Rhone Object Model
The platform nouns matter because each one has a different owner, writer, durability, and failure behavior.
Workspace
Billing, membership, policy, and top-level access boundary.
Owner
Rhone Cloud
Written by
API operation with RBAC and audit
Durability
regional control database
Depends on
Common trap
Letting app runtime identity mutate platform tenancy.
Project
A product/codebase grouping that owns apps, environments, imports, and settings.
Owner
Rhone Cloud
Written by
Project-scoped operation
Durability
regional control database
Depends on
Common trap
Treating project config as generated build output.
App
The hosted application identity independent of any single deploy.
Owner
Rhone Cloud
Written by
Create/import operation
Durability
regional control database
Depends on
Common trap
Confusing app identity with one running process.
Environment
A traffic and policy lane such as preview, staging, or production.
Owner
Rhone Cloud
Written by
Environment operation
Durability
regional control database
Depends on
Common trap
Giving preview and production the same mutable database by accident.
Deployment
A candidate release record with build, validation, preview, and promotion evidence.
Owner
Rhone Cloud
Written by
Pipeline operation
Durability
regional control database
Depends on
Common trap
Calling a build successful before validation/policy evidence exists.
Artifact
Immutable build output with digest, Vango manifest, routes, process, assets, and source facts.
Owner
Build pipeline
Written by
Build worker
Durability
artifact store plus metadata DB
Depends on
Common trap
Rebuilding source during promotion instead of promoting the exact validated artifact.
Allocation
One concrete running instance of an artifact in a region/cell.
Owner
Regional scheduler
Written by
Scheduler/runner state machine
Durability
regional runtime database
Depends on
Common trap
Treating allocation health as route ownership truth.
RouteOwner
The authoritative binding from route key to deployment/artifact/region/cell plus epoch.
Owner
Control plane
Written by
Promotion/rollback operation with compare-and-swap
Durability
regional/global route database
Depends on
Common trap
Routing to latest healthy backend instead of monotonic route authority.
Operation
Durable state machine for meaningful mutations such as deploy, promote, wake, scale, domain, and migration.
Owner
Rhone Cloud
Written by
API/worker stages
Durability
regional control database
Depends on
Common trap
Reconstructing user-facing status from logs.
ProviderBinding
A platform-owned attachment between app/environment and external provider resources.
Owner
Rhone Cloud
Written by
Provider operation
Durability
control DB plus secret store
Depends on
Common trap
Assuming app-declared config proves hosted readiness.
RuntimeServiceBinding
Declared availability of session store, broadcast, idempotency, cache, queue, or object storage services.
Owner
Rhone Cloud
Written by
Provision/bind operation
Durability
regional service registry
Depends on
Common trap
Allowing horizontal scale while required runtime services are missing.
Region
Geographic/control boundary for placement, data residency, and failover policy.
Owner
Rhone Cloud
Written by
Platform provisioning
Durability
platform topology database
Depends on
Common trap
Thinking multi-region is only a DNS or load-balancer feature.
Cell
Regional isolation unit containing runners and service bindings.
Owner
Rhone Cloud
Written by
Platform provisioning
Durability
platform topology database
Depends on
Common trap
Hardcoding the first cell into public product identity.