Subsystem Map SS-01 to SS-08

ELI5

Rocky’s UI is one console with eight tenants on different floors. Six tenants moved in already furnished (lifted from devarno-cloud/rocky with a VTM Pass each); two are new construction. RALPH (SS-07) is a Python kitchen on a separate building tied in by a service hatch. HEARTH (SS-08) is a leasing office that signs new tenants up for the whole building.

Technical Deep Dive

The eight subsystems

ALGO is intentionally not a subsystem — project-specific modelling packages (e.g. @rocky/algo-devarno-finance) plug through SS-03 PLUGINS so adding a project does not add a subsystem.

Subsystem dependency graph

classDiagram
    class SS01_WORKBENCH
    class SS02_DASHBOARDS
    class SS03_PLUGINS {
        +seam for ALGO
    }
    class SS04_WORKSPACE {
        +object store
        +ralph-runs aggregator
    }
    class SS05_RELAY {
        +/api/relay/ralph
        +/api/relay/polar
    }
    class SS06_VAULT {
        +per-workspace creds
    }
    class SS07_RALPH {
        +Python ralph serve
        +console wrapper
    }
    class SS08_HEARTH {
        +Go binary
        +Driver protocol
    }
    SS02_DASHBOARDS --> SS04_WORKSPACE : ralph-runs panel reads
    SS07_RALPH --> SS04_WORKSPACE : artifacts to object store
    SS07_RALPH --> SS05_RELAY : deviation events
    SS08_HEARTH --> SS06_VAULT : driver creds
    SS08_HEARTH --> SS05_RELAY : provision events
    SS03_PLUGINS --> SS01_WORKBENCH : ALGO packages render here

Ownership of cross-cutting concerns

• Audit — every state change is mediated by SS-05 RELAY → HATCH event before the action takes effect (see rocky-003).
• Credentials — only SS-06 VAULT stores secrets. The console DB never holds a raw credential; SS-08 writes a secrets_vault_path pointer and reads through VAULT.
• Deployment metadata — SS-08 HEARTH owns DeploymentRef rows; Rocky never stores CAIRNET/LORE contents, only deployment metadata.

Key Terms

• VTM Pass → “verification, tests, manual” pass that the seven lifted subsystems already cleared in devarno-cloud/rocky
• Subsystem (SS-XX) → a self-contained slice of console functionality with its own routes, lib code, and integration tests
• Seam → the public API a subsystem exposes to peer subsystems (SS-03 PLUGINS’ seam is the registration interface for ALGO packages)
• Relay → routes that translate console events into HATCH audit writes

Q&A

Q: Which subsystems are new versus lifted? A: Six (SS-01..SS-06) are lifted from devarno-cloud/rocky with VTM Pass intact. SS-07 has a NEW console wrapper around the lifted Python tool. SS-08 HEARTH is fully new in Phase 5.

Q: Why is ALGO not its own subsystem? A: PETROVA governs one slug per submodule; project-specific modelling differs per consumer. Plugging ALGO packages through SS-03 PLUGINS keeps PETROVA’s verb count fixed and lets @rocky/algo-devarno-finance ship independently.

Q: Where do per-workspace HEARTH credentials land? A: SS-06 VAULT, keyed by workspace_slug. The DeploymentRef row stores secrets_vault_path only, never the secret itself.

Examples

An office building with eight floors. The lobby (console) routes you to the right floor. Floors 1–6 already had tenants when Rocky took ownership; floor 7 is a new lounge wrapping a kitchen across the street; floor 8 is a leasing office that decides who gets a workspace. The vault (SS-06) holds every tenant’s keys; the relay (SS-05) writes every door swipe to the building’s logbook (HATCH).