Architecture

This page is the canonical reference for OSA-Midnight Oil’s architecture.

Trust stack

The cockpit is structured as a layered trust stack:

┌──────────────────────────────────────┐
│ UI Shell           (Vite / Svelte)   │
├──────────────────────────────────────┤
│ Tauri 2 Bridge     (IPC)             │
├──────────────────────────────────────┤
│ Rust Core          ← trust boundary  │
├──────────────────────────────────────┤
│ Encrypted Vault    (at rest)         │
├──────────────────────────────────────┤
│ Local FS / Models  (device)          │
└──────────────────────────────────────┘

Each layer above the trust boundary is treated as untrusted. The UI shell can ask the Rust core to perform sensitive operations, but it cannot perform them itself. This is the central design choice that makes the security story literal rather than aspirational.

Runtime modes

Mode	Path	Purpose
Native desktop	Tauri 2	Primary distribution. Rust-owned trust boundary.
Web / beta	Vite	UI iteration and preview. Reduced trust posture.

Both modes share the same UI codebase. The native mode adds the Tauri bridge and the Rust core.

Encryption posture

• The master passphrase derives the vault encryption key
• The key is never stored — it is held in memory only during a session
• The vault file on disk is the only persisted state
• Decrypted state lives in process memory and is discarded on lock
• The shell uses standard, well-reviewed cryptographic primitives (specifics in the source repo’s security/ directory)

Local model integration

The cockpit communicates with local models through ROS-managed runtime adapters. Developer builds may expose an Ollama-compatible endpoint for inspection, but the normal product path is a model card and a Prepare model action. The model layer is treated as untrusted output — model responses are stored as memory entries, never executed as actions.

What is not in this architecture

• No cloud sync as a core dependency
• No telemetry by default
• No remote attestation
• No mandatory account or login outside the local master passphrase

These are decisions, not omissions.