The system service
The system service is the spine of a cell. It holds the identities everyone
else authenticates against, the directory the estate is addressed through, the
licence that gates what the cell may run, and the orchestration that starts and
supervises every other service. It also carries three capabilities that reach
past the cell boundary: Knowledge and Model Serving for the AI platform,
and the edge-fleet control plane, Sensor Intake, and the radio / Tactical
Communications data plane for the intelligence platform.
Feeds: Platform Foundation · AI Platform · Intelligence Platform.
What it owns
- Identity and directory: the entity model for people, machines, and AI agents, and the directory in which nodes (not cells) are addressed.
- Licensing: offline, signed licence enforcement with nothing on the phone-home path.
- Setup: first-boot and cell bootstrap.
- Crypto provisioning: minting and delivering the cell's keys and certificates at provisioning time (the ongoing crypto lifecycle belongs to security).
- Orchestration: the supervisor that starts, restarts, and sequences the other eight services.
- Knowledge: the platform knowledge and semantics layer.
- Model Serving and Model Provisioning: hosting and standing up governed models.
- Edge-fleet control: the control plane the Edge Agent enrolls into, plus Fleet Releases for signed rollout.
- Sensor Intake: the ingest path for sensors and devices.
- Radio / Tactical Communications: the disruption-tolerant radio data plane.
Sub-modules (public names)
| Sub-module | What it does |
|---|---|
| Directory & entity model | People, agents, and devices in one directory; nodes survive cell replacement |
| Licensing | Offline signed licence checks on the enforcement path |
| Setup | Cell first-boot and provisioning |
| Crypto provisioning | Issues the cell's keys and certificates at provisioning time |
| Orchestration | Supervises and sequences the nine services |
| Knowledge | Knowledge and semantics layer; see Knowledge |
| Model Serving | Serves governed models; see Model serving |
| Model Provisioning | Stands up and provisions models for serving |
| Edge Agent (control plane) | Enrollment, delegation, and operational control for edge devices |
| Fleet Releases | Signed release rollout across a device fleet |
| Sensor Intake | Sensor and device ingest; see Intelligence |
| Radio | The radio data plane for contested links |
| Tactical Communications | Disruption-tolerant tactical comms over radio |
| Discovery & Mapping | Estate and asset discovery / mapping |
| Proactive Support | Health-driven proactive support signals |
APIs and surfaces
The system service is not externally exposed. Its HTTP and gRPC control
surfaces bind loopback (clear) and an internal mutual-TLS interface; external
clients reach anything the system service exposes only through the
node front door. Its one fabric-advertised surface is the
edge-fleet gRPC control plane, which carries a deliberately split
posture:
- a bootstrap-only clear channel that admits exactly device enrollment and certificate refresh, rejecting every other call as unauthenticated;
- a mutual-TLS operational channel that carries the full fleet surface, with per-device rate limiting applied after the device identity is verified.
See the Ports & protocols reference for the exact listeners.
Workers
Background workers under system cover orchestration reconciliation, licence
re-evaluation, directory maintenance, and fleet-control housekeeping. They run
per cell and require no coordinator, so a single-cell and an air-gapped cell
run the identical set.
Composition
Figure: the system service's capabilities, supervised by orchestration
(filled, core). Licensing is drawn verified/signed because it is enforced from a
signed offline licence; edge-fleet control is drawn outlined because it reaches
the edge. Ceiling: this shows the configured module
layout, not a live-derived call graph.
Table equivalent
| Capability | Role | Reaches beyond the cell? |
|---|---|---|
| Orchestration | Supervises the other eight services | No |
| Directory & entity model | One directory for people, agents, devices | Node identity spans cells |
| Licensing | Offline signed enforcement | No phone-home |
| Crypto provisioning | Mints cell keys/certs at provisioning | No |
| Knowledge / Model Serving | AI-platform capabilities | Serves cell workloads |
| Edge-fleet control / Fleet Releases | Enrollment, delegation, signed rollout | Yes: to edge devices |
| Sensor Intake | Sensor/device ingest | Yes: from the field |
| Radio / Tactical Communications | Contested-link data plane | Yes: over radio |
In the deployment matrix
system runs identically in every corner. Single-cell, the edge-fleet and radio
surfaces are present but idle. Multi-cell, node identity and the directory are the
level at which estate-wide answers roll up while cells beneath a node are
replaced freely. Sovereign / air-gapped, licence enforcement and crypto
provisioning work from signed material with no external call, and unreachable
fleet devices are modeled as absent edges rather than failures.
Related topics
- The estate hierarchy: organizations, nodes, and cells.
- Edge and fleet, the fleet this service controls.
- Model serving and Knowledge.
- Ports & protocols reference.