Liwiro Control Plane Reliability for Multi-Service Runtime Operations

Abstract

This paper examines Liwiro as a reliability-critical control plane sitting above Verun runtime components. The objective is not only to generate services but to preserve deterministic operator behavior through setup, contract validation, generation, deployment, and ongoing administration. The research argument is that reliability depends on explicit ownership boundaries across Liwiro frontend, Liwiro backend, generated services, and Verun runtime infrastructure.

The repository documentation describes Liwiro as the management layer responsible for platform bootstrap, LAPIS validation, service generation, service lifecycle operations, and mediated access to VDB and VI routes. That means reliability must be evaluated as an end-to-end property across user action, backend orchestration, runtime transport, and state persistence rather than as isolated UI availability.

Reliability Problem Definition

Without strict control-plane discipline, service platforms drift in ways that are hard to detect:

• contract definitions diverge from deployed runtime behavior
• role and permission changes bypass governance expectations
• generated service metadata stops matching process reality
• operator consoles display stale or partially invalid state
• recovery actions become destructive because there is no single source of truth

Liwiro's architecture addresses this by centralizing mutations through backend-managed APIs and storing operational state in explicit stores. The frontend is intentionally prevented from direct runtime mutation against VDB and VI. This mediation model is a reliability control, not just an implementation choice.

Layered Control Model

The reference system description presents four runtime layers: VI, VDB, Liwiro backend, and Liwiro frontend. Reliability is strongest when each layer keeps a narrow and auditable contract.

sequenceDiagram
  participant Operator as Operator
  participant FE as Liwiro Frontend
  participant BE as Liwiro Backend
  participant GEN as Generator
  participant VDB as Verun VDB
  participant RUN as Generated Service

  Operator->>FE: Submit or update LAPIS
  FE->>BE: Authenticated request
  BE->>BE: Validate schema + policy
  BE->>GEN: Build service artifact
  GEN-->>BE: Route/runtime payload
  BE->>VDB: Persist service metadata and state
  BE->>RUN: Start/refresh process
  BE-->>FE: Deterministic operation result
  FE-->>Operator: Status + governed controls

Governance and Authority Boundaries

Administrative reliability requires separation between routine operation and policy mutation. In practical terms:

1. settings and permission-governance changes are constrained to super-admin authority
2. role mutation requires explicit capability grants instead of implicit trust
3. user lifecycle operations must preserve invariant constraints such as super-admin non-deletion
4. backend authorization checks fail closed when context is incomplete

These constraints reduce accidental privilege escalation and prevent drift in policy-critical paths.

Recovery Strategy

A resilient control plane must support staged recovery:

1. Content/data restore: recover markdown/dynamic stores and metadata indexes.
2. Runtime restore: reconcile generated service registry state with active processes.
3. Platform restore: recover configuration and management access without bypassing governance checks.

Each stage should be executable independently so failure in one subsystem does not force full-stack rebootstrap.

Observability and Drift Detection

Reliable systems expose operation outcomes as traceable envelopes. Recommended indicators include:

• LAPIS validation failures by category
• service generation and restart success/failure rates
• permission and role mutation audit events
• content publication/revalidation latency
• mismatch counts between declared and running services

Reference Basis

This paper is grounded in:

• liwiro-context/integration/system-description.md
• liwiro-context/integration/liwiro-platform.md
• liwiro-context/integration/component-map.md

Conclusion

Liwiro's reliability posture is strongest when governance, generation, runtime control, and content operations remain explicit and centrally mediated. The core principle is stable: constrain mutation paths, preserve role boundaries, and make every control-plane transition inspectable.