Auth capability view Unknown
Live state unavailableWaiting for session and capability documents.
RS Platform · canonical interface
A live system should reveal
just enough of itself.
One entry point serves visitors, approved users, and the operator. Presentation is shared; authority remains server-side and path-bound.
No authenticated identity.
Absolute expiry is server-enforced.
UI visibility never grants authority.
Private operator path
Pending recovery review
Recovery state is read-only unless the API grants approval capability.
Audience and capabilities come from the platform API. There is no live telemetry projection; this view is derived from session and capability documents only.
System shape
One operating model across two environments.
The cloud holds runtime authority. The home edge executes storage-adjacent work. A replaceable gateway makes the network one platform without making it one failure domain.
Trust-aware topology Editorial view
People
Visitors
Approved users
Operator
Cloud control plane
Talos · Kubernetes
Console · policy
GitOps · observability
Gateway · EC2
Replaceable appliance
VPN · DNS · NAT
rs-gateway · private release
Home edge
Appliance plane
Media · DNS
Storage · watchdog
Repository map
Each repository owns one legible responsibility.
The platform is a polyrepo system. Repositories retain narrow ownership boundaries; the browser remains a consumer of console-authorized projections.
Private · workshop
Architecture and decision records become public as curated writing, not as a working tree.
rs-platformArchitecture
Explains the system.
ADRs, diagrams, and cross-cutting runbooks. No deployable code.
Public · implementation
Created public from the first commit. Source and artifacts are safe to inspect, but carry no operational authority.
rs-infraProvision
Builds the envelope.
Terraform for cloud foundations, networking, IAM, and infrastructure recovery.
rs-cloudDecide
Describes cloud state.
Raw Kubernetes manifests reconciled by ArgoCD for the cloud plane.
rs-edgeSite state
Describes edge state.
Per-node Compose stacks and contracts with no independent authority.
rs-workerExecute
Reconciles the edge.
The snap pulls desired state, reconciles Compose stacks, and reports.
rs-watchdogObserve
Reports the edge.
A Docker observer container that watches and reports, never decides.
rs-consoleAdmit
Admits hardware.
The enrollment API and the approval and artifact-catalog interface.
Private · privileged release
The deliberate exception: production image inputs and release orchestration get their own review and compromise boundary.
rs-gatewayRelease
Releases the gateway.
The immutable appliance image, runtime, verification, and AMI promotion pipeline.
Delegation of control
Cloud decides. Each system executes its own work.
Desired state delegates authority without turning the gateway or edge into competing control planes. This interface exposes authorized projections of that model; it does not bypass it.
Cloud control plane
Decides and records desired state.
Policy, enrollment, peer intent, and recovery direction have one authority. The gateway stays intentionally dumb: it reconciles local desired state rather than exposing an inbound admin API.
Gateway and home edge
Execute close to the network and bytes.
The gateway reconciles peers and network runtime. Home appliances execute storage-adjacent work and report back without becoming a second management plane.
Platform interface
Projects authority by audience.
Visitors, approved users, and the operator receive different views and capabilities. Authorization lives behind the interface, never in a hidden control or client-side condition.
Deliberate boundary
The frontend describes authority. It never creates it.
Live audience and capability state comes only from the versioned platform API. Development fixtures are explicitly labelled and compile out of production authority. API failure is shown as unavailable, never healthy.