Atlas Admin Shell: an admin console composed at runtime

Problem & constraints

Atlas Admin Shell is the kind of admin console a large organisation runs across several teams: identity and access, feature flags and an audit log, each owned by a different domain team. The hard part is not the screens. It is letting each domain build, test and deploy on its own while users see one console, without a release train through the shell. The repository states its deliverable as architecture, not features, and its own documents also call it a microfrontend control plane.

Four constraints shaped it. Every federation participant runs one exactly pinned Angular version, so the shell and the three remotes share one framework at runtime. Domain boundaries are enforced by the build, not by convention: a remote cannot import another remote, and only shared libraries cross. The console has to run with no backend and no identity provider, so a fresh checkout, a reviewer and the test suite need no account. And every significant decision is an ADR with a Verification section of dated receipts; when a receipt stops being true, the ADR says so instead of being rewritten.

It uses no LLM.

Architecture

Atlas runs as four Cloudflare Workers on four origins: one for the shell and one per remote (IAM, Feature Flags, Audit Logs). The remotes are cross-origin on purpose, so the import map, the CORS headers and the error boundary are exercised in production the way the design describes them.

At startup the shell fetches federation.manifest.json, uncached, and initialises Native Federation from it: ES modules and an import map, no bundler-specific runtime. Each entry names a remote’s entry URL, route, display name, icon, exposed module and required role, and the shell builds its routes and navigation from those entries. Adding or repointing a domain is an edit to that file and an upload, not a shell rebuild. A canMatch guard checks the role before a remote is downloaded at all. A remote that fails to load sends the user to an error page the shell owns, with a retry that works in the page, instead of a cached fallback the router would never try again.

Every app is zoneless Angular 21 built on signals. Each remote owns its NgRx Signal Stores, and only two things cross a boundary: AtlasAuth, the auth service every remote injects as the same instance, and a typed event bus whose payloads carry a type and a version, pinned by contract tests. Remotes never import each other, and an Nx lint rule enforces it.

On the shell’s own Worker, /api/* goes to an edge BFF and every other path is served as a static file. The BFF verifies JWTs with jose against the identity provider’s JWKS and enforces what a browser cannot: admin-only flag writes, never removing the last admin, no self-demotion, idempotent writes, and an audit trail written on the server from the verified token. Whether the remotes call it is environment data: the manifest’s apiMode is mock or http, and its auth block chooses the identity provider, mock personas or Nhost with GitHub sign-in. Without either, the console runs on mock data with mock sign-in and needs no server at all. The decisions behind it are logged below, each with the alternative it beat.

Claims that did not hold

The repository keeps its corrections in the ADRs instead of rewriting them, and they are among the most useful parts of it.

The Angular version: ADR-0002 pinned Angular 21 LTS because Nx, NgRx and Storybook could not follow Angular 22 within their declared peer ranges. By 2026-10-22 all of them could, and the ADR had gone on stating the old cause for months. The decision stands and its reason changed: Angular 22 has no LTS tag, nothing in it closes a gap this codebase has, and it changes the canMatch signature the error boundary is built on. The migration is deferred on cost and benefit, not blocked.

The manifest validator was meant to be stricter than the shell’s runtime check. When apiMode joined the contract, only the runtime check learned it, so a manifest with a one-letter typo passed the gate and booted a console with zero remotes. A test now asserts over generated mutations that whatever the runtime check rejects, the validator rejects too, and a second test fails when the fixture falls behind the fields the runtime check reads.

The first Lighthouse run measured the federated route almost exactly like the shell (LCP 1,446 vs 1,444 ms), which cannot be true if one of them loads a remote. The signed-in persona had never reached Lighthouse’s own browser context, so the shell redirected to an empty overview and the runner measured that. It now refuses to report unless the run landed on the URL it asked for and actually fetched a remote’s chunks.

Two protections passed every suite while missing. The BFF accepted a token with no expiry claim forever, because the tests never minted one. And nothing in the workspace styled keyboard focus while axe passed on every screen, because axe has no rule that measures a focus indicator. Both are fixed, and each fix was checked by breaking it again and watching the new test fail.

Outcomes

Slices 1 and 2 of the roadmap’s four are done. Slice 3 (BFF and deploys) is done except PR previews; slice 4 (polish) has Lighthouse, the axe pass and the written architecture done, while the demo video and the Angular 22 migration are open. All four Workers were redeployed on 2026-10-25, and the BFF on the live shell refuses an unauthenticated request to /api/flags with a JSON 401.

The live console shows the composition and a real sign-in, not the security at the edge. Since 2026-10-25 its deployed manifest carries the Nhost block, and a GitHub sign-in completed on it, by hand; no automated test drives it, and a token refresh in production has not been observed. apiMode is still mock, so the data is mock and nothing a visitor does reaches the BFF: no real request has been verified at the edge. PR previews need an edge router that mounts every remote under one origin, which does not exist yet, and the demo video is not recorded.

The figures above come from ADR-0012, measured on 2026-09-06 as the median of three desktop runs on the production build. The shell alone scored 0.96 with an LCP of 1,445 ms; the federated /flags route scored 0.94 with 1,629 ms. Composing a remote at runtime costs about 318 ms of FCP and 184 ms of LCP, which is the price of the manifest-driven design, measured instead of assumed. The test server sent no compression and no caching, so these are a floor on localhost, not production numbers.

The checks run locally. GitHub Actions minutes for private repositories ran out on 2026-10-22, so the hosted CI and Deploy workflows are disabled, and all fourteen gates run with one command, pnpm run ci:local: a zoneless guard, manifest and design-token checks, lint, typecheck, unit and contract tests, the builds, wrangler checks, a bundle check, axe over Storybook, end-to-end tests of the federation against production builds, the BFF over HTTP, and Lighthouse. The repository’s recent pull requests record all fourteen passing; that is pasted output from the author’s machine, not a check GitHub ran.

Lessons

A receipt expires. ADR-0002’s reason stayed in the README for months after it stopped being true, in a repository whose first rule is that a claim needs a receipt. Dating every check made the expiry findable; it did not make anyone look. Re-checking receipts is a task, not something you get by having written them.

A gate’s silence is not coverage. The algorithm pin, the expiry check, the interceptor’s origin check and the focus ring all passed every suite while broken or missing, because no test could produce the failing case. The fix was the same each time: break the protection on purpose and watch the new tests, and only those, fail.

Budget for the architecture you chose. Runtime federation costs requests before the first domain paints, and a Lighthouse budget tight enough to look impressive would have been an argument against the design. Measuring the shell and a federated route separately turned that cost into a number.

Losing hosted CI is a discipline problem, not a compute problem. Running the gates locally kept every one of them and runs more than the hosted pipeline did, but nothing stops a merge that nobody checked. The ADR says so instead of pretending otherwise.