SATURN ARCHITECTURE

Clear authority.
Private execution.

A development architecture for user-owned hardware. All products remain in active development and are not generally available.

The canonical runtime path.

Clients address Saturn-Control only. Control governs desired state and authority; execution crosses a narrow Container Runner boundary before an authenticated workload requests private inference.

CLIENTS
Saturn One / Saturn Container
Applications communicate with Saturn-Control.
AUTHORITY
Saturn-Control
Identity, policy, desired state, operations, and audit; it does not run inference.
EXECUTION BOUNDARY
Container Runner
A narrow internal adapter receives typed, validated lifecycle commands from Saturn-Control.
MANAGED WORKLOAD
managed agent container
The authenticated workload requests private inference.
PRIVATE INFERENCE
Saturn-Node
Private service for authenticated workloads; it is not publicly reachable.
RUNTIME
saturn-mlx-mesh / MLX
In-process inference library and MLX runtime.
COMMUNICATION SCHEME

Transport and authority stay distinct.

The same canonical path can be read as two separate concerns: the transport path used by clients and workloads, and the authority provenance that makes protected operations verifiable. Authority provenance is conceptual; it is not a direct Saturn-Control-to-Node client transport.

CLIENT TRANSPORT
Clients → Saturn-Control
Apple applications address Control only. They do not receive Runner or Saturn-Node endpoints or workload-compute credentials.
TYPED EXECUTION
Saturn-Control → Container Runner → workload
Control issues validated desired-state operations to the narrow Runner boundary, which reconciles the managed agent container.
PRIVATE COMPUTE TRANSPORT
Workload → Saturn-Node → saturn-mlx-mesh / MLX
The workload presents scoped compute authority when it calls the private Node; Node validates that authority before model work.
CLIENT → CONTROL
Clients address Control only
Apple applications never open a direct channel to a Runner, managed workload, or Saturn-Node and never receive workload-compute credentials.
AUTHORITY PROVENANCE
Conceptual, not a transport edge
Saturn-Control is responsible for assignment and bounded authority. The workload presents applicable compute authority to Saturn-Node; the website does not imply a direct Control-to-Node client channel.
AGENT → NODE
Private, scoped request
The managed workload calls Saturn-Node with workload-scoped authentication. Node is not publicly reachable and does not poll Control as the product architecture.
FAIL-CLOSED REQUIREMENT
Invalid authority must be denied
Expired, mismatched, replayed, revoked, or unverifiable authority must be rejected at the final enforcement point. A policy allow decision is not authentication or sandboxing by itself.
BOUNDARIES

Responsibilities stay separated.

CLIENTS
Address Control only
Apple applications do not connect directly to Container Runners, managed workloads, or Saturn-Node. They never receive workload-compute credentials.
CONTROL
Authority, not inference
Saturn-Control owns identity, policy, desired state, operations, and audit. It does not run inference.
RUNNER
Narrow execution adapter
The Container Runner accepts typed, validated commands from Saturn-Control and does not expose a public API or inference surface.
WORKLOAD
Calls private inference
Managed workloads call Saturn-Node with workload-scoped authentication. Node does not poll Control as the product architecture.
NODE
Private service
Saturn-Node is not publicly reachable. Secure composition, credentials, transport, and MLX integration remain under development.
CONTAINER
Remote-only operator
Saturn Container operates managed agent containers through Saturn-Control. It is not a local CLI frontend.
NUTRITION
Separate local path
NutriSelf defaults to a standalone local-first MVP. Managed Saturn execution is not a startup dependency.
CURRENT STATE

Contracts first, evidence before claims.

Contracts and required CI exist for Saturn-Control. Deterministic fake-Control and staging behavior, secure Node composition, private transport, the Node adapter, and reproducible Apple Silicon acceptance are still being developed and verified.

EvoIntelligenceFabric names the long-term coordinated architecture. It does not imply current public availability.