Platform Architecture

Authority boundaries

• Topolo Auth is authoritative for identity, organization access, service registration, service permissions, and API key catalogs.
• TopoloOne is the operator-facing control surface for those shared capabilities.
• Application services remain authoritative for their own data models and APIs.

Shared platform surfaces

• service registry
• user and organization resolution
• API keys
• resource-bound API access
• first-party browser auth transport through X-App-ID headers and app_id callback bodies
• deployment and operational conventions

Documentation model

This docs site is built from:

• public content for developers
• internal content for operators and agents, exposed under /internal only for Topolo-org members
• a system registry collection for canonical identifiers
• generated API summaries from source-controlled OpenAPI specs where available

Priority systems

The first migration wave covers Topolo Auth, TopoloOne, Socialize, TopoloCRM, and shared platform concepts. Additional applications can be added without changing the content contract.

Change Log / Verification

• Reconciled the Auth-owned workspace model, target-specific Cloudflare configuration, and fail-closed action-catalog boundary through topolo-platform origin/staging 51ff2d839e86 on 2026-07-29.

• Reconciled this page against topolo-platform origin/staging 24c646847b23 on 2026-07-24 after reviewing every docs-relevant commit since its previous verification watermark. Dependency-only currency commits were checked by the fleet production-dependency gate and did not change this page's product contract.

• Verified on 2026-07-05 that first-party browser login, refresh, and pre-boot SSO handoff use the X-App-ID / app_id auth contract instead of the retired X-App-ID browser header.

• Reconciled docs freshness on 2026-06-28 against topolo-platform through 20653c79; latest commit reviewed was 20653c79 feat(auth): bulk availability + app_id-mapping endpoints (seed subrequest cap), with recent context 20653c79 feat(auth): bulk availability + app_id-mapping endpoints (seed subrequest cap); 61117a0d feat(app-shell): add lazy component factory; d8784cfa feat(app-shell): add canonical lazy route factory.