01Current source snapshot
The shape of Metis today.
A dated view of the public platform and its official modules—not fixed product limits.
Measured from the Metis core and official module source · September 26, 2026
02Architecture
Thin entrances. Shared services. Clear ownership.
Metis keeps entrypoints small and moves application work into a centralized runtime. Modules extend the platform without building parallel security, data, or interface frameworks.
Entrypoint→Router→Security→Service→Repository
Central runtime
Routing, security, services, workers, and modules meet through a defined application layer.
Module isolation
Routes and behavior have explicit owners, while shared platform contracts remain consistent.
One frontend language
Core services provide the canonical API, modal, toast, form, and interaction patterns.
03Security boundaries
Security is a path, not a patch.
Sensitive work passes through named boundaries that default to denial when identity, permission, registration, or policy cannot be proven.
Authentication establishes who is making the request.
Interface visibility never substitutes for a permission check.
Raw request input is normalized before application code uses it.
File operations validate roots; process execution requires security and audit context.
Public endpoints attach explicit policy and fail securely when controls are unavailable.
04Validation gates
Five checks before protected work begins.
Authenticate
Confirm the request belongs to a recognized identity.
Authorize
Resolve the permission required for the action.
Register
Reject actions that were not explicitly declared.
Verify request
Validate the request token and expected transport.
Validate input
Normalize and enforce the action's input contract.
Modules face gates too. Manifests, structure, route ownership, dependencies, and compliance rules are checked before release or installation work proceeds.
05Data & storage
Predictable data is recoverable data.
Database accessCentral service ownership, prepared execution, charset handling, prefixes, and reconnect behavior.
MigrationsVersioned, documented, and reversible changes with consistent naming and timestamps.
Media classesExplicit public, protected, and private storage boundaries with path, traversal, symlink, and type checks.
SecretsApplication keys fail closed, and logging rules prohibit recording credentials and sensitive tokens.
ScalePagination, indexes, caching, and background work are first-class application requirements.
06Integrity & releases
An update must prove what it is.
Release installation is a controlled transaction with verification before and after files change.
- Preflight
Run integrity and compliance checks.
- Preserve
Create a rollback archive before replacement.
- Verify
Check SHA-256 digests and release signatures.
- Apply
Install only after the package passes its gates.
- Rebaseline
Run postflight checks and sign the new integrity baseline.
07Backup & recovery
Recovery is designed before it is needed.
Backups record component metadata and checksums, then restore in an order that respects application dependencies.
Configuration
Restore the settings that define the installation.
Media
Recover managed public and protected assets.
Runtime
Rebuild the application files captured by the backup.
Database
Restore the structured records after the platform is ready.
Two recovery scales. Metis supports complete backup-run restoration and eligible file-level recovery when a narrower repair is safer.
08Audit & operations
Important behavior leaves evidence.
Security trail
Authentication attempts, permission denials, governed process execution, and public-route failures can be recorded for review.
Operational trail
Cron runs, webhook handling, critical exceptions, release activity, and integrity events have defined logging paths.
Automated governance
Scans look for raw requests, unmanaged database access, unsafe serialization, process execution, route metadata, and file-policy violations.
Truthful failure
Security-sensitive services are designed to deny or report unavailable state rather than quietly bypass a missing control.
09Deployment baseline
Familiar infrastructure. Explicit expectations.
verification suites
security_scan.php
security_governance_test.php
operational_governance_test.php
system_audit_test.php
run-core-release-contracts.php
run-module-release-contracts.php
Names shown are representative project verification entrypoints; release and deployment checks remain tied to the current source.
Ready to look closer?
See the system from both sides.
Explore the human-facing modules, then use the installation guide to prepare a server.