[Architecture Review] Consolidate EventMesh boundaries and production-grade consistency

[qqeasonchen]

Architecture Review: Consolidate EventMesh boundaries and production-grade consistency

Summary

EventMesh's core direction is sound, but the biggest risk today is that, outside the "unified Runtime", multiple parallel stacks still coexist for protocols, state, clustering, and task handling. The priority is to converge boundaries and reliability semantics before adding more features.

This issue is the parent of a series of focused work items. See the Execution plan below for the machine-readable ordering and dependency graph.

Work items (by severity)

P0 (must address first)

• [Architecture Review][P0] Decouple eventmesh-runtime responsibilities via internal packages #5297 — Decouple eventmesh-runtime responsibilities via internal packages
• [Architecture Review][P0] Partition eventmesh-common into internal packages #5298 — Partition the eventmesh-common module into internal packages (model / wire / config / util)
• [Architecture Review][P0] Single protocol path (HTTP + CloudEvents) and ingress/egress adapters #5299 — Single protocol path (HTTP + CloudEvents) and ingress/egress adapters
• [Architecture Review][P0] Unified state control-plane stores #5301 — Unified state control-plane stores
• [Bug] Unify cluster delivery topology and fence stale partition owners #5293 — (pre-existing) cluster delivery topology + fence stale partition owners

P1 (plan soon)

• [Architecture Review][P1] A2A must not form a parallel Runtime #5302 — A2A must not form a parallel Runtime
• [Architecture Review][P1] Standardize Storage SPI capabilities + TCK #5303 — Standardize the Storage SPI capability model + TCK
• [Architecture Review][P1] Unified multi-tenant / security / quota entrypoint #5304 — Unified multi-tenant / security / quota entrypoint

P2 (engineering governance)

• [Architecture Review][P2] Gradle dependency guardrails (architectureCheck) #5305 — Gradle build + module dependency guardrails
• [Architecture Review][P2] Sync documentation with implementation status #5306 — Sync documentation narrative with implementation status

Note: #5300 (DeliveryTopology) was folded into #5293 and closed as a duplicate.

Execution plan (machine-readable)

Vocabulary for agents

• Severity = problem importance (P0 / P1 / P2).
• Phase = execution order (0 .. 4); orthogonal to severity — Phase 0 runs first even if its severity is lower.
• Depends on = must land before this issue; Blocks = cannot start until this issue lands.
• Issues are referenced by number (#NNNN) so they can be resolved programmatically.

Phase 0 — Guardrails & direction (no dependencies; start immediately)

• [Architecture Review][P2] Gradle dependency guardrails (architectureCheck) #5305 — dependency guardrails (severity P2, scheduled first: cheap, prevents further coupling)
• [Bug] Unify cluster delivery topology and fence stale partition owners #5293 — decide the cluster DeliveryTopology (severity P1)

Phase 1 — Single-instance at-least-once correctness (stop the bleeding; independent, parallelizable)

• [Bug] Make RocksDB and Meta offset writes atomically monotonic #5289 — atomic monotonic offset writes
• [Bug] Do not retire deliveries when durable offset persistence fails #5290 — do not retire deliveries on offset-persist failure
• [Bug] Prevent stale ACKs from matching reused delivery IDs #5291 — unique delivery IDs (epoch + random)
• [Bug] Make DLQ transition durable before retiring source delivery #5292 — durable DLQ transition

Phase 2 — Unified state control plane (fixes multi-instance correctness)

• [Architecture Review][P0] Unified state control-plane stores #5301 — unified stores (OffsetStore / SubscriptionStore / DeliveryStateStore / SessionStore / DeadLetterStore / TaskStore)
  • includes: [Bug] Preserve unacknowledged broadcast deliveries during cursor recovery #5294 (per-subscriber cursor) and [Bug] Gate RocketMQ 5 POP broker ACK on distribution completion #5295 (POP ACK barrier)

Phase 3 — Cluster model landing

• [Bug] Start and manage membership heartbeats in sticky cluster mode #5288 — membership heartbeat lifecycle (depends on [Bug] Unify cluster delivery topology and fence stale partition owners #5293)

Phase 4 — Boundary decoupling & protocol convergence

• [Architecture Review][P0] Partition eventmesh-common into internal packages #5298 — partition eventmesh-common into internal packages
• [Architecture Review][P0] Decouple eventmesh-runtime responsibilities via internal packages #5297 — decouple eventmesh-runtime via internal packages
• [Architecture Review][P0] Single protocol path (HTTP + CloudEvents) and ingress/egress adapters #5299 — single protocol path + SDK package organization
• [Architecture Review][P1] A2A must not form a parallel Runtime #5302 — A2A onto the Runtime
• [Architecture Review][P1] Standardize Storage SPI capabilities + TCK #5303 — Storage SPI TCK
• [Architecture Review][P1] Unified multi-tenant / security / quota entrypoint #5304 — multi-tenant / security / quota
• [Architecture Review][P2] Sync documentation with implementation status #5306 — documentation sync (throughout; final pass)

Dependency graph

Issue	Depends on	Blocks
#5288	#5293	—
#5294	#5301	—
#5295	#5301	—
#5301	#5289, #5290, #5291, #5292	#5294, #5295, #5302
#5297	#5305	#5302
#5298	#5305	#5299
#5299	#5298	#5303, #5304
#5302	#5301, #5297	—
#5303	#5299	—
#5304	#5299	—
#5306	(throughout)	—

One-line summary

EventMesh's direction is correct, but the largest current risk is retaining multiple protocol / state / cluster / task stacks outside the unified Runtime. Converge boundaries and reliability semantics first, then keep extending features.