Skip to content

ADR-0006 — Sense and Gen as sibling systems on shared infra

  • Status: Accepted
  • Date: 2026-04-28

Context

The platform has two product surfaces:

  • Sense — data collection (mobile + planner web + Sense API + Sense Worker).
  • Gen — analytics (gen web + Gen API).

They share the IdP, the OpenFGA model, the Postgres cluster, the ClickHouse cluster, S3, and observability. Sense produces the data; Gen reads it.

Three structural options were considered:

  1. One monolith. Add Gen's controllers to Sense API. Save a deployment.
  2. Two separate platforms. Each gets its own copy of infra. Maximum isolation, maximum cost.
  3. Sibling systems on shared infra. Two backends, two web apps, shared physical infra (Postgres, ClickHouse, S3, OpenFGA, SigNoz). Different databases on the shared Postgres cluster.

Decision

Run Sense and Gen as sibling systems on shared infrastructure:

  • Separate repos: axion.sense.backend, axion.sense.web, axion.gen.backend, axion.gen.web.
  • Separate deployments and release cadences.
  • Shared Postgres cluster but separate databases (axion_sense, axion_sense_tasks, axion_sense_permissions, axion_gen).
  • Shared ClickHouse cluster — Sense writes, Gen reads via federated query.
  • Shared S3, OpenFGA, SigNoz.

Consequences

  • Positive: Each product team ships independently. No coupling release trains.
  • Positive: A misbehaving Gen federated query (timeout, runaway memory) can't take down Sense.
  • Positive: The platform IS the shared infra plane — that abstraction is real, not just a slogan.
  • Positive: Clear ownership: axion.sense.* is the Sense team; axion.gen.* is the Gen team. Cross-team work goes through interface contracts (proto for Sense; OpenAPI for Gen) and through changes to the shared FGA model (which both teams review).
  • Negative: Two deploy pipelines, two CI configurations, two backups (per database) to think about — though they share the cluster.
  • Negative: Cross-cutting concerns (e.g., a new common auth pattern) need to land in two places. We mitigate via shared NuGet packages where it makes sense.
  • Negative: Federated queries from Gen → ClickHouse must respect the same authz that Sense applies. We accomplish this by Gen's Postgres role having SELECT access only to axion_sense data tables that the OpenFGA model declares "viewable by analyst" — coarser than per-row but acceptable for analytical workloads.

Notes

The C4 diagrams (under d2/) draw the platform as a single bubble at L1 — "Axion Platform" — with Sense and Gen surfaced only at L2 (containers.d2) via the Sense Backend / Gen Backend groups. The "siblings on shared infra" framing lives in this ADR and in the documentation; the L1 view intentionally collapses them because that matches how the platform looks externally — partners care about "Axion," not about the Sense/Gen split.