United. Connected. Diagrammed.
Below is the current target-state architecture, as of this morning's standup. It supersedes the architecture agreed at the offsite, which superseded the architecture on the whiteboard, which is still on the whiteboard because nobody is certain it isn't load-bearing.
Not shown: the sync path between the two event buses, which exists but cannot be drawn on a plane. Also not shown: the nightly job that reconciles the two monoliths. It is a shell script, it is thirty-one lines long, and it is the only component with one hundred percent uptime.
Four architectural principles, adopted in full and applied in part.
Loosely coupled
No service should depend on the internals of another. Achieved by ensuring no service can reach another's internals without going through the bus, the other bus, or the migration bridge.
Cloud native
Everything runs in containers, orchestrated automatically, with one exception that runs on a virtual machine in Sydney and is referred to internally as "the appliance".
Single source of truth
Patient data has exactly one authoritative home. Identifying which of the two homes is authoritative is scheduled for the quarter after next.
Build for scale
The platform is designed to serve twelve thousand clinics concurrently. It currently serves one, in beta, and the load test has been deferred so as not to disturb it.
Every direction we have committed to, in order.
Architectural decision records are kept for accountability, traceability, and to establish that the current situation was arrived at deliberately.
- ADR-001Build a single unified platformOne product, one codebase, one login, one data model. Adopted unanimously.Accepted
- ADR-004Split the platform into servicesThe single codebase was found to be slowing the team down. Split into nine services, each independently deployable.Accepted
- ADR-011Split the services into microservicesNine services were found to be slowing the team down. Split into forty-one.Accepted
- ADR-019Consolidate the microservicesForty-one services were found to be slowing the team down. Consolidation target: nine.Superseded by ADR-023
- ADR-023Pause consolidation pending a strategyConsolidation paused while a consolidation strategy is developed. Service count during the pause: forty-seven.In force
- ADR-027Standardise on OAuthAll services to authenticate through identity-oauth. Two services could not be migrated in time.Partially applied
- ADR-028Retain SAML for the two servicesTemporary exemption granted for one quarter. Now in its nineteenth quarter.Temporary
- ADR-031Retain session cookies for the one serviceNobody could identify the service's owner to ask them to migrate it. Exemption granted by default.Owner unknown
- ADR-036Adopt event-bus-beta as the strategic busMigration from event-bus-alpha to begin immediately and complete within two quarters.In progress since 2022
- ADR-039Retain event-bus-alphaMigration to beta found to be riskier than expected. Alpha retained alongside beta. Both are now strategic.In force
- ADR-044Reduce complexityA working group was established to reduce architectural complexity. The working group has three subgroups.Ongoing
- ADR-047Merge the two monolithsThe monolith and the other monolith to be merged into a single monolith. Currently blocked on what to call it.Blocked: naming
Terms you will encounter in support tickets.
A virtual machine
Runs the PDF service. Nobody has logged into it since 2022 and everyone agrees this is going well.
migration-bridge
Built to move data off the monolith over six weeks. Now a permanent part of every request path.
An estimate
Introduced in 2026 to replace dates. Has not slipped once, and cannot.
See when all of this is expected to arrive.
Delivery dates are reviewed continuously, which is how there have been eight of them.
View the roadmap