ADR 036 — Control / data / money plane boundaries
- Status: Accepted (2026-08-10) — ratified in chat / field ADR package (first-class module + Nautilus)
- Related: ADR 005, ADR 004, ADR 037, principal plan
Context
AlphaSwarm already separates concerns across packages. Source docs risk reintroducing a unified “Simulation platform” that owns infra, data, and orders. Track A+E/D verified:
- Mutation:
WorkloadRuntime,TerraformRuntime,/manage/*. - Execution dispatch:
alphaswarm_workerwithPlaneLLM vs MONEY. - Data writes:
iceberg_catalog.append_arrow; agents via DataMCP. - Cells: Kustomize + ArgoCD — no Terraform cell module.
- Postgres is canonical for ledgers; controller sinks audit via HTTP/JSONL.
Decision
| Plane | Sole authorities | Forbidden |
|---|---|---|
| Control | alphaswarm_controller /manage/*; WorkloadRuntime; TerraformRuntime; DeploymentSpec | Second deploy/scheduler CP; raw terraform/kubectl outside providers |
| Data | Iceberg wrapper; DataMCP; LineageBus; ingest/streaming owners | Agent ORM/Iceberg direct; silent critical event drops |
| Money | NativeExecutor; BotRuntime adapters; RiskLimits; kill switch; GateChain/metadata_gate | LLM consultation inside risk gate; Ray/Dask/Spark for MONEY |
| LLM / Agent | AgentRuntime / WorkflowRuntime / KB tools | Venue credentials; raising hard risk limits; order send without OrderIntent |
Do not create a second scheduler, execution, MLOps, or deployment control plane. Compose the existing ones via the alphaswarm facade (ADR-033).
Consequences
- New features must declare their plane and owner package.
- Default-OFF flags that protect plane isolation (
enable_money_plane, RLS, MCP audience, halt propagation) require explicit enablement plans before live expansion. - Cell topology changes go through Kustomize/GitOps, not a new Terraform cell module.