Technical Specifications, Add-ons & Kernel Architecture

Authoritative Invariants 5.A – 5.J

1. Tri-Boundary Demarcation

SYSTEM_INVARIANT

Strict mathematical identity separation: organization_id (Tenant) ≠ installation_id (Deployment) ≠ node_id (Compute Node). Prevents cross-tenant data leakage across PostgreSQL tables, Qdrant vectors, and ReAct contexts.

┌────────────────────────────────────────────────────────┐ │ MATHEMATICAL IDENTITY DEMARCATION │ ├────────────────────────────────────────────────────────┤ │ organization_id (Tenant Boundary / RDBMS & Vectors) │ │ ≠ installation_id (Air-Gapped Deployment UUID) │ │ ≠ node_id (Execution Compute Socket / IP) │ └────────────────────────────────────────────────────────┘

2. Two-Phase Hybrid ReAct Loop

AI_INVARIANT

Phase 1 (Bounded Tool Execution with fast_model <= 256 tokens and JSON Schema validation) strictly separated from Phase 2 (Clean Streaming Synthesis) with zero JSON leakage in the final client stream.

[PROMPT] ──► [PHASE 1: Tool Selection (think: false, fast_model)] │ ├──► Schema Validation (Draft 2020-12) └──► PolicyEngine Authorization (4-Gate) │ ▼ [SYNTHESIS] ◄── [PHASE 2: Clean Natural Stream (Zero JSON Leaks)]

3. Pure Qdrant REST Engine (:6333)

DATA_INVARIANT

Deprecation of legacy relational vector queries. Pure Qdrant REST with Int8 Scalar Quantization, UTF-8 character chunking (mb_strlen), and Zero-LLM Fast Path for FAQs matching Cosine Distance <= 0.15 in under 100ms.

User Query ──► nomic-embed-text (768d) ──► Qdrant REST (:6333) │ ├──► Cosine Dist <= 0.15 AND doc_type == 'faq' │ └──► [FAST PATH: Direct Hit < 100ms] │ └──► Deep RAG: mb_strlen 512 chunks + 60 overlap

4. Ed25519 Cryptography & C Zend Extension

SECURITY_INVARIANT

Asymmetric Ed25519 signature verification (Libsodium) for Air-Gapped nodes. Core intellectual property protection via the native C Zend extension helios_guard.so with ChaCha20-Poly1305 in-RAM decryption.

Encrypted PHP File (.php) ──► zend_compile_file() Hook │ ▼ [helios_guard.so] ──► ChaCha20-Poly1305 Decrypt in RAM │ ▼ OPcache Bytecode Memory ──► Zero Plain-Text on Physical Disk!

5. Redis Atomic Mutex Semaphores

CONCURRENCY

Daemon and worker concurrency management using SET key 1 NX EX ttl. Complete elimination of HTTP 504 Timeouts via the asynchronous worker polling pattern (1.5s interval).

Client Web Request ──► Spawns Async CLI Worker (php spark helios:*) │ (session_write_close() avoids session locks) ▼ Redis Atomic Mutex: "helios:{domain}:{category}:{orgId}:{id}" Redis Key Polling : 1.5s interval ──► Zero HTTP 504 Timeouts!

6. Runtime Profiles & Topologies

FLEET_CONVERGENCE

Full support for Standalone, Control Plane, and Node profiles across Connected, Semi-Isolated, and 100% Offline Air-Gapped topologies with 100% pull-based outbound heartbeats.

CONTROL PLANE ◄────────── Pull-Based Polling ────────── NODES (Global Release Hub) (IPv4 CURL_IPRESOLVE_V4) (Zero Inbound Ports) │ ├──► CONNECTED : Real-time telemetry & OTA Symlinks ├──► SEMI-ISOLATED: Scheduled VPC synchronization └──► AIR-GAPPED : Detached Ed25519 bundles (.helios-bundle)

4-Gate Restrictive Security Chain

Κάθε ενέργεια στο σύστημα (UI views, API endpoints, AI tool execution) υπολογίζεται μέσω της αυστηρής μαθηματικής συνάρτησης τομής 4 πυλών:

Effective Access = Gate_0 (Shield) ∧ Gate_1 (License) ∧ Gate_2 (Tenant Role) ∧ Gate_3 (Profile Tool)