The estate hierarchy
An System9 estate is built from one unit (the cell) composed under a small, fixed hierarchy. Four ideas do all the work, and the shape below is the whole of it: an Organization mints Nodes; a node aggregates Cells, optionally grouped into a Service Group; and where a full cell cannot run, an Edge Agent hangs off the node instead.
This page is the map. The cell model goes deeper on what is inside a cell; deployment topology covers how these units spread across regions, clouds, and the air gap.
The shape
Figure A1: the estate hierarchy. A filled box is a full-platform cell; the outlined box is the thin Edge Agent, which hangs off the node rather than sitting under a service group; the dashed enclosure is the service group, which is optional. This holds identically single-cell and multi-cell.
Table equivalent
| Unit | Parent | Glyph | An entity? | What it is |
|---|---|---|---|---|
| Organization | : (top boundary) | plain box | Yes | Mints nodes; owns users, agents, role assignments, and policy |
| Node | Organization | plain box | Yes | The system identity and roll-up view over a set of cells; survives cell replacement; can span locations |
| Service Group | Node | dashed (optional) enclosure | No | An optional grouping of cells: an erasure set, a replication group, or a workload boundary; every node has a default one |
| Cell | Service Group | filled solid rounded square | No | A whole-platform instance: its own databases, object store, services, and keys |
| Edge Agent | Node (delegated identity) | outlined, lighter | No (holds a delegated identity) | A small signed binary for the field, where a full cell cannot run |
The four ideas
A cell is a whole-platform instance
A cell is the unit of deployment: one process tree with its own databases, its own object store, its own service processes, and its own keys, the entire product, not a worker waiting on a coordinator. The same code runs whether the cell is a laptop dev box, a sovereign site, or a disconnected tactical node. See the cell model for what runs inside one.
Node identity survives cell replacement
A node is a logical construct: the cryptographic system identity that peers recognize, and the level at which estate-wide, rolled-up answers live. It is a collection of cells plus the resources they own, the workspaces, clean rooms, and data that live on those cells roll up to the node. Cells underneath a node can be rebuilt, replaced, or moved, and the node's identity is unchanged, the node is the face peers see, and it survives cell replacement. That is why the node, not the cell, is the entity in the directory, and why an operation's default reach is its own node (its own cells and their resources) with anything wider made explicit.
The service group is optional
A service group collects cells for a purpose, an erasure set, a replication group, or a workload boundary that can span availability zones, regions, and clouds. It is drawn dashed because it is optional: every node has a default service group, so the grouping is always present but is rarely something you set up by hand. You reach for an explicit service group when you need cells grouped for durability or workload, not to stand up an estate.
The Edge Agent hangs off the node
Where a full cell cannot run, a field device, a workstation, an IoT gateway, a tactical kit, an Edge Agent takes its place. It is a small, statically linked, signed binary that holds a delegated identity from a parent entity, and it attaches to the node, not to a service group, because it is a deployment of the estate rather than a cell within it. It is a tentacle, not a cell: it reads from and ingests to the node's cells and runs no lakehouse, catalog, or data placement of its own. Its default scope is intra-node, the cells of the node it hangs off, and cross-node or cross-organization reach is explicit, never assumed. The edge is a first-class deployment; see core and edge.
Cells and service groups are not entities
Two of these units are identities and two are physical groupings:
- Entities: Organization and Node. They hold keys, are addressed in the directory, and are what authority attaches to.
- Not entities: Service Group and Cell. A cell inherits its identity through the node it belongs to; a service group is a grouping, not a principal.
This rule holds throughout the platform, and it is why "which node?" is always a meaningful question and "which cell?" is an implementation detail.
Related topics
- The cell model, what is inside one cell.
- Deployment topology, how these units spread across the full single-cell/multi-cell, cloud/air-gapped matrix.
- Core and edge, the Edge Agent as a first-class runtime.
- The entity & identity model, the principals the organization and node belong to.