Architecture

KDCube Architecture

Platform Your app Infrastructure Experience Request / data Async / pub-sub Deploy / control Governed path Planned + Drill down Governance gate Reflects kdcube-ai-app main docs · 2 Jul 2026

KDCube architecture

An interactive explorer needs JavaScript. Here is the static component map — open the documentation hub for full detail. Components marked [gate] are governance checkpoints.

Your app & SDK — You build this; it exposes the experiences below

App package — One unit: code + surfaces + config
- Chat handler — @on_reactive_event
- REST operations — @api · operations & public
- MCP server — @mcp
- UI widgets — @ui_widget · @ui_main
- Scheduled scans — @cron
- Job executor — @on_job
- Data Bus handler — @data_bus_handler
Tools — What agents can do [gate: tool & namespace policy]
Skills — Instructions, not tools
User memory — Durable, cross-conversation
Named services — Apps as domain providers
Solutions — Prebuilt building blocks
Economics & accounting SDK — Every call attributed

Experiences & clients — What your apps expose; how people and agents reach them

Chat web app — Streaming chat client
Widgets & Mini Apps — Embedded iframe surfaces
Full app UI — App-owned frontend
MCP clients — Agents & IDEs as consumers
API & webhook callers — Server-to-server traffic
Channel integrations — Telegram · email · LinkedIn
- Telegram — Bots · Mini Apps
- Email — Send · receive · escalate
- LinkedIn — Posting · commenting
- Messaging providers — Slack · Teams · WhatsApp (planned)
Payments & subscriptions — Stripe · wallets · plans
Enterprise & SaaS connections — OIDC / SSO · cloud & SaaS APIs (planned)

Governance gates — Every call crosses these: auth, admission, RBAC, budgets, scanning

Identity & sessions — Cognito / OIDC · delegated auth [gate: authentication]
Admission control — Rate limits · backpressure [gate: admission & rate limits]
Uploads & hosted files — Attachments · ClamAV scan [gate: antivirus scan]
Economics enforcement — Plans · budgets · billing APIs [gate: budget enforcement]
RBAC & surface auth — Roles · user types · grants [gate: RBAC & grants]

Edge & ingress — Transport termination, streaming, event inception

Web proxy / auth gate — Edge routing, masked cookies
Chat ingress & gateway — Streaming · events · enqueue
- SSE & Socket.IO termination — Streaming to the browser
- Event inception — Messages · followup · steer
Metrics service — One scrape endpoint

Processing & agents — Workers, the ReAct runtime, Claude Code

Chat processor — Claims work · runs apps
- App loader & registry — Descriptor-driven · hot reload
- Integrations REST — App operation routes
- Data Bus workers — Retry · results · DLQ
- Scheduler — Cron reconciliation
- Long-run protection — Turns survive deploys
ReAct runtime — Timeline-first agent loop
- Timeline & context — The agent’s durable memory
- ANNOUNCE — Per-round volatile state
- followup & steer — Talk to a running turn
- Turn workspace — Files the agent works in
- Sources pool & citations — Provenance for every claim
- Compaction & summaries — Long conversations stay sharp
- Budgets & recovery — Bounded, resumable turns
- Micro-agents & subagents — Fan-out within a turn
Claude Code runtime — Coding agent as an app

Runtime & isolation — Redis fabric: queues, lanes, streams · sandboxes for untrusted code

Ready & inflight queues — Per-user-type work lanes
Conversation event lanes — Ordered per-conversation events
Chat relay pub/sub — Proc → ingress event routing
Data Bus streams — Durable non-chat messages
Job streams & cron locks — Background work coordination
In-process — Trusted lightweight tools
Subprocess & @venv — Crash containment · deps
Docker ISO runtime — py-code-exec sandbox [gate: isolation boundary]
- Supervisor — Networked · brokers tools
- Executor — No network · read-only rootfs
Distributed exec — Fargate task per execution

Cloud & infrastructure — Storage, models, delivery, deployment

PostgreSQL + pgvector — State · vectors · economics
Redis / ElastiCache — The fabric’s substrate
Object storage — S3 / EFS · artifacts & files
Secrets broker — Isolated secrets service
ClamAV — Upload scanning
LLM & search providers — Models · embeddings · web
Metered APIs & services — Paid third-party services (planned)
Control plane — Descriptors + kdcube CLI
- Descriptors — The deployment contract
- kdcube CLI — init · start · reload
Deployment targets — Compose · ECS · Kubernetes
Observability — Health · metrics · OPEX

Examples — Really-implemented apps on this map

This website (landing scene) [live] — kdcube.tech composes live widgets from two KDCube runtimes via kdcube.config.json.
versatile — reference app [oss] — The open-source reference bundle that also powers this site's chat: chat + widgets + files + canvas on ReAct v2.
Task Tracker — scene component app [live] — Widgets, Data Bus mutations, and namespace-provided task objects on this landing page.
Docs knowledge MCP — backend-only app [live] — The KDCube docs knowledge base served as a governed MCP tool surface.
Stats & news providers — view apps [live] — Provider apps publishing live view widgets over project-scoped SSE.

Changelog — Recent platform changes

See the full changelog.

2026-06 (in flight) — Direct delegated auth cookies
2026-06-11 (2026.6.11.415) — Pin Board, scene composition, economics enforcement, true cost breakdown
2026-06-06 (2026.6.6.342) — Bundle Data Bus runtime, scoped communication, memsearch refinements
2026-06-05 (2026.6.5.342) — External-event timeline protocol, hybrid memsearch, turn cost persistence
2026-05-29 (2026.5.29.1534) — CLI config descriptor import/export
2026-05-28 (2026.5.28.210) — Turn navigation + per-turn cost in the status line
2026-05-27 (2026.5.27) — Embedding guide, storage control plane, public anonymous access
2026-05-26 (2026.5.26) — Frame View Contract + LinkedIn commenting
2026-05-24 (2026.5.24.420) — Comm event sinks + project SSE fanout
2026-05-23 (2026.5.23.1825) — Async-only secrets, LinkedIn SDK, widget auto-rebuild
2026-05-23 (2026.5.23.312) — versatile app UX overhaul
2026-05-17 (2026.5.17.452) — User memory, bundle-scoped service keys, embedded control plane