Skip to content

Internal Systems Engineering

VaagaGraph Architecture

How VaagaGraph achieves sub-10ms cold boot times, O(1) append durability, and multi-writer consistency across ephemeral serverless runtimes.

Part I

Part I: Logical Architecture

Property graph data model, dual-adjacency index representation, traversal algorithm automata (BFS, Dijkstra, WCC, Dynamic Match Threshold scoring), and cryptographic tenant isolation models.

1. LOGICAL GRAPH ACTORS & QUERY INTERFACES VaakOps / VaakCMS Drivers GraphQL & Fluent Query DSL Tenant Security Context (RBAC) 2. IN-MEMORY GRAPH ALGORITHMIC ENGINE Dual-Adjacency Index Forward & Reverse Edges O(1) Out/In Degree Lookup Graph Algorithms BFS, Dijkstra & A* WCC Connected Components Dynamic Match Engine Semantic Weighted Matching Threshold Score Gating 3. LOGICAL PARTITIONING & CONSISTENCY AUTOMATA Cryptographic Tenant Namespaces Monotonic WAL Sequence Numbers Deterministic Conflict Resolution

Dual-Adjacency Graph Model

Nodes and directional edges are stored in RAM across dual adjacency sets. Finding incoming edges (transitive dependents) or outgoing edges (dependencies) is executed in exact O(1) time without full table scans.

Dynamic Match Threshold Scoring

Graph relationships evaluate contextual similarity vectors across properties. Matches exceeding dynamic score thresholds automatically link nodes into transitive clusters for real-time deduplication and blast-radius evaluation.

Part II

Part II: Technical Architecture & Physical Infrastructure

Physical Kubernetes pod sizing, stateless compute decoupling, dual protocol wire listeners (HTTP Port 4000 vs. TCP Wire Port 4001), S3/R2 ETag Optimistic Concurrency Control, and disaster recovery specifications.

1. MULTI-PROTOCOL INGRESS & NETWORKING PORTS HTTP/REST (Port 4000) Binary TCP Wire (Port 4001) Prometheus (Port 9090) 2. STATELESS COMPUTE TIER (1GB EKS PODS / LAMBDA / EDGES) Pod 1 (Primary Writer) Node 24 LTS (768MB) In-Memory Dual Index O(1) Append WAL Pod 2 (Read Replica) Async WAL Follower Sub-1ms Read Queries Horizontal HPA Scaling OCC & Compact Engine ETag If-Match Commit Background Compaction Zero Lock Contention 3. DURABLE OBJECT STORAGE TIER (AWS S3 / CLOUDFLARE R2 / MINIO) manifest.json ETag OCC Checkpoint Single Atomic Version wal/wal-*.log O(1) Append Only Logs CRC32 Checksummed snapshots/snapshot.json Compacted Baseline Sub-10ms Cold Boot

1GB Pod Envelopes & 85% Memory Governor

EKS pods run on Node.js 24 with --max-old-space-size=768 inside 1024MiB limits. A background memory governor triggers proactive garbage collection if heap allocation reaches 85%, eliminating container termination crashes.

Dual Protocol: HTTP (4000) & Binary Wire (4001)

Port 4000 serves JSON REST for web clients, Kubernetes health probes, and Prometheus scraping. Port 4001 runs VaagaWire, a zero-copy 12-byte header binary protocol delivering sub-2ms network round-trips for microservices.

ETag OCC Multi-Writer Coordination

Multiple stateless compute pods write concurrently against commodity object storage using HTTP If-Match headers. Conflicting writes receive HTTP 412, trigger an automatic state delta replay, and resolve without database table locks.

High Availability & Disaster Recovery

Write-Ahead-Logs persist directly to multi-AZ AWS S3 / Cloudflare R2 with 99.999999999% durability. RPO = 0 across all mutations. Cold boot replay from compacted snapshots recovers full in-memory indexes in under 200 milliseconds (RTO < 200ms).

5. Multi-Tenancy & Physical Storage Separation

Enterprise deployments demand strict multi-tenant isolation. VaagaGraph provides logical and physical database separation managed by the DatabaseCatalog:

  • Physical Directory Isolation: Every database is allocated its own directory (<dataDir>/databases/<db_name>/) containing dedicated WAL and snapshot partitions.
  • Zero Cross-Tenant Leakage: Graph adjacency maps, inverted indices, and Bloom filters are isolated per database.
  • Cold Backup Portability: Entire databases can be snapshotted, moved, or restored across physical environments using native filesystem commands (cp -r).
  • Per-Database Memory Quotas: Each database runs its own TieredLRUStorage (capped at 350MB) to preserve the 85% memory governor target on 1GB EKS pods.

6. Hardened Role-Based Access Control (RBAC)

Built strictly with Node.js built-ins (node:crypto) for zero supply-chain risk and maximum auditability:

  • Timing-Attack Immune: Token verification utilizes crypto.timingSafeEqual to prevent side-channel timing analysis.
  • Granular Role Scopes: admin (full cluster authority), readwrite (data ingestion and mutations), and readonly (queries and graph algorithms).
  • Database Access Whitelisting: API tokens can be restricted to specific database instances (e.g. allowedDatabases: ['tenant_finance']).
Experience the Architecture in the Live Demo →