THE PLATFORM
What runs underneath the declaration
A set of Rust services with hard boundaries between them, coordinated by events and driven from the same declarations the CLI reads.
Capabilities
Typed DAG execution
Workspace task-service pipelines are declared as typed Nickel graphs, with referential integrity checked at schema time. Parallelism and error handling are declared, not implicit.
Coordination over NATS JetStream
A persistent event bus is the single broker between services. They exchange lease, task and status events — credentials never travel on the bus.
Security end to end
Cedar policies for authorization, sessions managed only by the Control Center, and secrets served by SecretumVault on lease references: services never hold the values.
Extension through OCI
Providers, task services and cluster definitions are distributed as OCI artifacts. The component contract is content-addressed and pinned by digest, never copied.
One registry, every surface
CLI, HTTP and MCP dispatch through a shared registry, so an operation has the same semantics whichever way it is invoked.
Centralised versions
Every tool and provider version is defined in Nickel schemas, and shell-compatible exports are generated from them: one source of truth for Nushell, Nickel, SOPS, Age and the providers.
Service boundaries
Each responsibility lives in exactly one place. A violation is caught at compile time, development time, pre-commit, CI, runtime or audit.
Provider APIs → orchestrator only
Every cloud SDK call is isolated in the orchestrator, and SSH in the orchestrator and machine services; the others go through the orchestrator's HTTP API. SSH to a node is verified against its pinned host keys.
Authorization → Control Center only
Token validation and Cedar policy evaluation happen only in the Control Center. Other services receive a user context and never re-evaluate a policy.
Secrets → vault only
Credentials are never stored in messages or environment variables. A service holds a lease and retrieves the secret from the vault service over HTTPS.
Platform services
The Rust services that make up the control plane.
- Orchestrator
- Provider APIs and the SSH boundary; task state machine, webhooks, rollback.
- Control Center
- The authorization boundary: Cedar policies and sessions.
- Control Center UI
- Web dashboard compiled to WebAssembly with Leptos.
- SecretumVault
- Secrets API with lease lifecycle and post-quantum cryptography.
- Extension registry
- Catalog of providers, task services and clusters.
- MCP server
- Tools and retrieval for agents, over the shared registry.
- AI service
- Model inference layer behind the MCP tools.
- Detector
- Event detection across the platform.
- Daemon CLI
- Service lifecycle on the operator's host.
- Machines
- Machine management.
- Observability
- Prometheus metrics.
- Backup
- State backup.
- Encrypt
- Key operations.
Technology
- Nickel
- Nushell
- Rust
- NATS JetStream
- SurrealDB
- Cedar
- Leptos WASM
- Kubernetes
- Docker Compose
- SOPS
- Age
- OCI
- Git
Start from the declaration
Read what Provisioning is and the concepts it is built on, or ask about using it for your infrastructure.