A command plane that dispatches signed operations, a data plane that ingests fleet telemetry, and an intelligence plane where governed AI agents detect and remediate — all reading and writing one unified entity graph.
01 — COMMAND PLANE
Dispatch & control
Ed25519-signed typed operations over a gRPC bidi stream. Delivery tracking, batch execution, offline queueing.
02 — DATA PLANE
Ingest & store
Metrics to TimescaleDB, logs to Loki, events over NATS JetStream. Drift detection and a hash-chained audit trail.
03 — INTELLIGENCE PLANE
Detect & remediate
Diagnostic, remediation, security and compliance agents — risk-scored by the decision engine, approval-gated when it matters.
Fully async FastAPI on Postgres 16. Tenant isolation isn’t middleware — it’s row-level security enabled and forced on every tenant-scoped table, with an app role that cannot bypass it. Missing tenant context returns zero rows.
Modules split into separate services via a single env var when you outgrow one box — Docker Compose today, Kubernetes-ready by design.
One-shot tokens → CA-signed mTLS client certs, Headscale preauth keys, Ed25519 signing keys, full endpoint lifecycle API
COMMAND CHANNEL
gRPC CommandService bidi-stream with a connection manager per daemon
OPEN SURFACE
HMAC-signed webhooks with retries · OAuth2 client_credentials (RFC 6749) · MCP server on the roadmap
API
24 REST endpoints across auth, tenants, users, endpoints, enrollment, webhooks, oauth — OpenAPI spec checked in and diff-guarded in CI
ENDPOINT DAEMON — RUST
One binary. Every platform. Tiny footprint.
A single Rust binary for Windows, Linux and macOS behind a cross-platform SystemAdapter — under 200MB RAM, connected home through a self-hosted WireGuard mesh with mTLS on top.
Local inference (ONNX / CoreML / OpenVINO) triages and classifies on-device — cutting bandwidth, working offline, and slashing API cost at fleet scale.
Typed operations only — no arbitrary shell. Snapshot / restore / rollback backup engine wraps every change
TELEMETRY
Streams metrics, logs and security events into the data plane pipeline
LOCAL AI
On-device triage and classification; <2.7GB RAM with inference enabled; fleet-wide model distribution
OPERATOR DASHBOARD — REACT 19
Types that can’t drift.
React 19 + Vite + Tailwind, with every API type generated from the checked-in OpenAPI spec. CI fails the build if backend and frontend drift by a single field. Login, tenants, endpoints, enrollment and webhooks are live today, with an MSP-admin tenant switcher.