# Applications

StormTrust application code lives under `org/apps/`. Terraform owns each stable Worker identity and durable resource. Wrangler owns each application bundle and custom domain.

## Application inventory

| Domain or boundary                 | Source                | Worker                 | Repository state                               |
| ---------------------------------- | --------------------- | ---------------------- | ---------------------------------------------- |
| stormtrust.net, www.stormtrust.net | org/apps/www/         | stormtrust-www         | Managed                                        |
| assets.stormtrust.net              | org/apps/assets/      | stormtrust-assets      | Managed                                        |
| developers.stormtrust.net          | org/apps/developers/  | stormtrust-developers  | Managed                                        |
| ui.stormtrust.net                  | org/apps/ui/          | stormtrust-ui          | Managed                                        |
| auth.stormtrust.net                | org/apps/auth/        | Seven auth Workers     | Managed                                        |
| monitor.auth.stormtrust.net        | org/apps/auth/        | Auth monitor UI        | Access protected                               |
| app.stormtrust.net                 | org/apps/app/         | Eight app Workers      | Managed                                        |
| Gateway-managed hostnames          | org/apps/gateway/     | stormtrust-gateway     | Managed                                        |
| Internal service only              | org/apps/data/        | stormtrust-data        | Managed                                        |
| hail.stormtrust.net                | org/apps/hail-alerts/ | stormtrust-hail-alerts | Access protected                               |
| pioneer.stormtrust.net             | org/apps/pioneer/     | stormtrust-pioneer     | Access protected; token-protected proof routes |

Application selection follows transitive build and runtime dependencies. Shared toolchain changes can select every app. Bundled changes rebuild consumers; runtime-service changes verify consumers without automatically redeploying them. The trusted workflow applies Terraform before it deploys an affected application.

The gateway route runs before its configured Custom Domain origins, including auth. It selects a fixed service binding from the request hostname. Public pages remain public, while protected paths must pass identity and coarse role checks.

## Operate an application

Use the shared [operations guides](/stormtrust/engineering/operations/) to create, catalog, administer, validate, deploy, and recover apps. The [health evidence table](/stormtrust/engineering/operations/health/#evidence-by-application) covers every cataloged app and distinguishes deployment receipts from runtime checks. Read the application reference for its special access, state, and build requirements.

## Application documentation

- [www.stormtrust.net](/stormtrust/apps/www.stormtrust.net/)
- [assets.stormtrust.net](/stormtrust/apps/assets.stormtrust.net/)
- [developers.stormtrust.net](/stormtrust/apps/developers.stormtrust.net/)
- [ui.stormtrust.net](/stormtrust/apps/ui.stormtrust.net/)
- [StormTrust data service](/stormtrust/apps/stormtrust-data/)
- [auth.stormtrust.net](/stormtrust/apps/auth.stormtrust.net/)
- [Kansas City hail alerts](/stormtrust/apps/stormtrust-hail-alerts/)
- [StormTrust gateway](/stormtrust/apps/stormtrust-gateway/)
- [app.stormtrust.net](/stormtrust/apps/app.stormtrust.net/)
- [Pioneer acceptance canary](/stormtrust/apps/stormtrust-pioneer/)