Three-layer stack
The Three-Layer Stack is the infrastructure decomposition pattern used across PointSav deployments, separating raw computing capability, isolated platform execution, and secure operator access into three distinct layers.
The Three-Layer Stack is the foundational infrastructure pattern that decouples operational logic from physical hardware across PointSav deployments. The infrastructure layer provides raw computing capability — bare metal, cloud instances, or customer hardware. The platform layer runs isolated micro-kernels and services, applying capability-based security boundaries between components. The delivery layer provides secure terminal access so operators interact with the system without touching the underlying infrastructure directly. Each layer is independently replaceable, which means a customer can migrate from a cloud infrastructure layer to on-premises hardware without changing how the platform layer operates.
Key Takeaways
- Three distinct layers: Infrastructure (raw compute — bare metal, cloud, or customer hardware), Platform (isolated microkernel and service execution with capability-based security boundaries), Delivery (terminal and console interfaces operators interact with directly).
- Independent replaceability at each layer. Migrating from a cloud infrastructure to on-premises hardware does not require changes to the platform layer. The layers are decoupled by design, not by convention.
- No component at the platform layer can exceed explicitly granted capabilities. Isolation is enforced at the microkernel level, not by policy — a compromised service cannot elevate its own access.
- The delivery layer is the only layer operators touch directly. It forwards requests into the platform and returns results upward; operators never have direct access to infrastructure-layer primitives such as raw disk or network interfaces.
Overview
The three layers map directly to the operational concerns of a regulated SMB deployment:
- Infrastructure layer — the physical or virtual computing substrate: bare-metal servers, GCE instances, customer iMac hardware, or any combination. This layer supplies CPU time and memory. It makes no security guarantees above what the hardware provides.
- Platform layer — the operating system and service execution environment: ToteboxOS, capability managers, and the Ring 1/Ring 2 service processes. Isolation between components is enforced at this layer. No component at the platform layer can exceed the capabilities explicitly granted to it.
- Delivery layer — the terminal and console interfaces operators use: ConsoleOS terminals, the proofreader interface, and any browser-based access surface. The delivery layer is the only layer operators interact with directly; it forwards requests down into the platform and returns results upward.