Territory & infrastructure

The Realm

The land under the institutions: cluster, gateway, identities, audit, treasury, perimeter. Boring on purpose, governed by construction.

The horizon — and today

The horizon

A substrate any sovereign could instantiate — on a remote cluster or a local machine — where founding a kingdom is configuration, adding a capability costs a decree, and the infrastructure is so unremarkable that no institution ever thinks about it. Multi-instance, provider-agnostic, reconstructible from its own recipe within an hour.

Today, verifiably

One Kubernetes cluster (Scaleway Kapsule asl-production, Paris, k8s 1.34, Cilium, two small nodes autoscaling 0–3), run for one sovereign. Roughly twenty services under Flux GitOps. One cloud, one region, one tenant. The template exists as a standing constraint and a recipe-in-progress — not as anything you could download.

source: INVENTORY.md · docs/CURRENT-STATE.md (cluster-reconciled 2026-06-11; security posture 2026-07-01)

The distance is large and stated on purpose: nothing on the left exists as a product. The right column is a working single-tenant estate whose one-hour reconstruction is designed, partially provisioned, and untested. The horizon earns belief only through the column on the right.

The idea

The Realm exists so that capability is cheap and safe to add: one identity border, one audit trail, one budget gate — and then every new agent, officer, or application inherits territory, law, memory, and government on day one. The infrastructure serves; it never leads. It is done enough precisely when the other institutions stop noticing it.

The road into the Realm — every request, one path

There is exactly one front door, and the law is enforced by the pipe, not by good intentions:

client / agent
   │  HTTPS
   ▼
Edge WAF          TLS termination · OWASP CRS, blocking mode · origin-locked LB behind it
   ▼
ingress-nginx     per-IP rate limits · 256 KB body cap · TLS everywhere
   ▼
agent-gateway     Auth0 bearer required · JSON-only · 60 req/min per identity
                  loads the agent's constitutional context · audits every call
                  checks the Treasury kill-switch before any model spend
   ▼
knowledge-mcp     reachable ONLY from the gateway (NetworkPolicy)
   ▼
Neo4j + Postgres  the graph (constitution, structure) and the notes (full-text)

How it is built

Change control

All change is git → pull request → Flux. CI builds images; CD is Flux only — no kubectl, no helm from pipelines. Branch protection with no bypass actors: "agents act only via PR" is technical fact, not convention. The admin kubeconfig is human break-glass, regenerated on demand.

Identity & onboarding

One Auth0 M2M identity per agent; its kingdom role rides in the token as a claim the gateway asserts — an agent cannot forge its rank. Tokens live one hour. Onboarding an agent is one script, no code, no deploy. Humans: OAuth + passkeys via the custom auth domain, no passwords.

Models

One model gateway (LiteLLM) routes every call; no agent holds a provider key. Anthropic live; EU-hosted Scaleway models proven on the Investment digest. Per-conversation, jurisdiction-labelled choice for the Sovereign's personal class is decreed and being wired.

Audit & Treasury

Every gateway call is audit-logged to object storage as append-only JSONL. The treasury daemon enforces a hard monthly LLM spend cap, fail-closed — when the treasury is unreachable, the models do not answer.

Secrets

In-cluster secrets are placed by External Secrets Operator from the cloud secret manager — never by hand, never in the repo. Operator credentials live outside the repo entirely, sourced on demand.

The exits

Anti-lock-in by seams: models behind one gateway, storage behind pointers, capabilities behind contracts, the whole estate reconstructible from git + a state export. Exit-enabled, not multi-cloud theatre.

The compromises

Stated here because a front door that oversells is worse than none. This ledger may grow freely; it shrinks only with evidence.

Compromise	The honest line
Identity config is imperative	The Auth0 tenant is clicked, not committed: identity-as-code was evaluated and rejected as riskier than the gap it closes — for now. Known, logged, owned.
The estate cannot yet rebuild itself	The constitution demands one-hour reconstruction. Designed, partially provisioned, untested — and untested recoveries don't count. Deferred by decree, not amnesia.
The cluster is over-provisioned	Roughly 5% of reserved CPU/memory is actually used; right-sizing is pending. The estate pays for headroom it has not yet earned.
The network floor is half-laid	Per-namespace isolation is verified for the knowledge and agent planes; the remaining policies were paused by the Sovereign's own call after the console broke twice on them — marginal hardening judged not worth the risk to the login path. A decision, on the record.
Cost dashboard deferred	Per-call cost lives in logs and the treasury state, not on a wall. Built when the officer count justifies it — capability before ceremony.
One cloud, one region	EU-hosted, single provider. The exit is a recipe and an export path, not a second cloud on standby.

A kingdom you could found

A standing architectural constraint — not a promise — rules that a second kingdom must be configuration, never a rewrite: engine, constitution-template, and sovereign content kept separable; a renamable Prime Minister; an independent Auditor that can never be folded into the government it audits. The same machinery, a different charter, an empty archive, your law. Under test at design level; stated here so the claim can be held against us.

Enter the Consoleoperate the Realm: agents, models, spend, audit