See Alfred's scope, actors, external systems, and capability boundary.
Alfred is the control plane for Headout's domain and certificate operations. It accepts authenticated intent, records a durable execution, serializes shared infrastructure changes, and reports progress independently of the original HTTP request.
Alfred owns the control-plane contract around infrastructure work:
Alfred does not replace the provider control planes. ACM remains authoritative for certificate state, Route53 for DNS, CloudFront for distributions, ELB for listeners, Google API Keys for browser referrers, and ArgoCD for GitOps convergence. Alfred coordinates those systems and records the intent and result of each bounded mutation.
| Boundary | Alfred owns | External system owns |
|---|---|---|
| API | authentication, authorization, validation, idempotency, execution resources | client retry and terminal-state polling |
| Workflow | ordering, durable control flow, waits, hooks, child runs | Workflow SDK persistence mechanics |
| AWS | mutation plan, safety checks, receipts, compensation | resource state and provider-side propagation |
| GitOps | repository change and convergence intent | merge policy and ArgoCD reconciliation |
| Notifications | outbox event and Zendesk update attempt | subscriber availability and ticket lifecycle |
The public contract ends at executions and events. A provider operation may finish while the overall workflow is still waiting for another system, so clients should not infer completion from ACM, CloudFront, or GitHub alone.
Alfred's durable runtime implements five public workflows:
onboard-domain, add-certificate, add-domain, add-subdomain, and
update-lambda-version. Onboarding finalization recovery, certificate and
onboarding rollback, Maps-only onboarding recovery, and Lambda version
restoration also run as explicit durable workflows tied to a source execution.
These are the only workflow triggers in the client OpenAPI contract. Health, observability, audit, API-key, and administrative endpoints have a separate operator contract. Slack, GitHub, and Zendesk hooks remain adapter ingress and are not client SDK operations. Check Service Capabilities for the current boundary and Workflow Reference for lifecycle behavior.
onboard-domain, add-domain, and add-certificate mutate shared AWS
infrastructure. Their root commands and applicable continuation, rollback, and
finalization-recovery commands use the global aws-infrastructure lane. Lambda
version updates use a separate lane derived from target and environment;
conflicting versions in one active lane are rejected rather than queued.
Only one root execution owns that lane at a time. Valid work that cannot start immediately remains queued instead of being rejected. Recovery for the active owner takes precedence when it is required to return infrastructure to a stable state.
This lane controls Alfred's mutations, not every actor with AWS credentials. Provider readiness checks, drift checks, and mutation receipts still protect against state changing outside Alfred.