A cell is physical. A node is an identity.
A cell is a complete instance of the platform, its own databases, its own object store, its own service processes, up to nine services. It is replicable and holds its own state, so replication and placement operate at this level.
A node is logical and persistent. It carries a cryptographic identity, aggregates one to many cells that may span clouds and regions, and is the identity that survives cell replacement. An organization aggregates nodes.
Which means a cell can die and be replaced without the estate losing an identity, a history or a peer relationship. The node is what the outside world knows.
| Level | What it is |
|---|---|
| Organization | The top boundary. Mints nodes, owns users, agents and policy, holds a certificate authority. An organization can be moved under another, transferring ownership with recorded consent. |
| Node | A cryptographic identity over a set of cells that may span clouds and regions. It survives cell replacement, so a cell can die without the estate losing an identity, a history or a peer relationship. |
| Service group | Cells grouped for a purpose, an erasure set, a replication group, a workload boundary. |
| Cell | The unit of deployment: a complete instance of the platform with its own databases, object store and service processes. Not a worker node. |
| Air-gapped cell | Modelled as an absent edge rather than a failed peer to retry, every rival treats a partition as an error condition. |
| Edge Agent | A signed binary on a field device, holding a delegated identity from a parent entity. |
3 scale axes, with the roll-up chains declared rather than implied
| Axis | Members | Roll-up chain |
|---|---|---|
| Entity | User, agent, node, organization, device, service account | cell → node → organization → nested organization → super-organization |
| Physical | Cell, rack, zone, region | cell → rack → zone → region |
| Grouping | Service group, entity group | aggregates across both |
Replication is not one setting. Each table declares its own policy and workspace scope alongside its schema, and the engine resolves scope from topology across 9 scopes, so what crosses which boundary is a property of the data model rather than a runtime setting somebody can quietly widen.
Cross-organization traffic is authenticated with a key derived from the trust edge between the two parties, not with the cluster token, a foreign organization never holds that. Revoking a partner means dropping an edge rather than rotating a cluster. That is the difference between a federation model and a shared secret with extra steps.
Your data survives, spread so no one cell can sink it
Placement is not left to chance. A durable object is erasure-coded into data and parity shards, and an executable invariant forbids any cell from holding two shards of the same object, checked before a shard is placed, so a repair never rebuilds a shard onto a cell that already holds a sibling. Spread across distinct cells and failure domains, losing any single domain still leaves enough shards to rebuild.
Two tiers, one governance model: a live database tier replicates whole databases per cell, and a durable object tier erasure-codes large objects and moves them between a hot and a cold class as access changes. Erasure is chosen only once there are enough cells and at least two failure domains, below that, plain replication is the safer default, and the engine picks the safer one rather than the cheaper one.
| Mechanism | What it guarantees |
|---|---|
| Erasure coding (object tier) | A durable object is split into data and parity shards with a Reed-Solomon code, so it survives the loss of a whole failure domain without a full replica of every byte. Erasure is chosen only once there are enough cells and at least two failure domains; below that, the safer choice is plain replication. |
| Distinct custody | No cell may hold two shards of the same object. The rule is checked as a pre-condition before a shard is placed, so a repair never rebuilds a shard onto a cell that already holds a sibling, which would otherwise cost two shards in one failure. |
| Zone and region affinity | A namespace's placement policy filters and ranks candidate cells by zone and region, and the same selector runs at the core and the edge. A placement that cannot satisfy the policy is refused rather than quietly made outside it. |
| Survives any one failure domain | Because shards are spread across distinct cells and domains, losing any single domain still leaves enough shards to rebuild. Durability is expressed as executable invariants that name what they violated, not as prose, distinct custody, domain spread and survivability checked before and after placement. |
| Two tiers | A live database tier replicates whole databases per cell; a durable object tier erasure-codes large objects and moves them between a hot and a cold class as access changes. Two tiers, one governance model, no second system to run. |
| Cross-organization key separation | A batch relayed across an organization boundary is sealed to the destination organization's own key; the private half never leaves that organization, and a relay in between sees only an opaque blob. Revoking a partner drops a trust edge rather than rotating a cluster. |
Disaster recovery is the same spine
A workspace fails over to a standby all-or-nothing across every plane, under a completeness gate that requires an attested, complete snapshot before any cutover, the home re-point is withheld unless each plane promoted cleanly, and a partial promotion aborts rather than half-completes. Failback reverses it. And a durability claim survives the sovereign corner too: the same placement invariants hold with no cloud in the loop.
You declare one intent, and every cell tells you, signed, what it applied.
Configuration is derived from capability intent rather than toggled per cell. Policies target a region, zone, rack, service group, cell profile or tag, never a cell list, so disabling a capability across a region is one signed edit and the reconcilers converge. A newly joined cell inherits its effective configuration during join, before it serves traffic, so a cell is never live but ungoverned.
And distribution alone would be write-only, so it is symmetric: on each reconcile tick a cell emits a signed attestation of what it actually applied, policy versions, capability state, worker set, drift, active pins, hash-chained into the audit. The node observes every cell’s real running state and can compare intended against actual, fleet-wide.
| Step | What happens |
|---|---|
| Declare intent | An operator declares a capability at a high semantic level. Nobody toggles a worker. |
| Derive | A declarative dependency graph derives the worker set from the capability. Turn a capability off and the workers servicing it derive off. |
| Sign | The policy is signed by the issuing entity before it goes anywhere. |
| Replicate | Written to a directory-replicated table and propagated by existing replication scopes, targeted by selector (a region, zone, rack, service group, profile or tag) never a cell list. |
| Verify | Each cell verifies before applying. An unsigned or badly-signed policy is rejected and the cell holds last-known-good. Versions are monotonic, so a replayed policy cannot roll a cell backwards. |
| Reconcile | Local edits are reverted unless held by an audited, reason-prompted, time-boxed break-glass pin. |
| Attest | On each tick the cell emits a signed effective-configuration attestation (versions applied, capability state, worker set, drift, active pins) hash-chained into the audit. |
| Compare | The node observes every cell's actual running state and can render intended against actual, fleet-wide. |
| Disconnected cells | Accept policy by signed offline bundle verified on import, keep reconciling locally, and flush queued attestations on reconnect. |
Every level is a decision-maker, not a number being averaged upward
A monitoring stack aggregates numbers upward and leaves the decision to a human at the top. Here each scale runs the same discipline, its own view, its own band, its own budget, and each scale can refuse. The level above sees what the level below decided and why, through a decision audit chain with peers co-witnessing across cells.
A workspace is not just a container; it is a bounded context that can be asked how it is doing, fusing its own semantic coherence, its governed capacity per resource class, and the standing of the entity that owns it. That rolls up to the node, both the node’s own state and a fractal composition over its cells and its edge devices, so a persisted snapshot answers “how is my whole network” instantly, even while children are unreachable.
Coherence and value never collapse into one number
Strong internal agreement paired with low net gain is surfaced as extractive (a cartel) rather than reported as aligned. Two different axes, reported side by side.
The most-concerning child surfaces
Rather than being averaged away by the siblings that are fine. An average is how a roll-up hides the thing you needed to see.
Absent signals stay absent
A missing reading is reported as unknown, never fabricated as a zero. A dashboard that cannot tell those apart is worse than no dashboard.
Load is work; value is value
They are reported beside each other and never thresholded through one another, because a busy system and a harmful one are different problems.
A spike is not damage
Only a sustained breach is, and it is reported as debt owed compensation rather than as an alarm to acknowledge and dismiss.
These five invariants are what make a roll-up trustworthy rather than a dashboard average. The order is acquired rather than imposed: cells converge on shared state, attest what they are running, observe and are observed by their peers, and roll their state into a node that has a cryptographic identity of its own and can be asked questions.
And the leaves are devices
An edge device is a leaf of the same structure rather than a separate telemetry estate. It holds a hardware-bound identity and a delegation the platform can revoke in one call, evaluates policy locally with no round trip, and, when the link drops, becomes a sub-conductor so a disconnected group can still answer a question among themselves and rejoin with its history intact.
| Carrier | Role |
|---|---|
| gRPC over mutual TLS | Primary. Direct to the cell's service ports, with token-by-token streaming for AI queries. |
| HTTPS / REST | Secondary, through the node's public gateway. |
| WebSocket | Tertiary, for networks that block gRPC and long-poll HTTPS alike. Every frame attests its delegation chain. |
| SSH tunnel | Bastion-style relay for estates whose only way in is a jump host. |
| MQTT | Constrained and low-power links. Refuses an AI query rather than publishing cleartext to a broker when the sealing key is absent. |
| DNS-over-HTTPS | Heartbeat-class traffic only, and we do not claim more than that. |
| Air-gapped posture | Writes a signed bundle for an operator to carry; the device never dials. Outside the ladder, because failing over to store-and-forward would let an outage read as success. |
The design philosophy, stated plainly
We are not racing to build a general intelligence. We are building the conditions under which distributed intelligence can operate safely: every actor identified, every action observable, every consequential decision gated, at every scale from a single workspace to a whole estate, and the estate can still answer when the network cannot.
The addressing, selector and replication model is designed for estates of many thousands of cells. That is a statement about the design, not a measured deployment, and we keep the distinction because an architecture claim you cannot check is worth nothing to the person who has to defend it internally.