Community

Built in the open, on GitHub.

Vennir is MIT-licensed and developed in public. Questions, bugs, ideas and fixes all go through the repository's issues and pull requests.

Open an issue

A bug, a question, or something you'd like Vennir to do. For anything bigger than a small fix, start here so the approach is agreed first.

Issues

Send a pull request

One focused change, with what changed and why, and a test that fails without it.

Pull requests

Report a vulnerability

Privately, never in a public issue: the repository's Security tab, then Report a vulnerability.

Report privately

Code of conduct

Everyone taking part follows the Contributor Covenant 2.1, in issues, pull requests and anywhere else.

Read it

GitHub issues and pull requests are the only channels today: there's no chat server, forum or mailing list, and GitHub Discussions isn't turned on.

Contributing

What a pull request needs.

  • Read AGENTS.md first. It's written for AI coding assistants, but it's the quickest orientation for people too: the layout, the contracts between components, and the engineering principles the code follows.
  • Keep it focused. One change per pull request. A bug fix gets a test that fails without it; a new authorization rule gets a test in console/test/.
  • Keep the docs in step. A new, moved or removed file updates the repository map; a schema change updates the database guide; diagrams are regenerated, never hand-edited.
  • CI must pass: tests against a real Postgres, linters, type checks, Helm rendering, and the security scans (Trivy, OSV, Semgrep, gitleaks).
  • Never commit a secret, not even a placeholder that looks real.
Read CONTRIBUTING.md Read AGENTS.md
from the repository root needs Docker 
# a throwaway test Postgres on 127.0.0.1:55432,
# both databases migrated, every suite run
make test

# just the databases, then run a suite yourself
make test-db
make test-db-down
your first pull request CLA, once 
# a bot asks you to accept CLA.md; reply on the pull request:
I have read the CLA and I accept it

# and each new source file starts with
# SPDX-License-Identifier: MIT
Reporting a vulnerability

Vennir holds other people's secrets. Tell us privately.

Please don't open a public issue. Open the repository's Security tab, choose Report a vulnerability, and include what you found, how to reproduce it, and what an attacker could do with it.

  1. 01 · AcknowledgedWithin 5 working days.
  2. 02 · AssessedA fix or mitigation plan as soon as the impact is understood.
  3. 03 · Fixed, then disclosedA fix is released before details are published, within 90 days unless agreed otherwise with you.
  4. 04 · CreditedIn the advisory, if you'd like it.

In scope

The kernel, the console, the API gateway, the vennir CLI, the Helm charts and the admission policies they install. Only the latest release gets security fixes while Vennir is 0.x.

Not in scope

Gaps the security model already lists as not yet enforced (a new way to exploit one is still welcome), the local kind admin password, products in a catalog repository, and third-party charts.

Read SECURITY.md
The repository

Independent projects, deployed together.

They share no code and no environment: build and test each one from inside its own directory. The repository map lists every folder and file, one line each.

  • kernel/Go. The scheduler and kernel-api: one binary, coordinating only through Postgres.
  • console/TypeScript. The authenticated front door: teams, people, bots, secrets, and the React app.
  • gateway/Go. Forwards to each API product's backend exactly what its OpenAPI document describes.
  • cli/Go. vennir, the installer, with OpenTofu for the cloud side.
  • helm/The kernel and console charts, their admission policies, and each environment's values.
  • proto/The console's and kernel's APIs, and the catalog release format.
  • catalog-template/What a new catalog repository starts as, with a no-cloud sample product in five languages.
  • docs/Architecture, setup, operations, the security model, and the diagrams.
  • examples/Demo products that deliberately share no code.
  • perf/Benchmarks on a kind cluster of their own.
  • site/vennir.io, this website: static pages on Firebase Hosting.
Read the repository map
What's next

Solid before features.

The agreed order of work: housekeeping and tests first, then features with steps left, then proving on a cloud what's only been proven on kind, and the MCP server and Azure last. One paid run, on GKE and EKS, is done; the list below is what the next one proves. No dates: it's done when it's proven.

Blocked, or undecided

The chat agent on Amazon Bedrock waits on the account's model access, and Sigstore's newer signature format waits on policy-controller. Whether to mask Secret values in logs still needs a decision.

The full list in TODO.md
  1. 01

    The gateway on the internet, on GKE and EKS

    built, to prove

    Its public listener behind a cloud load balancer and certificate. Documented, and proven so far only on kind.

  2. 02

    A team building in its own Environment

    built, to prove

    A catalog team's builds using values of their own, from a GitHub Environment only main may use: built in 0.10.0, to see in a real catalog repository.

  3. 03

    A catalog read across clouds

    built, to prove

    One install reading another's catalog from Amazon ECR, by AWS web identity.

  4. 04

    Cleanup that touches only its team's

    built, to prove

    The samples label what they make with the run's team, and delete only what carries it.

  5. 05

    The smaller proofs

    built, to prove

    The base images' weekly mirror, vennir apply waiting for a hostname's DNS record, a narrowed schema refused at checkout, and deploying GKE from a release.

  6. 06

    Pages that hide a failed load

    A few console pages show “nothing here” when a load fails; each should say so, with Try again.

  7. 07

    Last: an MCP server, then Azure

    The chat agent's tools for engineers' own agents, then Azure as a target, with its managed Prometheus and the Azure sample signing in.

License

MIT. Use it, change it, ship it.

Vennir is under the MIT License. Your contributions are covered by the Contributor License Agreement, which you accept once; you keep the copyright in them.

Read the license Star it on GitHub
LICENSE MIT 
MIT License

Copyright (c) 2026 rburns629

Permission is hereby granted, free of charge, to any
person obtaining a copy of this software …