Skip to content

Architecture

Logical & Technical System Architecture

A comprehensive multi-cloud blueprint separating domain models, schema contracts, reactive orchestration fabric, data intelligence, deterministic NLP, and physical EKS/GKE cluster topology.

Part I: Logical Architecture

7-Tier Decoupled Domain Architecture & Contracts

Domain entities, message contracts, and quality feedback flow between functional tiers through strictly validated boundaries.

⇄ Scroll horizontally to inspect full architecture topology
TIER 1 TIER 2 TIER 3 TIER 4-5 TIER 6-7 🛍️ Vastra Platform 💍 Vaagai Platform 📜 BhumiClear ⚡ Veloctra Data Platform 120k+ rows/sec · PyArrow C++ · AEAD 🔍 Anvesh Vector Search 🕸️ VaagaGraph Engine ⚙️ VaakLoom Orchestrator 🤖 Tharior Remedai ⚙️ AxiomFlow 🛡️ Snapline ✍️ Vaakly NLP 📄 VaakCMS ⚑ VaakFlags ⚙️ VaakWorkflow 🚀 VaakOps

Layers

Tier-by-tier breakdown

Each tier communicates through well-defined protocols, creating clean separation of concerns.

TIER 1

Consumer & Domain Apps

🛍️ Vastra💍 Vaagai📜 BhumiClear

High-performance domain platforms solving real-world challenges across E-Commerce, Cultural Matchmaking, and Property Legal Title Clearance.

REST / Webhooks / CDC Streams
TIER 2

Agentic & Rule Orchestration Fabric

🕸️ VaakLoom⚙️ AxiomFlow🤖 Tharior

Reactive DAG engine, deterministic SOP rule graphs, and multi-agent autonomous remediation mesh with 10-tier LLM routing.

Bulk Streams / Vector & Graph Queries
TIER 3

Data Intelligence, Graph & Vector Search Mesh

⚡ Veloctra🔍 Anvesh🕸️ VaagaGraph

Zero-JVM streaming at 120k+ rows/sec with PyArrow C++, hybrid BM25+HNSW vector search, and distributed sharded graph database for 1GB EKS pods with dynamic match threshold querying.

Sanitized Text / Normalized Output
TIER 4

Deterministic Linguistic & NLP

✍️ Vaakly

Zero-hallucination offline grammar repair and vocabulary normalization using WordNet. Sub-2ms execution, zero cloud dependency.

Snapshot Diffs / Test Telemetry
TIER 5

Continuous Reconciliation & Testing Mesh

🛡️ Snapline📊 Snapline Hub

Declarative API↔DB↔Fixture comparison with data normalizers, structured JSON diffs, and live reporting dashboard.

OIDC / OAuth2 / M2M JWT
TIER 6

Identity Federation, Control Plane & Portals

🌐 VaagaTech Portal🔐 Cognito & M2M JWT📡 Multi-Cluster Hubs

Federated identity with OIDC/PKCE user auth and OAuth2 Client Credentials M2M mesh. Central marketing gateway and hub control planes.

GitOps / Canary Routing / State Orchestration
TIER 7

Continuous Delivery, Feature Flags & Autonomous DevOps

📄 VaakCMS⚑ VaakFlags⚙️ VaakWorkflow🚀 VaakOps

Hardened headless content intelligence, sub-millisecond feature flag evaluation, distributed state-machine workflows, and visual DAG multi-cloud DevOps with RemedAI synthesis.

Cross-Boundary Invariant Contracts

To prevent systemic failure modes across multi-tenant workloads, all seven tiers adhere to non-negotiable engineering invariants:

1. Zero-OOM Invariant

Every workload pod enforces strict cgroup memory caps (1.0 GiB - 2.0 GiB). Internal memory governors (MemoryGuard 75% RSS, gc.collect(2), bounded ring buffers) shed non-critical load before the kernel invokes OOMKilled.

2. Zero-JVM Overhead

The entire high-throughput streaming and search mesh (Veloctra, Anvesh, VaagaGraph) executes on native C++, PyArrow, Rust, or optimized Node/Python engines, eliminating JVM garbage collection pauses.

3. Strict Schema Validation

All inter-tier payloads are validated against strict JSON Schema, Protocol Buffers, or Pydantic contracts. Unrecognized or malformed payloads are immediately rejected at boundary ingress.

4. Cryptographic Tenant Isolation

Tenant contexts are strictly bound to AWS Cognito RS256 claims, mTLS SPIFFE identities, or AES-256-GCM AEAD encryption envelopes, prohibiting cross-tenant data exposure.

Part II: Technical Architecture

Multi-Cloud EKS/GKE Cluster Mesh & Disaster Recovery

Physical container topology, Istio mTLS service mesh, transit networking, strict pod resource envelopes, and cross-cloud disaster recovery.

⇄ Scroll horizontally to inspect full physical topology
Figure 2.1: VaagaTech Multi-Cloud Kubernetes Cluster Mesh (AWS EKS & GCP GKE) with Istio mTLS & Physical Network Mesh ACTIVE-ACTIVE MULTI-CLOUD HA
EDGE & GLOBAL INGRESS CloudFront & Fastly CDN • Global Anycast Edge • Static & SSR Caching • Port 443 / TLS 1.3 WAF & Rate Limiting • OWASP Core Rule Set • DDoS Shield Advanced • Token Bucket Throttling AWS Cognito & IAM M2M • OAuth2 / OIDC Discovery • RS256 JWT Verification • SPIFFE / SPIRE Identities Cross-Cloud Transit • AWS Transit Gateway • GCP Cloud Interconnect • Sub-5ms WireGuard Tunnel AWS EKS CLUSTER (PRIMARY) Veloctra Streaming Pods • Port 8000 (HTTP) / 9090 (Metrics) • 1.0 GiB RAM / MemoryGuard 75% • PyArrow C++ Zero-JVM (120k r/s) Anvesh Vector Search Pods • Port 7000 (HTTP/gRPC API) • 2.0 GiB RAM / Sub-0.5ms HNSW • 32-Query Semaphore / 85% Shed VaagaGraph Sharded Pods • Port 4000 (HTTP) / 4001 (VaagaWire) • 1.0 GiB RAM / Dual-Adjacency O(1) • Consistent Hash Sharding / R2 OCC VaakFlags & VaakWorkflow • Port 8080 (API) / 8081 (SSE Stream) • Sub-1ms Flag Rule Engine • Distributed FSM State Coordinator RemedAI & VaakDevOps • Port 4400 (DevOps) / 8000 (RemedAI) • KEDA Scale-to-Zero Worker Fleet GCP GKE CLUSTER (ACTIVE-ACTIVE) Veloctra Mirror Workers • Port 8000 / Realtime CDC Mirror • Active-Active Stream Processing • Cross-Cloud Checkpointing Anvesh Read-Replica Fleet • Port 7000 (Low-Latency Reads) • Realtime Embedding Re-indexing • Sub-1ms Geographic Queries VaagaGraph Sharded Mirror • Port 4000 (HTTP) / 4001 (VaagaWire) • Distributed Shard Read Nodes • GCS / S3 Bidirectional Sync VaakFlags Regional Nodes • Port 8080 (API) / 8081 (SSE Stream) • Regional Memory Mirror • Zero-Downtime Traffic Rerouting Snapline Hub & CI Mesh • Port 8080 (Reporting Engine) • Continuous Automated Verification STORAGE & PERSISTENCE MESH Redis 7 Active-Active Mesh • Port 6379 (mTLS / Cluster) • Cross-Region Pub/Sub Bus • Task Queues & Flag State • Sub-millisecond Cache Hits AWS DynamoDB (Vastra) • Single-Table Schema Design • Global Tables Multi-Region • Atomic Inventory Reservation • Sub-10ms Global Latency Object Storage (S3 / R2 / GCS) • Port 443 (TLS Encrypted) • Sharded Graph State Snapshots • Immutable Audit & Parquet Dumps • ETag Optimistic Concurrency MongoDB / PostgreSQL • Port 27017 (Mongo) / 5432 (PG) • Veloctra Catalog Metadata • Automatic Failover Replicas • Point-in-time WAL Archival

Ecosystem-Wide Physical Network Port Matrix & Firewall Boundaries

Service / Pod Port Protocol Ingress Source Egress Destination Security Boundary
veloctra-service 8000 / 9090 HTTP / gRPC Istio Ingress / Mesh Redis (6379), Mongo (27017) AES-256-GCM AEAD Encryption
anvesh-service 7000 / 9090 HTTP / gRPC Ecosystem Pods Persistent NVMe / S3 mTLS + Semaphore Rate Limiting
vaaga-graph 4000 / 4001 HTTP / VaagaWire TCP VaakOps, RemedAI, Apps S3 / Cloudflare R2 Custom Binary Framing + Token Auth
vaak-flags 8080 / 8081 HTTP / SSE Stream All Ecosystem SDKs Redis Pub/Sub (6379) Bearer Token / Tenant Secret
vaak-workflow 8080 / 9090 HTTP / REST VaakCMS, Apps Postgres (5432), Redis (6379) Quorum Signature Gates
vaak-devops (VaakOps) 4400 / 9090 HTTP / WebSocket DevOps Engineers / CI K8s API (6443), VaagaGraph OPA Rego Policy Enforcement
tharior-remedai 8000 / 8001 HTTP / WS / Local Web UI, Webhooks Anvesh (7000), OpenRouter (443) POSIX 0700 Sandbox Fences
vastra-platform 443 HTTPS CloudFront CDN DynamoDB, Paytm Gateways AWS WAF + Paytm HMAC-SHA256
snapline-hub 8080 / 9090 HTTP CI/CD Runners SQLite / PostgreSQL SSRF Guard + Path Traversal Filter

Pod Resource Envelopes & Strict Heap Governors

Workload Role Base Replicas Max Replicas CPU Limits Memory Limits Heap Governor / Memory Guard
veloctra-streaming 2 20 2000m 1.0 GiB MemoryGuard 75% RAM cap; disk spillover on burst
anvesh-search 3 15 4000m 2.0 GiB 85% Heap Load-Shedder; 32 concurrent query semaphore
vaaga-graph-shard 3 12 2000m 1.0 GiB Sub-1GB EKS envelope; LRU partition eviction to S3
vaak-flags-engine 2 10 1000m 512 MiB Zero dynamic allocations during flag rule evaluation
vaak-workflow-core 2 10 1000m 1.0 GiB 85% memory cap coordinator; proto-shield JSON bounds
remedai-worker 0 (KEDA) 50 2000m 1.0 GiB Scale-to-Zero; 3-gen GC (gc.collect(2)) at 75% RSS

Active-Active Multi-Cloud High Availability & Disaster Recovery (HA/DR)

System Layer Target RPO Target RTO Failover & Recovery Mechanism
Data Streaming (Veloctra) RPO = 0 RTO < 1s Bidirectional Kafka mirror with exact-once PyArrow checkpointing across AWS and GCP.
Vector & Graph (Anvesh / VaagaGraph) RPO = 0 RTO < 200ms S3/R2 dual-replicated partitions; any node failure automatically re-routes via Consistent Hash Ring.
Feature Flags & Rules (VaakFlags) RPO = 0 RTO = 0 (Instant) In-memory evaluated rule engine continues serving cached flag sets locally even during network isolation.
Autonomous Remediation (RemedAI) RPO = 0 RTO < 5s Quarantined incidents archived in Dead-Letter Queue (DLQ); KEDA dynamic worker launch on retry.
E-Commerce Consumer Tier (Vastra) RPO = 0 RTO < 3s CloudFront multi-region origin shield failover; DynamoDB Global Tables multi-region active-active.

Communication

Inter-service communication matrix

Each connection uses a purpose-chosen protocol matching the data's shape and latency requirements.

REST / JSON

Standard request/response for synchronous API calls. Used for workflow delegation between VaakLoom, AxiomFlow, and consumer apps.

  • VaakLoom → Vastra checkout flows
  • AxiomFlow → SOP rule evaluation
  • BhumiClear → Anvesh RAG queries
  • VaakWorkflow → Event-driven state machine transitions

CDC Streams & Embeddings

Change data capture and vector embedding pipelines for asynchronous, high-throughput data movement between tiers.

  • Veloctra CDC → Anvesh index refresh
  • Anvesh embeddings → Vaagai matching
  • VaakCMS → OCR token stream & Anvesh index
  • VaakOps → RemedAI synthesis & blast radius lineage

Want to understand how it all fits together?

We'll walk you through the architecture and how it maps to your needs.

Contact VaagaTech