---
title: "Reference architecture overview"
description: "Use this map to find the architecture, delivery, operations, and governance rules for an MNPPI project."
url: "https://architecture.mnppi.org/start/overview/"
status: "Current"
last_updated: "2026-07-23"
---

# Reference architecture overview

**Standard details**

- Status: Current
- Reviewed: July 23, 2026
- Cadence: Review each quarter

This site is the public operating reference for new MNPPI projects.
It explains the choices that affect design, delivery, and support.

The source standards remain in the internal `org-standards` repository.
This site presents those standards in a task-focused form.

> **Note — Public scope**
>
> The site includes reusable decisions and controls.
> It does not include secret locations, host inventories, live incident records, or private exception details.

## Find the right section

- [Architecture](https://architecture.mnppi.org/architecture/cloudflare-flagship-stack/index.md): Select a project profile and apply the Cloudflare platform baseline.
- [Delivery](https://architecture.mnppi.org/delivery/ci-cd-and-merge-controls/index.md): Separate merge authority from production build and deployment.
- [Operations](https://architecture.mnppi.org/operations/runner-security/index.md): Use isolated runners, useful telemetry, and tested recovery.
- [Governance](https://architecture.mnppi.org/governance/lifecycle/index.md): Review the standard, record exceptions, and remove obsolete rules.

## The default delivery model

| Stage             | System                    | Required result                                    |
| ----------------- | ------------------------- | -------------------------------------------------- |
| Pull request      | GitHub Actions            | Repository checks pass on the designated runner.   |
| Merge             | GitHub rulesets           | Failed or missing required checks block the merge. |
| Production build  | Cloudflare Workers Builds | Cloudflare builds the merged default branch.       |
| Production deploy | Cloudflare                | Cloudflare deploys only after its build passes.    |

No default branch requires another person's approval.
The repository owner can merge after all required checks pass.

## How to use the reference

Start with the [adoption checklist](https://architecture.mnppi.org/start/adoption-checklist/index.md).
Select an [application profile](https://architecture.mnppi.org/architecture/application-profiles/index.md).
Then review the applicable delivery and operations controls.

Record any necessary deviation through the [exception process](https://architecture.mnppi.org/governance/exceptions/index.md).