Kyle Isom
eab7e807e4
- All services now have version tags (v1.0.0 for mature, v0.1.0 for early) - Metacrypt promoted from Testing to Production - MCP status updated from "Not started" to Active dev (Phases 0-4) - MCDeploy added as tactical deployment CLI - Rift port map updated with mcns-coredns (53) and exod (8080/9090) - mcdeploy.toml added for deployment configuration - .gitignore updated for mcp/ and mcdeploy/ project directories Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
151 lines
6.1 KiB
Markdown
151 lines
6.1 KiB
Markdown
# Metacircular Platform Status
|
||
|
||
Last updated: 2026-03-26
|
||
|
||
## Platform Overview
|
||
|
||
One node operational (**rift**), running core infrastructure services as
|
||
containers fronted by MC-Proxy. MCIAS runs separately (not on rift).
|
||
Bootstrap phases 0–4 complete (MCIAS, Metacrypt, MC-Proxy, MCR all
|
||
operational). MCP is in active development; full MCNS is not yet built.
|
||
|
||
## Service Status
|
||
|
||
| Service | Version | SDLC Phase | Deployed | Node |
|
||
|---------|---------|------------|----------|------|
|
||
| MCIAS | v1.7.0 | Maintenance | Yes | (separate) |
|
||
| Metacrypt | v1.0.0 | Production | Yes | rift |
|
||
| MC-Proxy | v1.0.0 | Maintenance | Yes | rift |
|
||
| MCR | v1.0.0 | Production | Yes | rift |
|
||
| MCAT | v1.0.0 | Complete | Unknown | — |
|
||
| MCDSL | v1.0.0 | Stable | N/A (library) | — |
|
||
| MCNS | v0.1.0 | Precursor | Yes | rift |
|
||
| MCP | v0.1.0 | Active dev | No | — |
|
||
| MCDeploy | v0.1.0 | Active dev | N/A (CLI tool) | — |
|
||
|
||
## Service Details
|
||
|
||
### MCIAS — Identity and Access Service
|
||
|
||
- **Version:** v1.7.0 (client library: clients/go/v0.1.0)
|
||
- **Phase:** Maintenance. Phases 0-14 complete. Feature-complete with active
|
||
refinement.
|
||
- **Deployment:** Running in production. All other services authenticate
|
||
against it.
|
||
- **Recent work:** WebAuthn/FIDO2 passkeys, TOTP 2FA, service-context login
|
||
policies, Nix flake for CLI tools.
|
||
- **Artifacts:** systemd units (service + backup timer), install script,
|
||
Dockerfile, example configs.
|
||
|
||
### Metacrypt — Cryptographic Service Engine
|
||
|
||
- **Version:** v1.0.0.
|
||
- **Phase:** Production. All four engine types implemented (CA, SSH CA, transit,
|
||
user-to-user). Active work on integration test coverage.
|
||
- **Deployment:** Running on rift as a container, fronted by MC-Proxy on
|
||
ports 443 (web, L7), 8443 (API, L4), and 9443 (gRPC, L4).
|
||
- **Recent work:** ACME integration tests (60+ tests), mcdsl migration,
|
||
security audit fixes.
|
||
- **Artifacts:** systemd units (service + web + backup timer), Docker Compose
|
||
(standard + rift), install script, example configs.
|
||
|
||
### MC-Proxy — TLS Proxy and Router
|
||
|
||
- **Version:** v1.0.0. Phases 1-8 complete.
|
||
- **Phase:** Maintenance. Stable and actively routing traffic on rift.
|
||
- **Deployment:** Running on rift. Fronts Metacrypt, MCR, and sgard on ports
|
||
443, 8443, and 9443. Prometheus metrics on 127.0.0.1:9091.
|
||
- **Recent work:** MCR route additions, Nix flake, L7 backend cert handling,
|
||
Prometheus metrics, L7 policies.
|
||
- **Artifacts:** systemd units (service + backup timer), Docker Compose
|
||
(standard + rift), install and backup scripts, rift config.
|
||
|
||
### MCR — Container Registry
|
||
|
||
- **Version:** v1.0.0. All implementation phases complete.
|
||
- **Phase:** Production. Deployed on rift, serving container images.
|
||
- **Deployment:** Running on rift as two containers (mcr API + mcr-web),
|
||
fronted by MC-Proxy on ports 443 (web, L7), 8443 (API, L4), and
|
||
9443 (gRPC, L4). Metacrypt is already pulling images from MCR.
|
||
- **Recent work:** Manifest push bug fix (LastInsertId unreliable after
|
||
upsert), structured slog error logging in OCI handlers, first production
|
||
deploy, Dockerfile fixes, server wiring, OCI route mounting.
|
||
- **Artifacts:** systemd units (service + web + backup timer), Dockerfiles
|
||
(API + web), Docker Compose (rift), install script, rift config.
|
||
|
||
### MCAT — Login Policy Tester
|
||
|
||
- **Version:** v1.0.0.
|
||
- **Phase:** Complete. Diagnostic tool, not core infrastructure.
|
||
- **Deployment:** Available for ad-hoc use. Lightweight tool for testing
|
||
MCIAS login policy rules.
|
||
- **Recent work:** Migrated to mcdsl for auth, config, CSRF, and web.
|
||
- **Artifacts:** systemd unit, install script, example config.
|
||
|
||
### MCDSL — Standard Library
|
||
|
||
- **Version:** v1.0.0.
|
||
- **Phase:** Stable. All 9 packages implemented and tested (87 tests). Being
|
||
adopted across the platform.
|
||
- **Deployment:** N/A (Go library, imported by other services).
|
||
- **Packages:** auth, db, config, httpserver, grpcserver, csrf, web, health,
|
||
archive.
|
||
- **Adoption:** mcat, mc-proxy, and mcr migrated. metacrypt and mcias
|
||
pending.
|
||
|
||
### MCNS — Networking Service
|
||
|
||
- **Version:** v0.1.0.
|
||
- **Phase:** Precursor. CoreDNS instance serving internal zones until the
|
||
full MCNS service is built.
|
||
- **Deployment:** Running on rift via Docker Compose. Serves two zones:
|
||
`mcp.metacircular.net` (node addresses) and
|
||
`svc.mcp.metacircular.net` (service addresses).
|
||
- **Records:** rift node, metacrypt, mcr, sgard services.
|
||
- **Artifacts:** Corefile, zone files, Docker Compose (rift).
|
||
|
||
### MCP — Control Plane
|
||
|
||
- **Version:** v0.1.0.
|
||
- **Phase:** Active development. Phase 0 (scaffolding) and Phase 1 (core
|
||
libraries) complete. Phase 2 (agent) and Phase 3 (CLI) underway — P2.1
|
||
and P3.1 done.
|
||
- **Deployment:** Not yet deployed.
|
||
- **Architecture:** Two components — `mcp` CLI (thin client) and `mcp-agent`
|
||
(per-node daemon with SQLite, podman management). gRPC-only (no REST).
|
||
- **Recent work:** Core libraries (registry, runtime, servicedef, config,
|
||
auth), agent skeleton, CLI skeleton with command stubs.
|
||
- **Artifacts:** Design docs (`PROJECT_PLAN_V1.md`, `PROGRESS_V1.md`,
|
||
`DESIGN_AUDIT.md`).
|
||
|
||
### MCDeploy — Deployment CLI
|
||
|
||
- **Version:** v0.1.0.
|
||
- **Phase:** Active development. Tactical bridge tool for deploying services
|
||
while MCP is being built.
|
||
- **Deployment:** N/A (local CLI tool, not a server).
|
||
- **Recent work:** Initial implementation, Nix flake.
|
||
- **Description:** Single-binary CLI that shells out to podman/ssh/scp/git
|
||
for build, push, deploy, cert renewal, and status. TOML-configured.
|
||
|
||
## Node Inventory
|
||
|
||
| Node | Address (LAN) | Address (Tailscale) | Role |
|
||
|------|---------------|---------------------|------|
|
||
| rift | 192.168.88.181 | 100.95.252.120 | Infrastructure services |
|
||
|
||
## Rift Port Map
|
||
|
||
| Port | Protocol | Services |
|
||
|------|----------|----------|
|
||
| 53 | DNS (LAN + Tailscale) | mcns-coredns |
|
||
| 443 | L7 (TLS termination) | metacrypt-web, mcr-web |
|
||
| 8080 | HTTP (all interfaces) | exod |
|
||
| 8443 | L4 (SNI passthrough) | metacrypt API, mcr API |
|
||
| 9090 | HTTP (all interfaces) | exod |
|
||
| 9443 | L4 (SNI passthrough) | metacrypt gRPC, mcr gRPC, sgard |
|
||
| 9091 | HTTP (loopback) | MC-Proxy Prometheus metrics |
|
||
|
||
Non-platform services also running on rift: **exod** (ports 8080/9090),
|
||
**sgardd** (port 19473, fronted by MC-Proxy on 9443).
|