Runtime and host boundaries
Understand why Quirello owns operations while the website keeps content and presentation.
Quirello owns website operations, not published pages. Markdown and git remain canonical for published content. The package owns the Operator Contract, forms, redirects, media, Cloudflare storage adapters, and the runtime handler.
| Concern | Authority | Reason |
|---|---|---|
| Published pages | Website repository content | Quirello v0 does not introspect or write markdown. |
| Operator validation and behavior | Quirello Operator Contract | MCP and clients share one transport-independent contract. |
| Redirect records | D1 through Quirello | Optional KV lookup state is derived. |
| Media metadata | Quirello through MCP | A Signed Upload URL transfers bytes only. |
| Form definition and submission storage | Quirello | Public intake stays narrow while inspection stays authenticated. |
| Route mounting and site presentation | Website Host Adapter | The host chooses its prefix, bindings, redirect lookup scope, and React presentation. |
request flow
The host checks a request against its redirect lookup scope, then mounts the package handler under the Quirello Runtime Prefix. The package handles MCP, public form reads and intake, public media reads, and Signed Upload URL byte transfer. A response outside the package’s routes returns to normal website routing.
This split keeps site-specific rendering out of the package and operational behavior out of the website adapter. It also lets the Operator Contract survive a future transport change because an operation is defined independently from MCP.
ADR 0017 records the MCP-first mutation decision. The Quirello context glossary owns the domain terms. The runnable redirect source tutorial shows the boundary in code.