The Open-Source Data Operating System

An open, cloud-native operational data platform for building data products with datasets, ontologies, applications, AI/ML, governance, and observability from one monorepo.

Documentation · Architecture · Contributing · Security · Issues

OpenFoundry is an open-source operational data platform inspired by the capability model of Palantir Foundry, implemented as auditable, extensible software. It combines 42 Go microservices, 33 shared libraries, Protobuf/OpenAPI contracts, generated SDKs, a React 19 + Vite + TypeScript web console, and declarative infrastructure for Kubernetes.

The goal is to provide a reproducible foundation for teams that need to connect sources, version datasets, model an ontology, expose APIs, automate workflows, govern access, and operate analytical or AI workloads with end-to-end traceability.

Working with this codebase as an AI agent? Start at CLAUDE.md. It is the canonical onboarding guide for commands, conventions, security-critical zones, and what not to read by default.

• Cloud-native architecture: small Go services, one entrypoint per service, and delivery through Helm, ArgoCD, and Terraform.
• Ontology at the core: object types, actions, functions, object views, lineage, and stable contracts for building applications on operational data.
• Contracts first: Protobuf as the source of truth, generated OpenAPI, and synchronized TypeScript, Python, and Java SDKs.
• Integrated governance: authentication, authorization, Cedar policies, audit, tenancy, SSO/MFA, and egress controls.
• Observability by default: /healthz, /metrics, Prometheus, Grafana, Mimir, structured logs, and OTel traces.
• Developer platform: CLI tooling, SDK generation, service templates, VitePress docs, and unit/integration test paths.

git clone https://github.com/openfoundry/openfoundry-go.git
cd openfoundry-go

make tools

This installs the Go tools used by the monorepo into ./bin, including buf, golangci-lint, sqlc, and gofumpt.

make ci

make ci runs tidy, vet, lint, contract checks, and unit tests. For faster iteration, use:

make test
make build
make contracts-check

pnpm install
pnpm --filter @open-foundry/web dev

The web application lives in apps/web/ and uses React 19, Vite, and TypeScript.

docker compose -f infra/compose/docker-compose.yml up -d

For development, there is also:

docker compose -f infra/compose/docker-compose.dev.yml up -d

make gitops-bootstrap
make gitops-status

Delivery assets live in infra/: Helm charts, ArgoCD apps, Terraform, Compose, and operational runbooks.

openfoundry-go/
├── apps/web/         React 19 + Vite + TypeScript frontend
├── services/         Go microservices; copy services/template/ for new services
├── libs/             Shared Go packages for auth, observability, kernels and more
├── proto/            Protobuf source of truth; Go generated into libs/proto-gen/
├── sdks/             Generated TypeScript, Python and Java SDKs
├── infra/            Helm, ArgoCD, Terraform, Compose and operational runbooks
├── docs/             VitePress capability-oriented documentation site
├── tools/            CLIs and lint/helper tools
├── images/           Project branding assets, including this README logo
├── go.mod            Single Go module for the entire monorepo
└── Makefile          Canonical local task runner

Per-service shape:

services/<svc>/
  cmd/<svc>/main.go          entrypoint
  internal/server/           chi router (/healthz, /metrics, /api)
  internal/handlers/         HTTP handlers
  internal/domain/           pure logic
  internal/repo/             data access, sqlc-generated when relevant
  internal/repo/migrations/  goose-style SQL migrations
  internal/models/           wire types
  internal/config/           koanf-backed config

OpenFoundry uses a single Go module (go.mod at the root) instead of a multi-module go.work setup because it:

• Keeps libs/ and services/ synchronized without version drift.
• Simplifies dependency resolution, caching, and builds.
• Makes contract generation and compatibility tests more direct.
• Follows a familiar pattern for large infrastructure monorepos.

Splitting specific services into their own modules remains possible if the project needs it.

Run these commands from the repository root:

make help              # list available targets
make tools             # install tools into ./bin
make ci                # tidy + vet + lint + contracts-check + test
make test              # unit tests with race detector and coverage
make test-integration  # tests with the integration build tag; requires Docker
make gen               # regenerate proto Go, sqlc, OpenAPI, and SDKs
make contracts-check   # verify OpenAPI and SDK drift
make build             # compile all packages
make build-services    # compile one binary per service into ./bin/
make lint              # golangci-lint
make fmt               # gofumpt + gci

Frontend:

pnpm --filter @open-foundry/web dev
pnpm --filter @open-foundry/web check
pnpm --filter @open-foundry/web test

• docs/ — capability-oriented technical documentation.
• docs/index.md — VitePress site entrypoint.
• ARCHITECTURE.md — high-level architecture overview.
• docs/architecture/adr/ — dated architectural decisions.
• CLAUDE.md — concise onboarding for AI agents.
• CONTRIBUTING.md — PR process, RFC requirements, and DCO policy.
• SECURITY.md — how to report vulnerabilities.

Some contracts are pinned by golden tests and must not change without an explicit migration:

• /healthz payload shape (status, service, version, timestamp).
• JWT claim names and JSON tags.
• Dataset RID format: ri.foundry.main.dataset.<uuid-v7>.
• Transaction state/type tokens: open|committed|aborted and snapshot|append|update|delete.
• Marking source and schema field type discriminators.
• Media reference camelCase keys (mediaSetRid, mediaItemRid, branch, schema).

• Open a bug report or feature request in GitHub Issues.
• Review the documentation in docs/ before changing services or contracts.
• For new capabilities, start from services/template/ and the existing ADRs.

Contributions are welcome. See CONTRIBUTING.md for the PR process, RFC requirements, and DCO policy. Security reports follow SECURITY.md.

OpenFoundry is licensed under AGPL-3.0-only. See LICENSE.