Gateway

There is no gateway configuration file. What can be called is what has been published: the flow brings its own name and the route appears with the artifact. Nothing is declared a second time, somewhere else.

Environment configuration is asked for by the flow, by name. A declared key the installation does not supply stops the boot and names the key — it is not discovered at the first message, with an empty value forwarded downstream. The same check runs without starting anything, and the command exits non-zero when a key is missing.

The price is written down, not discovered. A configuration value is captured once, at start-up, so changing configuration requires a restart — otherwise the start-up check would have verified values other than the ones the platform runs on. Same for the gRPC door’s routing table: it is built at start-up, so a flow published after that needs a restart before it is routable. And a boot scan cannot stay silent: a registry that cannot be listed stops the boot rather than looking checked.

• The credential is an API key or an identity provider’s token, both presented in Authorization: Bearer. The gate is closed by default; starting with no gate exists as an explicit option and announces itself on every boot.
• The authentication method is the tenant’s declared property, and a method this build cannot perform is refused at the tenant’s registration. Today that list accepts two: the API key and OIDC.
• A key carries scopes and, optionally, the list of flows it may call. A flow can require a given scope, and the requirement is checked after the artifact is loaded — that is where it is written.
• The gate runs before the body: a caller without a valid credential causes no body read and no parsing.
• An attributable refusal enters the audit chain with its subject, never carries the credential, and spends the caller’s ceiling — so a refusal cannot be used as a write pump. The audit is a record, not a doorman: if the row cannot be written, the refusal is still a refusal.
• A SOAP request goes through the same gate, unchanged. A refusal is plain HTTP 401 or 403, never a SOAP Fault — a fault carries a success status, and a gateway routing on status would forward the refusal as an answer.

What the platform performs

Key and token verification, scopes, the flow allowlist, the throughput ceiling, and the audited refusal.

What sits in front of it

TLS termination, at your reverse proxy.

The platform validates OIDC / OAuth 2.0 tokens itself, at the front door, for each tenant that declares an issuer. The signature is checked against that issuer’s JWKS, and iss, aud and expiry are required. The platform refuses alg: none and every HS* algorithm. The token’s roles are translated into the platform’s own entitlements, per tenant. A tenant declares at most one issuer, with nexus tenant oidc set, and the management UI has no OIDC page. A token is checked locally and stays valid until it expires: there is no introspection and no revocation before expiry, and opaque tokens are not accepted. The platform does not issue tokens and does not work with SAML.

A gateway guards the door. NexusFabric also transforms the message behind it in the same program, and queues it with retry.

Transformations · Operating · Observability

The ceiling is set on the key, when it is issued, or on an OIDC issuer’s declaration, which gives each subject (sub) one of its own. Both message doors — synchronous and queue — spend from it, and a throttling refusal says when to come back: four headers on 429. Connector telemetry does not spend the ceiling, so a connector sharing the key does not pay twice for the same message.

• The measured unit is the delivery, not the request: received plus exactly one verdict. Which door it came through is read from the channel column, not from the kind of event.
• The typed verdict has its own column — succeeded, fault_handled, failed — and can be filtered on.
• A flow can carry a six-field schedule, and a tick leaves the same pair as a request, on the cron channel.
• One retention window governs both journal sinks — rows and files — in a single pass, wired into the serving process. The default is 30 days.

• SecurityHow far an unauthenticated caller gets, and what does not leak into a log.
• ObservabilityWhat can be read about a delivery, and how long it stays written.