ARCHITECTURE
Three concerns.
One graph.
Three connected foundations — endpoint command, telemetry evidence, and governed actions — share tenant, authorization, and audit primitives. The architecture supports a real, partial remediation loop today; field evidence, operational scale, and complete PSA/service workflows are still being built.
01 — COMMAND
Dispatch & control
Ed25519-signed typed operations over a gRPC bidi stream, ACL-checked against a default-deny allow-list before they touch a daemon.
02 — DATA
Ingest & store
Every daemon heartbeat carries a full telemetry snapshot into Postgres, evaluated for drift on arrival, chained into a tamper-evident audit trail.
03 — ACTION
Discover & gate
A typed action registry and MCP proxy mediate tenant authorization, risk scoring, approvals where required, and audit receipts. Breadth and endpoint acceptance vary by action.
UNIFIED ENTITY GRAPH — CLIENT · SITE · IDENTITY · ASSET · CONTRACT · TICKET · CONFIG · LICENSE · KNOWLEDGE
TODAY THIS IS ONE MODULAR MONOLITH, NOT THREE SEPARATE SERVICES — EACH CONCERN IS ITS OWN ROUTER MODULE, TOGGLEABLE BY ONE ENV VAR
CONTROL PLANE — PYTHON / FASTAPI
A modular monolith that refuses to leak.
Fully async FastAPI on Postgres 16. Tenant isolation isn’t middleware — it’s row-level security enabled and forced on nearly every tenant-scoped table, with an app role that cannot bypass it. Missing tenant context returns zero rows.
Domain routers can be enabled explicitly, but the control plane remains a modular monolith today. Docker Compose and a CI-validated Helm chart provide the supported deployment paths.
AUTH
JWT (RS256) + Argon2 password hashing, RBAC, per-route rate limiting
ENROLLMENT
One-shot tokens → CA-signed mTLS client certs, Ed25519 signing keys, full endpoint lifecycle API
COMMAND CHANNEL
gRPC CommandService bidi-stream with a connection manager per daemon
OPEN SURFACE
HMAC-signed webhooks with retries · OAuth2 client_credentials (RFC 6749) · tenant-gated MCP proxy · loopback-only endpoint MCP tools
API
712 REST operations across 552 paths, covering the core platform plus action discovery, MCP proxy, models, procurement, CRM, maintenance, imports, CVE intelligence, monitoring, AI exposure, memory security, agent behavior, Agent Threat Rules, compliance posture, incidents and service desk, knowledge and RAG, documents, assets, patch and application-update inventory, update policies, playbooks, revenue, SmartCVE, Microsoft 365 reporting, provider workspaces, and specialist agents — with the OpenAPI contract checked in and diff-guarded in CI
ENDPOINT DAEMON — RUST · SHIPPED
One binary. Every platform. Tiny footprint.
A single Rust binary for Windows, Linux and macOS — enrollment, telemetry, signed typed commands, a loopback-only MCP tools surface, and local-inference foundations are implemented today, designed for a 200MB RAM ceiling.
Local inference triages and classifies on-device — cutting bandwidth and working offline. We’d rather ship the daemon honestly-scoped today than promise a wrapper around vaporware.
TRANSPORT
mTLS-only bidirectional gRPC derives endpoint identity from the enrollment-issued client certificate; Ed25519 signs each authorized command, replay-guarded by a nonce ledger that’s now persisted to disk and survives a full restart. Transport is direct outbound mTLS gRPC that works behind NAT; the Headscale/WireGuard mesh was deliberately retired (ADR 0021). Certificate renewal, revocation, and old+new CA bundle rotation are live. A decommissioned or rotated cert is rejected fleet-wide within seconds
EXECUTION
A typed executor, not arbitrary shell. 18 typed command types are defined, and PING, DIAGNOSTIC, BACKUP_CREATE, BACKUP_RESTORE, FILE_OP, SERVICE_OP, REGISTRY_OP, FIREWALL_OP, CONFIG_OP, PACKAGE_OP, REBOOT, DAEMON_UPDATE and the read-only inventory commands all ship today.
TELEMETRY
A full state snapshot rides every REST heartbeat — the control plane evaluates it for drift on arrival, no polling loop involved
LOCAL AI + MCP
A deliberately narrow local MCP surface binds only to loopback, while an OpenAI-compatible embeddings endpoint supports local workflows. Resource budgets, packaging, and offline acceptance remain foundation work.
OPERATOR DASHBOARD — REACT 19
Types that can’t drift.
React 19 + Vite + Tailwind, with every API type generated from the checked-in OpenAPI spec. CI fails the build if backend and frontend drift by a single field — and the same generated client now backs a mobile app too.
LIVE TODAY
37 navigated operator areas across four workspaces (Operate, Automate, Manage, Platform), including endpoints, agents, AI exposure, AI fleet, AI usage, incidents, patch inventory, patch compliance, application updates, asset management, compliance posture, revenue, Microsoft 365 reports, knowledge, session recording, Vault, webhooks and API clients.
GOVERNANCE UI
Approvals queue, drift policies, and the unified Alert Center — not just CRUD screens, the actual decision-engine workflow
COMMAND RAIL
One role-filtered registry drives the navigation rail, the global search bar and the detail routes, which orient beneath their parent with breadcrumbs and parent-active state. Endpoint, alert and monitoring inspectors keep approval, execution, result, verification and cancellation states separate, and are scoped by tenant and session so stale or cross-tenant data is never rendered. Search and chat share one input.
TYPE SAFETY
OpenAPI codegen with two-way CI drift guards — 500+ Vitest cases across 76 dashboard test files
RECENTLY LANDED
Endpoint detail with live remediation history · compliance posture workspace · monitoring and logs workspace with a fixed-DSL query proxy · routed deep links with browser-history restoration.
STILL AHEAD
An audit viewer with in-app hash-chain verification, and broader accessibility hardening.
INFRASTRUCTURE
Grows from one box to a cluster.
TODAY
Docker Compose
One command brings up the control plane, Postgres, Redis, NATS, MinIO, Loki and the dashboard on a single box. Real docs, up in an afternoon.
AT SCALE
Kubernetes (Helm)
A real chart — Deployment, migration Job, optional Ingress/HPA/PDB — lint/template/kubeconform-checked in CI on every push, not a diagram.
SCALE-OUT PATH
Swap the key store
Move Ed25519 signing keys from the default filesystem store to the Postgres/Fernet-encrypted one and it removes one scale-out blocker. Today the supported topology is a single active control-plane process: the Helm chart rejects replicaCount > 1 and the daemon connection registry is still process-local.
SELF-HOSTABLE INFRASTRUCTURE — POSTGRES 16 + PGVECTOR · NATS · OPENSEARCH · LOKI · REDIS · MINIO. R2 HAS A DELIVERED INGESTION SLICE WITH AN ENCRYPTED ENDPOINT SPOOL AND A SHIPPED FIXED-DSL QUERY UI.
BUILD STATUS
Deliberately partial. Honestly reported.
Everything marked shipped passes real tests against real backing services — locally and in CI, on every push. See the Platform page for what drift detection, policy packs, and identity sync actually do.
✓ SHIPPED & TESTED
Multi-tenant foundationRLS · JWT · RBAC · AUDIT
Endpoint enrollmentmTLS CERTS · ED25519 · LIFECYCLE
Endpoint credential renewal + revocationPROOF-OF-POSSESSION · LIVE REVOCATION · GENERATIONS
Rust endpoint daemon18 TYPED COMMAND TYPES
gRPC command channelBIDI STREAM
Drift detection + governed remediation foundationEVERY HEARTBEAT
Unified Alert CenterDEDUP · WEBHOOKS
Monitoring admission + queue healthJETSTREAM · OPENSEARCH · QUARANTINE
Baseline policy packsWINDOWS · LINUX SEEDS
Identity directory syncENTRA · OKTA · GOOGLE
Secrets vaultENVELOPE CRYPTO · BREACHWATCH · PKI
Reporting engine + mailer17 REPORT TYPES · SCHEDULED
Application catalog + matchingEVERY HEARTBEAT · CVE-AWARE
Software inventory + patch/update managementDAEMON · CONTROL PLANE · DASHBOARD
Windows + Linux security stateBOUNDED · FAIL-CLOSED
Model rollout + maintenance packagesSIGNED · CANARY · GOVERNED
Competitor import foundationSTAGE · DRY-RUN · IDEMPOTENT COMMIT
Compliance posture + framework catalogsEVIDENCE · MAPPINGS · ALERTS
Customer portal foundation14 DESTINATIONS · COMPLIANCE · INVOICES · KNOWLEDGE
Webhooks + OAuth2HMAC · RFC 6749
AI-agent security foundationsATR · ABV · EXPOSURE · MEMORY
Mobile app (P0)LOGIN · APPROVALS
Kubernetes deploymentHELM · CI-VALIDATED
Operator dashboard + CICODEGEN DRIFT GUARDS
⎋ IN FLIGHT / ROADMAP
Issuer adoption proofCA CUTOVER · CRL
Security event + remediation foundationINGEST · VERIFY · RETRY
Compliance & reporting depthSCORE ROLLUPS · PDF EXPORT · AUDITOR PACKS
Commercial workflow depthLIVE PROVIDER OAUTH · SOCIAL CONNECTORS
Centralized monitoring depthBROADER COLLECTORS · ARCHIVE · NOTIFICATION PROVIDERS
Agent evidence automationSCHEDULED SCANS · UI · RELEASE GATES
Customer portal depthCUSTOMER UAT · BROADER WORKFLOWS
Mobile app P1+PUSH · STORE SUBMISSION
Android MDM + bounded visual evidencePLANNED TRACKS · NOT BUILT