Skip to main content

Architecture

What runs today, and what doesn't yet

One map of the runtime, from an incoming signal to the clients that read the result.
Every part carries its own label: Shipped, Beta, Partial or Planned.

Runtime mapsignal and queueinvestigation stagesrecord and clients

Signal in, cited report out

Read it top to bottom. A dashed box is not running the way the design describes. Where it runs, hosted, or in your own cluster (available in closed beta), is on the Platform page.

  1. 01 Signal in

    • Signal intake

      Shipped

      An API edge takes alerts, webhooks and direct requests, and opens an investigation.

  2. 02 Queue

    • Event queue (Kafka)

      Shipped

      Each investigation is dispatched as a message, and a worker picks it up.

  3. 03 Investigation

    Investigation stages

    Shipped

    Specialist agents run the stages in order. Today one worker runs them all; dispatching each stage through the queue is built but switched off.

    1. 01Detect
    2. 02Gather
    3. 03Exhibit
    4. 04Hypothesise
    5. 05Challenge
    6. 06Report
    7. 07Gate

    • Stage orchestrator

      Partial

      Designed to schedule each stage over the queue. It is built but is not the executor: one worker runs the investigation today.

    • Autoscaling per stage

      Planned

      Designed to scale each stage with demand, down to zero. Designed, not live.

    • LLM gateway

      Shipped

      Every model call goes through one gateway, with routing, retries and a circuit breaker across providers.

  4. 04 Record and replay

    • Evidence record

      Shipped

      Events and exhibits are recorded as the investigation runs, and the report cites them.

    • Live stream with replay

      Shipped

      A client can pick a live investigation back up where it left off after a dropped connection.

    • Rebuild and time travel

      Planned

      Rebuilding a view from the full record, or stepping back through it, is designed and not built.

  5. 05 Clients

    • Web workspace

      Beta

      Read the investigation, its exhibits and its proposed action, and approve or reject.

    • Editor plugin and command line

      Beta

      Start and follow an investigation from the editor. Claude Code is wired end to end; Cursor, Codex and OpenCode run.

    • MCP server

      Beta

      Open source and published on npm. Exposes the investigation tools to any MCP client; validation in each editor is still pending.

  • ShippedBuilt and running in the product (access is through the closed beta).
  • BetaAvailable to closed-beta teams.
  • PartialBuilt, but not the way the design describes it.
  • PlannedDesigned, and not running today.
signal · queue · investigation · record · clients · a dashed box is not running the way the design describes

Three parts not yet live

Three parts are not fully running.
This is what each one means if you are sizing a rollout.

One worker per investigation

The orchestrator that would schedule stages across workers is built, and switched off.
An investigation runs start to finish in a single worker, which is how it works today.
It also means capacity is set by hand, not by demand.

Partial

No autoscaling per stage

Scaling each stage independently, to zero when idle, is designed and is not live.
Do not size a rollout on the assumption that it is.

Planned

No rebuild on request

Events and exhibits are recorded, and a client can resume a live stream.
Rebuilding a view from scratch, or stepping back through an investigation, has no tool yet.

Planned

Bring one incident and see what it exercises

The map is only useful against a real investigation.
Run one through the shipped parts and read what each stage produced.

Join the closed beta

Self-host via Helm — available in closed beta.