terrane 1.0.0__tar.gz

terrane-1.0.0/.gitignore

@@ -0,0 +1,49 @@
+__pycache__/
+*.py[cod]
+.venv/
+venv/
+.idea/
+.vscode/
+*.tmp
+
+# Built by 80_APP/tools/export_site.py and the Pages workflow
+site/
+
+# Installed on demand by 50_ENGINE/tools/mermaid_parse_check.mjs and
+# the probes in 80_APP/tools/dev
+node_modules/
+
+# Built by 80_APP/tools/review_pack.mjs: a picture of a commit, not a record
+*.pptx
+# The workbook `terrane pack --excel` writes beside the default deck: the same picture, as sheets
+70_ARTIFACTS/review-pack.xlsx
+
+# Pictures the developer probes in 80_APP/tools/dev/ write
+80_APP/tools/dev/out/
+
+# Written by `terrane render --png` through resvg-py, which CI does not have, so
+# a committed PNG would be the one generated file nothing holds fresh
+70_ARTIFACTS/png/
+
+# What `terrane --root 90_EXAMPLE/thurman-health render` and friends write. The
+# second estate commits its model and views, not its pictures: the gate and
+# its own test hold it, and a second copy of every generated file would be a
+# second thing for every drawing change to keep fresh.
+90_EXAMPLE/thurman-health/40_SCHEMAS/
+90_EXAMPLE/thurman-health/70_ARTIFACTS/
+
+# Built by 50_ENGINE/tools/wheel_check.py: the sdist and the wheel, before a release
+/dist/
+
+# Credentials never belong in the repository: a connection names where its
+# secret lives (an environment variable, a secrets manager), not the secret.
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+*.pfx
+*.p12
+secrets.yaml
+secrets.yml
+.secrets/

terrane-1.0.0/10_MODEL/model.yaml

@@ -0,0 +1,150 @@
+# Model-level configuration.
+name: Architecture Model
+description: >
+  The application, data and technology landscape. Populate it with `terrane import
+  csv` from an existing inventory, with the app in `80_APP/`, or by hand.
+
+# The sample estate the repository ships with, and the one the engine's tests
+# are seeded from. While this says true, `terrane refresh` copies the export into
+# 90_EXAMPLE/csv and the spelling test reads this folder's prose. `terrane clear`
+# takes the estate out and this line with it (00_METHOD/AAC-15_ADOPTING.md).
+sample_estate: true
+
+# Libraries of the organization's own, read after the shipped 20_ARCHETYPES
+# to 29_TYPES folders and in the order listed; each holds any of the same
+# layer folders. A record there stands in for a shipped one only when it says
+# `replaces:` with its own id (00_METHOD/AAC-16_EXTENDING_THE_LIBRARY.md).
+# library_paths: [our-library]
+
+metamodel:
+  aligns_to: architecture_method_metamodel.v2
+  contract: 00_METHOD/AAC-07_METAMODEL_CONTRACT.md
+
+# Overrides for the house palette. Anything not listed falls back to the
+# defaults in 50_ENGINE/terrane/palette.py.
+palette:
+  Vendor:
+    fill: "#fff7ed"
+    stroke: "#ea580c"
+
+# What the library asks of this estate, answered once for every product on
+# it. A shape or a part names a role -- who owns the shared network, where a
+# vendor's audit trail goes, which controls govern a vendor tenancy -- and
+# this says which of the estate's records plays it; a product says otherwise
+# for itself with `with` on the part. The shared services are not here: the
+# library names their kind, and the services tagged `landing-zone` answer
+# (50_ENGINE/terrane/estate.py).
+answers:
+  platform_org: ORG-TECH
+  data_org: ORG-DATAENG
+  security_org: ORG-INFOSEC
+  ingest_system: SYS-DATA-INGEST
+  siem_system: SYS-SIEM
+  vendor_controls: [CTL-TPRM-DD]
+  vendor_policies: [POL-TPRM]
+  landed_data_controls: [CTL-RETENTION]
+  landed_data_policies: [POL-RECORDS, POL-PRIVACY]
+  access_controls: [CTL-ACCESS-CERT]
+  access_policies: [POL-INFOSEC]
+  change_controls: [CTL-CHG-APPROVAL]
+  change_policies: [POL-CHANGE]
+
+# Who owns each of the library's patterns here, the decision that approved
+# it, and which controls in the register it is designed to meet. The pattern
+# in 27_PATTERNS says what it is for and what it costs, and goes to any
+# estate; these three are the card issuer's, so they are kept with its
+# model rather than on the pattern, where a second estate heard fifty-one
+# warnings about a register it never had (50_ENGINE/terrane/estate.py).
+patterns:
+  customer-communication-archive:
+    owner_org_id: ORG-SERVICING
+    decision_ref: ADR-0017
+    satisfies: [CTL-NOTICE-CONTENT, CTL-FDCPA-NOTICE, CTL-RETENTION]
+  contact-center-integration:
+    owner_org_id: ORG-SERVICING
+    decision_ref: ADR-0020
+    satisfies: [CTL-CONTACT-LIM, CTL-COMPLAINT-REG, CTL-AUTH-POLICY]
+  analytics-landing-zone:
+    owner_org_id: ORG-DATAGOV
+    decision_ref: ADR-0010
+    satisfies: [CTL-DQ-GATE, CTL-MASK-NONPROD, CTL-RETENTION]
+  inline-risk-decision:
+    owner_org_id: ORG-FRAUD
+    decision_ref: ADR-0014
+    satisfies: [CTL-FRAUD-SLA, CTL-AUTH-AVAIL]
+  governed-model-lifecycle:
+    owner_org_id: ORG-CREDIT
+    decision_ref: ADR-0018
+    satisfies: [CTL-ADVERSE-ACT, CTL-TREATMENT-APPR, CTL-DQ-GATE]
+  public-web-entry:
+    owner_org_id: ORG-INFOSEC
+    decision_ref: ADR-0003
+    satisfies: [CTL-PCI-EVIDENCE]
+  api-front-door:
+    owner_org_id: ORG-TECH
+    decision_ref: ADR-0004
+    satisfies: [CTL-AUTH-POLICY]
+  private-egress-to-saas:
+    owner_org_id: ORG-VENDORMGMT
+    decision_ref: ADR-0007
+    satisfies: [CTL-TPRM-DD, CTL-SANCTIONS]
+  event-fanout:
+    owner_org_id: ORG-APPDEV
+    decision_ref: ADR-0008
+    satisfies: []
+  partner-file-exchange:
+    owner_org_id: ORG-TPS
+    decision_ref: ADR-0009
+    satisfies: [CTL-CLIENT-SLA]
+  shared-database-integration:
+    owner_org_id: ORG-APPDEV
+    decision_ref: ADR-0002
+    satisfies: []
+  regulatory-file-furnishing:
+    owner_org_id: ORG-COLLECTIONS
+    decision_ref: ADR-0022
+    satisfies: [CTL-METRO2-RECON, CTL-BUREAU-ACC, CTL-REGE-ACK]
+  workload-account-baseline:
+    owner_org_id: ORG-TECH
+    decision_ref: ADR-0001
+    satisfies: [CTL-CHG-APPROVAL, CTL-ACCESS-CERT, CTL-VULN-SLA]
+  hybrid-return-path:
+    owner_org_id: ORG-TECH
+    decision_ref: ADR-0011
+    satisfies: [CTL-DR-TEST]
+  observed-service:
+    owner_org_id: ORG-TECH
+    decision_ref: ADR-0015
+    satisfies: [CTL-IR-PLAYBOOK, CTL-AUTH-AVAIL, CTL-DR-TEST]
+  change-evidence-chain:
+    owner_org_id: ORG-EA
+    decision_ref: ADR-0016
+    satisfies: [CTL-CHG-APPROVAL, CTL-REGCHANGE-TRACK]
+  payment-capture-and-posting:
+    owner_org_id: ORG-PAYMENTS
+    decision_ref: ADR-0021
+    satisfies: [CTL-PMT-POSTING, CTL-FUNDING-CONF, CTL-DAILY-RECON]
+  workforce-identity-lifecycle:
+    owner_org_id: ORG-INFOSEC
+    decision_ref: ADR-0012
+    satisfies: [CTL-ACCESS-CERT, CTL-IR-PLAYBOOK]
+  secrets-and-keys:
+    owner_org_id: ORG-INFOSEC
+    decision_ref: ADR-0013
+    satisfies: [CTL-PCI-EVIDENCE]
+  tokenized-card-data:
+    owner_org_id: ORG-INFOSEC
+    decision_ref: ADR-0019
+    satisfies: [CTL-PCI-EVIDENCE, CTL-AUTH-AVAIL]
+  stateless-request-service:
+    owner_org_id: ORG-APPDEV
+    decision_ref: ADR-0005
+    satisfies: []
+  windowed-batch:
+    owner_org_id: ORG-DATAENG
+    decision_ref: ADR-0006
+    satisfies: [CTL-DAILY-RECON]
+  strangler-facade:
+    owner_org_id: ORG-APPDEV
+    decision_ref: ADR-0023
+    satisfies: [CTL-CHG-APPROVAL, CTL-CONV-VERIFY]

terrane-1.0.0/10_MODEL/tech_services/ai_platform.yaml

@@ -0,0 +1,50 @@
+# The foundation model service of each landing zone, tagged `landing-zone` so
+# a part that asks for one (the inference service in 28_MODULES/) resolves to
+# it without the shape binding it. Named as the clouds name them in 2026;
+# the models behind each are the provider's own families and the third-party
+# ones it hosts, which change too often to list here.
+
+- tech_service_id: TS-AWS-BEDROCK
+  name: Amazon Bedrock
+  description: Managed access to foundation models (Amazon Nova, Claude, Llama and others) inside the account's own data boundary.
+  status: Active
+  togaf_layer: Technology
+  architecture_domain: Technology
+  company_domain: Enterprise Platform
+  owner_org_id: ORG-TECH
+  provider: AWS
+  cloud_provider: AWS
+  service_category: AI
+  service_name: Bedrock
+  component_type: foundation-model-service
+  tags: [landing-zone]
+
+- tech_service_id: TS-AZURE-FOUNDRY
+  name: Microsoft Foundry
+  description: Managed access to foundation models (OpenAI, Microsoft MAI, Claude and others), formerly Azure OpenAI Service and Azure AI Foundry.
+  status: Active
+  togaf_layer: Technology
+  architecture_domain: Technology
+  company_domain: Enterprise Platform
+  owner_org_id: ORG-TECH
+  provider: Microsoft Azure
+  cloud_provider: Azure
+  service_category: AI
+  service_name: Foundry
+  component_type: foundation-model-service
+  tags: [landing-zone]
+
+- tech_service_id: TS-GCP-GEMINI-PLATFORM
+  name: Gemini Enterprise Agent Platform
+  description: Managed access to foundation models (Gemini, Gemma, Claude and others) through Model Garden, formerly Vertex AI.
+  status: Active
+  togaf_layer: Technology
+  architecture_domain: Technology
+  company_domain: Enterprise Platform
+  owner_org_id: ORG-TECH
+  provider: Google Cloud
+  cloud_provider: GCP
+  service_category: AI
+  service_name: Gemini Enterprise Agent Platform
+  component_type: foundation-model-service
+  tags: [landing-zone]

terrane-1.0.0/10_MODEL/tech_services/aws_network.yaml

@@ -0,0 +1,337 @@
+# The network fabric. Modeled by hand rather than by the onboarding archetype
+# on purpose: account-level networking is provisioned by the landing zone, not
+# by the product team, and in a real estate several products share a VPC. An
+# archetype that vended a VPC per product would be describing a different
+# operating model from the one this estate actually runs.
+#
+# Subnets are per availability zone, which is what makes a multi-AZ diagram
+# drawable without duplicating every system once per zone.
+
+# --- shared network account -------------------------------------------------
+- tech_service_id: TS-NET-VPC-SHARED
+  name: Shared Services VPC
+  service_name: VPC
+  component_type: vpc
+  description: Hub VPC holding the transit attachments, egress and resolver endpoints.
+  status: Active
+  provider: AWS
+  service_category: Network
+  owner_org_id: ORG-TECH
+  cloud_provider: AWS
+  cloud_account: shared-network
+  region: eu-west-2
+  network_zone: Shared-Services
+  cidr: 10.20.0.0/16
+  company_domain: Enterprise Platform
+  togaf_layer: Technology
+  architecture_domain: Technology
+  tags: [network-fabric, landing-zone]
+
+- tech_service_id: TS-NET-DX
+  name: Direct Connect
+  service_name: Direct Connect
+  component_type: hybrid-link
+  description: >
+    Dual 10G circuits to the data center, one per carrier hall. The primary
+    hybrid path, and the long-lead item on any onboarding that touches the
+    mainframe.
+  status: Active
+  provider: AWS
+  service_category: Network
+  owner_org_id: ORG-TECH
+  cloud_provider: AWS
+  cloud_account: shared-network
+  region: eu-west-2
+  network_zone: Shared-Services
+  company_domain: Enterprise Platform
+  togaf_layer: Technology
+  architecture_domain: Technology
+  tags: [network-fabric, landing-zone]
+
+- tech_service_id: TS-NET-VPN
+  name: Site-to-Site VPN
+  service_name: VPN
+  component_type: hybrid-link
+  description: Encrypted backup path over the internet, used only when Direct Connect is down.
+  status: Active
+  provider: AWS
+  service_category: Network
+  owner_org_id: ORG-TECH
+  cloud_provider: AWS
+  cloud_account: shared-network
+  region: eu-west-2
+  network_zone: Shared-Services
+  company_domain: Enterprise Platform
+  togaf_layer: Technology
+  architecture_domain: Technology
+  tags: [network-fabric, landing-zone]
+
+- tech_service_id: TS-NET-ROUTE53
+  name: Route 53 Resolver
+  service_name: Route 53
+  component_type: dns
+  description: Private hosted zones and inbound/outbound resolution to on-premise DNS.
+  status: Active
+  provider: AWS
+  service_category: Network
+  owner_org_id: ORG-TECH
+  cloud_provider: AWS
+  cloud_account: shared-network
+  region: eu-west-2
+  network_zone: Shared-Services
+  company_domain: Enterprise Platform
+  togaf_layer: Technology
+  architecture_domain: Technology
+  tags: [network-fabric, landing-zone]
+
+# --- the data center, so the hybrid edge has two ends ------------------------
+- tech_service_id: TS-ONPREM-DC
+  name: Primary Data Center
+  service_name: Data Center
+  component_type: vpc
+  description: >
+    The data center the mainframe and the authorization switch live in. Modeled
+    because half the integration cost of any cloud onboarding is the path back
+    to here.
+  status: Active
+  provider: In-house
+  service_category: Network
+  owner_org_id: ORG-TECH
+  cloud_provider: On-prem
+  network_zone: On-prem
+  cidr: 10.10.0.0/16
+  company_domain: Enterprise Platform
+  togaf_layer: Technology
+  architecture_domain: Technology
+  tags: [network-fabric, landing-zone]
+
+# --- lending workload account ----------------------------------------------
+- tech_service_id: TS-NET-VPC-LENDING
+  name: Lending VPC
+  service_name: VPC
+  component_type: vpc
+  description: Workload VPC for the lending product, three tiers across two zones.
+  status: Active
+  provider: AWS
+  service_category: Network
+  owner_org_id: ORG-TECH
+  cloud_provider: AWS
+  cloud_account: prod-lending
+  region: eu-west-2
+  network_zone: Private-App
+  cidr: 10.40.0.0/16
+  company_domain: Lending
+  togaf_layer: Technology
+  architecture_domain: Technology
+  tags: [network-fabric]
+
+- tech_service_id: TS-NET-SUB-LEND-PUB-A
+  name: Lending Public Subnet A
+  service_name: Subnet
+  component_type: subnet
+  status: Active
+  provider: AWS
+  service_category: Network
+  owner_org_id: ORG-TECH
+  cloud_provider: AWS
+  cloud_account: prod-lending
+  region: eu-west-2
+  availability_zone: eu-west-2a
+  network_zone: Public
+  cidr: 10.40.0.0/20
+  company_domain: Lending
+  togaf_layer: Technology
+  architecture_domain: Technology
+  tags: [network-fabric]
+
+- tech_service_id: TS-NET-SUB-LEND-PUB-B
+  name: Lending Public Subnet B
+  service_name: Subnet
+  component_type: subnet
+  status: Active
+  provider: AWS
+  service_category: Network
+  owner_org_id: ORG-TECH
+  cloud_provider: AWS
+  cloud_account: prod-lending
+  region: eu-west-2
+  availability_zone: eu-west-2b
+  network_zone: Public
+  cidr: 10.40.16.0/20
+  company_domain: Lending
+  togaf_layer: Technology
+  architecture_domain: Technology
+  tags: [network-fabric]
+
+- tech_service_id: TS-NET-SUB-LEND-APP-A
+  name: Lending App Subnet A
+  service_name: Subnet
+  component_type: subnet
+  status: Active
+  provider: AWS
+  service_category: Network
+  owner_org_id: ORG-TECH
+  cloud_provider: AWS
+  cloud_account: prod-lending
+  region: eu-west-2
+  availability_zone: eu-west-2a
+  network_zone: Private-App
+  cidr: 10.40.32.0/20
+  company_domain: Lending
+  togaf_layer: Technology
+  architecture_domain: Technology
+  tags: [network-fabric]
+
+- tech_service_id: TS-NET-SUB-LEND-APP-B
+  name: Lending App Subnet B
+  service_name: Subnet
+  component_type: subnet
+  status: Active
+  provider: AWS
+  service_category: Network
+  owner_org_id: ORG-TECH
+  cloud_provider: AWS
+  cloud_account: prod-lending
+  region: eu-west-2
+  availability_zone: eu-west-2b
+  network_zone: Private-App
+  cidr: 10.40.48.0/20
+  company_domain: Lending
+  togaf_layer: Technology
+  architecture_domain: Technology
+  tags: [network-fabric]
+
+- tech_service_id: TS-NET-SUB-LEND-DATA-A
+  name: Lending Data Subnet A
+  service_name: Subnet
+  component_type: subnet
+  status: Active
+  provider: AWS
+  service_category: Network
+  owner_org_id: ORG-TECH
+  cloud_provider: AWS
+  cloud_account: prod-lending
+  region: eu-west-2
+  availability_zone: eu-west-2a
+  network_zone: Private-Data
+  cidr: 10.40.64.0/20
+  company_domain: Lending
+  togaf_layer: Technology
+  architecture_domain: Technology
+  tags: [network-fabric]
+
+- tech_service_id: TS-NET-SUB-LEND-DATA-B
+  name: Lending Data Subnet B
+  service_name: Subnet
+  component_type: subnet
+  status: Active
+  provider: AWS
+  service_category: Network
+  owner_org_id: ORG-TECH
+  cloud_provider: AWS
+  cloud_account: prod-lending
+  region: eu-west-2
+  availability_zone: eu-west-2b
+  network_zone: Private-Data
+  cidr: 10.40.80.0/20
+  company_domain: Lending
+  togaf_layer: Technology
+  architecture_domain: Technology
+  tags: [network-fabric]
+
+- tech_service_id: TS-NET-IGW-LENDING
+  name: Lending Internet Gateway
+  service_name: Internet Gateway
+  component_type: load-balancer
+  description: The only route to the internet, and only from the public subnets.
+  status: Active
+  provider: AWS
+  service_category: Network
+  owner_org_id: ORG-TECH
+  cloud_provider: AWS
+  cloud_account: prod-lending
+  region: eu-west-2
+  network_zone: Edge
+  company_domain: Lending
+  togaf_layer: Technology
+  architecture_domain: Technology
+  tags: [network-fabric]
+
+- tech_service_id: TS-NET-NAT-LEND-A
+  name: Lending NAT Gateway A
+  service_name: NAT Gateway
+  component_type: private-egress
+  description: Outbound-only egress for the private tiers. One per zone, so a zone loss is not an outage.
+  status: Active
+  provider: AWS
+  service_category: Network
+  owner_org_id: ORG-TECH
+  cloud_provider: AWS
+  cloud_account: prod-lending
+  region: eu-west-2
+  availability_zone: eu-west-2a
+  network_zone: Public
+  company_domain: Lending
+  togaf_layer: Technology
+  architecture_domain: Technology
+  tags: [network-fabric]
+
+- tech_service_id: TS-NET-NAT-LEND-B
+  name: Lending NAT Gateway B
+  service_name: NAT Gateway
+  component_type: private-egress
+  status: Active
+  provider: AWS
+  service_category: Network
+  owner_org_id: ORG-TECH
+  cloud_provider: AWS
+  cloud_account: prod-lending
+  region: eu-west-2
+  availability_zone: eu-west-2b
+  network_zone: Public
+  company_domain: Lending
+  togaf_layer: Technology
+  architecture_domain: Technology
+  tags: [network-fabric]
+
+# --- risk operations account ------------------------------------------------
+- tech_service_id: TS-NET-VPC-RISKOPS
+  name: Risk Operations VPC
+  service_name: VPC
+  component_type: vpc
+  description: Workload VPC for screening and risk tooling.
+  status: Active
+  provider: AWS
+  service_category: Network
+  owner_org_id: ORG-TECH
+  cloud_provider: AWS
+  cloud_account: prod-riskops
+  region: eu-west-2
+  network_zone: Private-App
+  cidr: 10.41.0.0/16
+  company_domain: Risk and Compliance
+  togaf_layer: Technology
+  architecture_domain: Technology
+  tags: [network-fabric]
+
+# --- disaster recovery region ----------------------------------------------
+- tech_service_id: TS-NET-VPC-LENDING-DR
+  name: Lending VPC (DR)
+  service_name: VPC
+  component_type: vpc
+  description: >
+    Warm standby VPC in the recovery region. Built by the same Terraform as the
+    primary; capacity is scaled to zero until a declaration.
+  status: Planned
+  provider: AWS
+  service_category: Network
+  owner_org_id: ORG-TECH
+  cloud_provider: AWS
+  cloud_account: prod-lending
+  region: eu-west-1
+  network_zone: Private-App
+  cidr: 10.42.0.0/16
+  company_domain: Lending
+  togaf_layer: Technology
+  architecture_domain: Technology
+  tags: [network-fabric]