Platform Architecture
Most platforms are an assembly: a data platform, plus a SIEM, plus an identity story, plus an AI governance layer, plus an edge story, each a separate product with its own model of who a user is, its own audit trail, and its own seam where governance gets lost. System9 is the opposite. It is one substrate that carries data, AI, security, and mission work, so its guarantees are structural, true because of how the system is built rather than because of a feature bolted on top.
This topic is the map of that shape. It exists to make the whole product legible as one system: the unit it is built from, the shapes that unit composes into, and the fact that the core and the edge are one product rather than a platform and a degraded client of it.
What's covered
| Page | What you'll find |
|---|---|
| The estate hierarchy | Organization → Node → (optional) Service Group → Cell, with the Edge Agent off the node: the shape an estate is composed from |
| The executive engine | One organ that senses, decides, and acts: a reflex value gate and a deliberative foresight stage: deciding identically on core and edge, with intelligence forming at four loci |
| The Mind (roll-up) | A workspace asked how it is doing across knowledge, load, and value: rolled up fractally through cells, edge agents, and regions without collapsing its axes |
| The cell model | A cell is a complete instance of the platform; nodes and service groups compose cells into an estate, and version skew across them is normal |
| Deployment topology | Single cell to elastic fleet, cloud to air-gapped: the full matrix, the region → zone → rack → cell topology, and the edge as a deployment (including cells placed at an edge site) |
| Data residency | Residency pinned on a workspace or clean room; failover stays within the pinned level, and an unsatisfiable required constraint refuses rather than degrading |
| Replication, DR & federation | Nine replication scopes resolved from topology, the four ways the catalog distributes across cells, and disaster recovery |
| Cell network fabric | How cells find, trust, and reach each other: fenced leases with monotonic epochs, the peering graph, and layered attested reachability over mutual TLS |
| Directory router | Resolving a public front-door URL, a system9:// entity address, or a service scope to a target: deny-closed, and pinned to the edge by a cross-language fixture |
| Core and edge | One product, two runtimes: a full cell, the Edge Agent that reads from a cell, and the parity discipline that keeps them from drifting |
| The digital nervous system | Core as brain, Edge Agents as sensorimotor tentacles: the four signal planes (afferent, proprioception, efferent, coordination) that form a sense → decide → act loop |
| Placing work across Edge Agents | The operator's how-to for the efferent and coordination planes: freest-first placement, lifecycle holds, A2A, and the edge conductor fallback |
| Edge & fleet management | The transport ladder and fleet releases: the deployment the product is sold on |
| Fleet Releases | Moving signed software across an Edge Agent fleet: post-quantum signed packages, a transparency log, cohorts as queries, ring-by-ring rollout with health gates and automatic rollback, freeze and blackout windows, drift severity, and GitOps |
| Third-party interoperability | Sovereign and integrated: federate identity, govern data in place, keep keys where they live, feed existing BI and SIEM tools, and be driven by other agents |
| Platform services | The nine services that run inside every cell, what each owns, its ports and workers, and the node service as the single front door |
| Lifecycle & operations | The operational life of a cell and a node: first boot and setup, joining the fabric, cloning a workspace or clean room, and disaster recovery with failover and failback |
The shape
Organization mints nodes; owns users, agents, and policy
└── Node a logical system identity spanning locations
├── Service Group a set of cells grouped for workload or replication
│ └── Cell a complete instance of the whole platform
└── Edge Agent a small signed binary where a cell cannot run
Four ideas do all the work here, and every page in this topic returns to them.
- A cell is the unit of deployment: a whole platform, with its own databases, its own object store, and its own service processes. Not a worker node.
- Everything composes from cells: cells group into service groups and roll up into nodes. A node is a collection of cells plus the resources they own (workspaces, clean rooms, and their data), under one identity that can span clouds, regions, and disconnected sites.
- "Edge" is a location, and the Edge Agent is a tentacle: the same cell can run in the cloud, on-premises, or edge-racked at a sovereign site or on a device; that is a location, not a lesser build. The Edge Agent is a distinct thing: a small Rust tentacle that reads from and ingests to a cell without being one: it runs no lakehouse, catalog, or data placement of its own. Its default reach is intra-node (the cells of its own node) with cross-node and cross-organization reach made explicit rather than assumed.
- One product, two runtimes: the same contract is implemented by the cell and by the Edge Agent, and held to a single definition rather than allowed to drift.
Why the shape is the argument
The architecture is the differentiator, and the features prove it.
- It holds across the full matrix. Every capability is designed for single cell and multi-cell, cloud and air-gapped, not a corner of that grid. See Deployment topology.
- Sovereign operation is the default, not a SKU. A cell needs no vendor control plane, no external database licence, and no call home to start, license itself, or enforce policy.
- The edge is a first-class deployment. Intermittent, contested, and absent links are states the design plans for, not errors, down to running a full, self-sufficient edge-racked cell on-site, with an Edge Agent tentacle reaching the last mile beyond it.
How it fits together
Platform Architecture is the plane the other three topics stand on. Each cell carries all of them at once:
- Every cell runs the full Data Platform, catalog, engines, lakehouse, and object storage, locally.
- Agents are directory entities that compose across cells and run at the edge as well as the core.
- The Security plane, identity, classification, and the tamper-evident record, is enforced per cell and shared by every capability on it.
Work happens inside a workspace or a clean room, which is the surface this architecture exists to serve.
New to the platform? Start with what System9 is, or go straight to choosing a deployment.