A command surface that dispatches signed operations, a data surface that ingests fleet telemetry, and an intelligence surface where the decision engine risk-scores every proposed action — three concerns, one modular monolith today, all reading and writing one unified entity graph.
01 — COMMAND
Dispatch & control
Ed25519-signed typed operations over a gRPC bidi stream, ACL-checked against a default-deny allow-list before they touch a daemon.
02 — DATA
Ingest & store
Every daemon heartbeat carries a full telemetry snapshot into Postgres, evaluated for drift on arrival, chained into a tamper-evident audit trail.
03 — INTELLIGENCE
Score & gate
The decision engine scores every proposed action across five dimensions into a single risk score that decides auto-execute, approval, or senior approval.
TODAY THIS IS ONE MODULAR MONOLITH, NOT THREE SEPARATE SERVICES — EACH CONCERN IS ITS OWN ROUTER MODULE, TOGGLEABLE BY ONE ENV VAR
CONTROL PLANE — PYTHON / FASTAPI
A modular monolith that refuses to leak.
Fully async FastAPI on Postgres 16. Tenant isolation isn’t middleware — it’s row-level security enabled and forced on every tenant-scoped table, with an app role that cannot bypass it. Missing tenant context returns zero rows.
Modules split into separate services via a single env var when you outgrow one box — Docker Compose today, Kubernetes-ready by design.
One-shot tokens → CA-signed mTLS client certs, Headscale preauth keys, Ed25519 signing keys, full endpoint lifecycle API
COMMAND CHANNEL
gRPC CommandService bidi-stream with a connection manager per daemon
OPEN SURFACE
HMAC-signed webhooks with retries · OAuth2 client_credentials (RFC 6749) · MCP server on the roadmap
API
74 REST endpoints across auth, tenants, users, endpoints, enrollment, webhooks, oauth, identity, drift, approvals, alerts, policy packs — OpenAPI spec checked in and diff-guarded in CI
ENDPOINT DAEMON — RUST · SHIPPED
One binary. Every platform. Tiny footprint.
A single Rust binary for Windows, Linux and macOS — enrollment, telemetry, and signed-command execution all ship today, under 200MB RAM, backed by 91 daemon-side tests.
Local inference triages and classifies on-device — cutting bandwidth and working offline. We’d rather ship the daemon honestly-scoped today than promise a wrapper around vaporware.
TRANSPORT
Ed25519 per-request signatures over gRPC today, with a 300-second freshness window and replay protection. WireGuard mesh join and mTLS verification are next — keys and certs are already issued at enrollment
EXECUTION
A typed executor, not arbitrary shell: PING, DIAGNOSTIC, BACKUP_CREATE and BACKUP_RESTORE ship today; other command types are defined but stubbed
TELEMETRY
A full state snapshot rides every REST heartbeat — the control plane evaluates it for drift on arrival, no polling loop involved
LOCAL AI
Tiered on-device triage (candle + quantized Gemma), native service install for systemd, launchd and Windows SCM
OPERATOR DASHBOARD — REACT 19
Types that can’t drift.
React 19 + Vite + Tailwind, with every API type generated from the checked-in OpenAPI spec. CI fails the build if backend and frontend drift by a single field — and the same generated client now backs a mobile app too.
Approvals queue, drift policies, and the unified Alert Center — not just CRUD screens, the actual decision-engine workflow
TYPE SAFETY
OpenAPI codegen with two-way CI drift guards — 64 vitest cases across 13 test files
COMING
Endpoint detail page, compliance view, logs explorer, an audit viewer with hash-chain verification
INFRASTRUCTURE
Grows from one box to a cluster.
TODAY
Docker Compose
One command brings up the control plane, Postgres, Redis, NATS, MinIO, Loki and Headscale on a single box. Real docs, up in an afternoon.
AT SCALE
Kubernetes (Helm)
A real chart — Deployment, migration Job, optional Ingress/HPA/PDB — lint/template/kubeconform-checked in CI on every push, not a diagram.
MULTI-REPLICA
Swap the key store
Move Ed25519 signing keys from the default filesystem store to the Postgres/Fernet-encrypted one, and the control plane can run more than one replica behind the HPA.
Everything marked shipped passes real tests against real backing services — locally and in CI, on every push. See the Platform page for what drift detection, policy packs, and identity sync actually do.