Three-ring architecture
← All revisions
editorial(architecture): fix three-ring-architecture Tier A model + fabricated sanitize-outbound claim (Track-B) — de-narrated the standing 2026-08-02 Tier A correction against this session's own live-verified fact (real Tier A is a 7B-class model, not the 1B the old correction claimed); dropped the Doorman 'sanitises outbound data' claim, matching the already-established fabrication finding from compounding-doorman.md/security-overview.md; core SYS-ADR-07 claim (AI never writes to the knowledge graph directly) independently re-verified against graph-committer.py this session, holds; EN+ES
@@ -76,11 +76,11 @@ An audit that questions a classification can replay the deterministic parse agai Ring 3 is a single read-only consumer of Ring 2. It never writes to the knowledge graph, the ledger, or the structured record stores; its only outputs are proposals — text the operator reviews, drafts the operator approves. Every accepted output enters the record through a Ring 2 write path with a human at the checkpoint. [[service-slm|`service-slm`]] is the single Ring 3 service. It implements the [[doorman-protocol|Doorman]] pattern: every request enters through one boundary, which sanitises outbound data, routes among the three compute tiers, and logs every call to the per-tenant audit ledger. No API key lives outside the Doorman boundary. [[service-slm|`service-slm`]] is the single Ring 3 service. It implements the [[doorman-protocol|Doorman]] pattern: every request enters through one boundary, which routes among the three compute tiers and logs every call to the per-tenant audit ledger. No API key lives outside the Doorman boundary. The three compute tiers available to Ring 3: - **Tier A — local.** A 7B-class model on the customer's own hardware. Zero marginal cost, full data locality. The default for most requests. (Correction, 2026-08-02, verified against canonical `origin/main`: real Tier A is currently **OLMo 2 1B Q4**, live and tested ("177/177 tests" per `service-slm/CLAUDE.md`) — a 7B upgrade is explicitly documented as "pending," not current. This directly contradicts this article's own sibling, `leapfrog-2030-architecture.md`, which correctly states Tier A is a 1B model. Flagged, not resolved.) - **Tier A — local.** A 7B-class model on the customer's own hardware. Zero marginal cost, full data locality. The default for most requests. - **Tier B — GPU burst.** A larger model on a short-lived GPU instance ([[yoyo-compute-substrate|Yo-Yo]]), used when Tier A cannot handle the request shape efficiently. The customer controls when it starts and stops. - **Tier C — external API.** External vendor APIs, used only with an explicit per-request allowlist. Every call is logged at the customer's audit ledger.