is the gRPC ingest/query boundary for request outcomes, logs, metrics, traces, error events, and Kubernetes event-derived inventory. Ingress reports proxied HTTP outcomes into the control-plane stats stream, so public web traffic can feed service dashboards and rollout analysis.

Native OTLP ingest, Datadog/Sentry compatibility, browser explorers, monitors, SLOs, incidents, and retention policy are not implemented yet. They are roadmap items, not hidden features.

donalet --observe
  -> Collect stream
  -> dona-observe
  -> memory or ClickHouse store
  -> console gateway / future explorers

current observe foundation and the next UI path

The zero-cluster product path shares the substrate

The Directory story is the adoption path: a hosted service directory, identity-preserving relay, and delegable agent authority for teams that should not have to start by running a cluster.

In this checkout, the relay, connector, and directory crates are compile-clean stubs reserved for that D-track work. The site should call that a foundation, not a shipped Directory product.

Directory A0/A1 path
  relay      reserved crate
  connector  reserved crate
  directory  reserved crate

depends on object namespace, identity, observe

foundation in-tree; product work still ahead

subsystems

The current surface area

The web story now matches the 2026-07-07 audit: edge, ingress, console, observe, deployment, federation identity, and Directory foundations are visible instead of hidden behind the original SDK demo.

Brain

Endpoint leases, config watches, flags, rollout state, deployment records, ingress/shared services, stats, and attestation.

SDK / RPC

Proxyless Rust data plane with deadlines, retries, breaker, Workload registration, and server-side enforcement.

Ingress

HTTP(S) reverse proxy over operator-owned routes with bearer, cookie, Basic, and mTLS route-auth policy.

Edge

Cloudflare DNS plus ACME DNS-01/file certificate reconciliation for public routes.

Console

Dashboard, JSON API, and MCP endpoint for operators; protected publicly by ingress auth.

Observe

First-party ingest/query service with memory and ClickHouse backends, spool, and agent collection.

Identity

SPIFFE CA, scoped bootstrap tokens, node attestation, federation cells, and workload SVID grants.

Sovereignty

Hash-chained audit, ed25519 signed reports, and offline verifier; external anchoring still open.

Store / k8s skin

Durable config WAL, MVCC, etcd-v3 shim, raft library pieces; full apiserver skin is later work.

Built vs. not built

Area	Built now	Still a gap
Progressive delivery	Artifact, release, deployment records; canary/rolling/blue-green control; manual holds.	Environment drivers do not actuate placement yet; shadow returns unimplemented.
Observability	Observe gRPC APIs, ClickHouse/memory stores, collect stream, console service panels.	OTLP receiver, explorers, monitors/SLOs/incidents, and vendor compatibility.
Ingress and edge	Public route proxy, route auth, Cloudflare DNS, ACME DNS-01/file cert store.	Control-plane RBAC/admission and broader Envoy LDS/RDS/SDS export.
Directory	Object namespace protos and reserved D-track crates.	Relay, connector, tenancy, delegation, and hosted product UX.
Distribution	Local release tarballs and install scripts are tested.	`get.dodona.dev` and `ghcr.io/dodona-dev/*` remain placeholders.

Start with the captured demo output

The demo page shows a fresh transcript from the current tree and the exact command that reproduces it.

Open the transcript Run locally