Architecture Notes

System flow

How work moves through it

1. The browser sends authenticated prompt intent and modality choices to the Next.js application.
2. Server routes enforce Supabase session state and Stripe-backed capability checks.
3. FastAPI retrieves relevant prompt context from Pinecone before model generation.
4. Azure ML studies remain a separate evidence lane instead of being presented as live request processing.
5. The retained cloud delivery path built container images, stored them in ACR, and deployed them to Azure Container Apps.

Evidence boundary

What this diagram does not claim

• The Azure Container Apps runtime is historical because those resources were removed during CLI cleanup.
• Current public evidence does not yet include complete monitoring, rollback, or restore captures.
• Azure ML training and benchmark jobs are research infrastructure, not part of the production request path.

System flow

How work moves through it

1. Each benchmark gives the same task and acting model to both harnesses.
2. The ViperMesh lane favors parameterized addon tools over generating Blender Python from scratch.
3. Both lanes produce scenes, renders, command traces, timing, and token evidence.
4. Deterministic inspectors and a neutral LLM visual judge remain separate evaluation surfaces.
5. Observed ViperMesh failures feed Harneloop candidate work before a harness change is promoted.

Evidence boundary

What this diagram does not claim

• The wider ViperMesh studio and proprietary tools are private; the connector is public.
• The published token reduction is aggregate local acting-agent usage across seven benchmark runs, not provider billing.
• The current study covers seven comparable live render pairs and does not claim universal superiority on every Blender task.

System flow

How work moves through it

1. The harness unit stores task context, environment requirements, evaluators, and candidate history.
2. A real task attempt preserves the produced artifact as well as actions, traces, logs, and state transitions.
3. Failed output is traced to a tool, context, validator, retrieval, or environment decision.
4. A candidate is tested in isolation against the same evidence-bearing task.
5. The baseline changes only after the candidate passes the relevant improvement gate.

Evidence boundary

What this diagram does not claim

• Harneloop is a public alpha and is not described as an autonomous production optimizer.
• The strongest published application evidence currently comes from the ViperMesh Blender harness.
• Promotion quality depends on task-specific evaluators that can inspect the real artifact.

System flow

How work moves through it

1. Maintained community sources, handcrafted workflows, and specialized kits enter one normalization path.
2. Parsing requires complete n8n node and connection structures while preserving source and license context.
3. Archetypes and compatible node groups guide synthetic variation generation.
4. Deduplicated outputs are packaged differently for direct import and machine-learning use.
5. The corpus can ground an agent, but generated workflows still require credentials, schema checks, and operational review.

Evidence boundary

What this diagram does not claim

• The 97,000 node-swap variants are ML-oriented and are not all presented as production-ready imports.
• Corrective RAG did not improve the tested workflow-generation path and is not treated as the default architecture.
• Retrieval similarity cannot prove that a workflow is operationally correct for a specific environment.

System flow

How work moves through it

1. The original Terraform source remains unchanged while each run uses an isolated working copy.
2. Deterministic code identifies supported exposure paths and creates a controlled emulator target.
3. Self-hosted red and blue models are reached through a private SSH-tunneled vLLM endpoint.
4. Only a generated run-directory attack script executes through the constrained runner.
5. A deterministic patch is applied before the same attack path is replayed and reported.

Evidence boundary

What this diagram does not claim

• The AWS S3 LocalStack path is live-validated; the Azure Blob path has offline deterministic evidence only.
• The model improves reasoning and reporting but does not own the final security verdict.
• The alpha is not a production security control and does not attack real cloud accounts by default.

System flow

How work moves through it

1. n8n first ran directly on a Google Cloud VM before its state and configuration moved to Azure Files.
2. A fresh n8n image mounted the retained files after supporting database services were rebuilt.
3. Tailscale and Termius enabled private remote operation from a workstation or mobile device.
4. OpenClaw and n8n shared workflow data while PromptTriage UI and API used the same VNet-integrated Container Apps environment.
5. GitHub Actions used Entra OIDC to push images to ACR and create independent Container Apps revisions.
6. Cost and topology evidence was captured before teardown, followed by post-teardown inventory checks and lower-cost restore procedures.

Evidence boundary

What this diagram does not claim

• EUR 156.68 is the May 2026 pre-tax total for PersonalStuff and the Azure-managed environment group; it excludes EUR 3.97 in separate scheduled query rules.
• The historical EUR 1,175.21 screenshot is subscription-wide and is not used for platform attribution.
• Application secrets, database and file contents, old registry images, DNS-provider records, and completed certificate state remain outside the recovery boundary.

System flow

How work moves through it

1. Model services were adapted locally as Dockerized HTTP APIs before pull-request review.
2. Approved changes built images for ACR, where registry checks ran before managed-identity deployment.
3. Shape generation used a T4 lane while paint generation used an A100 lane.
4. Validation continued beyond endpoint success by loading generated assets into the ViperMesh product and browser 3D engine.
5. Alerting existed, but the cost result proved that scale-to-zero settings were not enough for GPU budget control.

Evidence boundary

What this diagram does not claim

• The pilot is archived and the GPU Container Apps are not presented as current infrastructure.
• EUR 676.67 is verified at the gpumodels resource-group scope from April through July 2026.
• Historical GPU utilization logs and some private-alpha output captures remain unavailable.

System flow

How work moves through it

1. Infrastructure and cluster configuration changes begin as reviewed repository changes.
2. Terraform formatting, validation, tests, IaC scans, and image scans run before a manually approved apply.
3. Terraform is intended for infrastructure and bootstrap concerns while Flux or Argo CD reconciles applications.
4. Tailscale, namespace isolation, RBAC, NetworkPolicies, policy-as-code, secrets, observability, and backups are first-class platform controls.
5. At least one real AI, data, or automation workload must run before the platform becomes a completed case study.

Evidence boundary

What this diagram does not claim

• This is a target architecture and has not been deployed.
• Node roles, storage, GitOps controller, secret manager, ingress model, and workload selection can change during implementation.
• The planned environment should not reuse Azure claims or resume bullets until equivalent controls are implemented and evidenced on-premises.