Context
Many small services multiply deployments, contracts and cross-service calls. With one Encore app (0029) and one owner, the cost of a split is paid daily, while the cost of a later split is paid once.Decision
- Start with few, coarse services; features live as modules inside a service.
- Split a service only on evidence: a different scaling profile, a different failure domain, a different team, or a security boundary.
- Three are isolated from the start: identity, payments/ledger, and services holding sensitive data (PII).
- Each split is recorded in the PR that makes it, with the evidence.
Consequences
- Fewer contracts to maintain early; a module boundary inside a service must be kept clean to make a later split cheap.
- Security-sensitive code has a separate blast radius and review path.
Enforcement
Planned — a guardian review item on any new service folder;pnpm validate lists services so additions are visible in the diff.