Skip to content

PointSav Documentation

The engineering library for the PointSav platform — operating systems and services for regulated businesses that own their data, their AI, and their record-keeping outright. Where the monorepo holds the code, this wiki holds the reasoning: architecture, services, security, and the governance commitments that bind future development.

PointSav Digital Systems

Revision as of · 056ab965

Historical revision — this record as it stood on 5 September 2026, not the current version. View the current record →

OS mediakit

os-mediakit is the guest operating system image for the vm-mediakit VM tier in the PointSav Private Network hypervisor layer. It isolates the MediaKit service surface — knowledge wikis, marketing sites, and compliance/distribution feeds — from the source vault and orchestration tiers.

OS / app boundary

os-mediakit (the operating system) and app-mediakit-* (the applications it hosts) have a fixed division of responsibility, ratified as part of the OS family's tier definitions.

os-mediakit provides: TLS termination (nginx and certbot), systemd unit lifecycle, the per-tenant filesystem layout, log rotation with forwarding into the WORM ledger, MBA pairing to the fleet gateway, Doorman client TLS bootstrap, rate limiting, and static asset serving.

app-mediakit-* provides: domain logic — page rendering, search, payment verification, taxonomy queries, the editorial UI, wiki wikilink resolution, and license issuance. Each app-mediakit-* binary is a tenant of the OS, not part of it.

Deployments and data flow

Every app-mediakit-* instance reaches Totebox data through the fleet gateway only — media-* → outbound MBA → gateway-orchestration-command-1 → Doorman audit → cluster-totebox-*. No app-mediakit-* process reads Totebox storage directly; the gateway is the only crossing point, and every read is recorded to the audit ledger on its way through.

Instance Binary Surface Status
media-knowledge-documentation-1 app-mediakit-knowledge documentation.pointsav.com Live
media-knowledge-projects-1 app-mediakit-knowledge projects.woodfinegroup.com Live
media-marketing-landing-1 app-mediakit-marketing home.woodfinegroup.com Live
media-marketing-landing-2 app-mediakit-marketing home.pointsav.com Live
media-intranet-1 nginx (no app binary) VPN-only internal preview of the above Live, WireGuard-gated
media-knowledge-corporate-1 app-mediakit-knowledge corporate.woodfinegroup.com Not yet deployed
media-distribution-* app-mediakit-distribution Compliance/press-release feed Not yet deployed

Two things worth stating plainly rather than smoothing over. First, the fleet-gateway MBA pairing this data-flow model depends on is not yet wired for any media-* instance today — each one currently reaches its content locally rather than through the gateway, a known, tracked gap. Second, software.pointsav.com — sometimes associated with app-mediakit-distribution in early planning — is in practice served by the separate app-privategit-marketplace/app-privategit-source binaries; no app-mediakit-distribution instance is deployed there today.

Stack position

The four-layer Totebox stack places os-mediakit in the Hypervisor layer:

Operator
  ↓
PPN (WireGuard mesh, os-network-admin control plane)
  ↓
Hypervisor layer  ←— os-mediakit guest OS runs here
  ↓
Totebox Orchestration (app-mediakit-*, service-fs, system-core)

os-mediakit is one guest among three in the three-VM layout:

VM Guest OS Tier
vm-workspace host OS (Linux) os-privategit (permanent host)
vm-intelligence os-intelligence (planned) os-totebox + inference
vm-mediakit os-mediakit os-mediakit

The host — foundry-workspace GCP VM — runs QEMU to manage all guests. The hypervisor itself is os-infrastructure (the Genesis Protocol boot layer).

Phase 1: Ubuntu 24.04 interim (present)

The first deployment of vm-mediakit uses an Ubuntu 24.04 server cloud x86_64 QCOW2 as the guest OS. This is the production interim while the per-instance seL4 VMs are developed.

Ubuntu 24.04 is required — not Debian 12 — because all service binaries compiled on the GCP host (Ubuntu 24.04, glibc 2.39) link against GLIBC_2.39 symbols. Debian 12 provides only glibc 2.36 and would fail to execute the binaries at load time.

What is running today:

  • Ubuntu 24.04 booted under QEMU/TCG (this host has no hardware KVM; TCG is adequate for Phase 1 testing)
  • 6 GiB RAM (-m 6144), 20 GB QCOW2 disk
  • User-mode NAT networking: the host forwards a dedicated local port to each guest service
  • virtio-balloon device: dynamic RAM adjustment without guest reboot
  • cloud-init first boot: hostname vm-mediakit, user foundry, systemd-native
  • nginx/1.24.0 and build-essential installed post-boot

Services running inside the Ubuntu 24.04 guest, by category (Phase 1 state, 2026-05-29):

Service category Purpose Phase 1 status
Proofreader Proofreader service ✓ active
Knowledge wikis (documentation, corporate, projects) The three media-knowledge wikis ✓ active
Marketing sites (PointSav, Woodfine) The two public marketing landing sites ✓ active
service-fs WORM ledger — data ingest backbone pending (project-data build)
BIM gateway Depends on service-fs pending
system-core Capability Ledger substrate pending (project-system install)
system-ledger Ledger state-machine pending (project-system install)

Each active service is reachable only on the guest's own local network interface, port-forwarded from the host; none of these are exposed addresses a reader outside the platform's own infrastructure could reach. A systemd unit on the host manages the QEMU process for the guest and handles graceful shutdown via the QEMU monitor socket.

Phase 3: one seL4 VM per deployment instance (planned)

The ratified moonshot topology for the OS family does not package os-mediakit as one combined seL4 appliance the way os-orchestration consolidated Command and SLM into a single guest. Instead, each app-mediakit-* deployment instance — not each service type — gets its own dedicated seL4/Microkit VM, using the same Microkit-plus-vendor-libvmm-Linux-guest pattern already proven for os-totebox.

Planned VM Hosts
mediakit-knowledge-vm-1 media-knowledge-documentation-1 (documentation.pointsav.com)
mediakit-knowledge-vm-2 media-knowledge-projects-1 (projects.woodfinegroup.com)
mediakit-knowledge-vm-3 media-knowledge-corporate-1 (corporate.woodfinegroup.com, not yet deployed)
mediakit-marketing-vm the marketing landing instances
mediakit-dist-vm the distribution/compliance-feed instance, once built

The rationale mirrors os-privategit's three separate instances (source vault, software distribution, design assets): different public surfaces carry different attack profiles, and a compromise of one wiki instance should not put a sibling instance's process space at risk. This is a planned milestone, not yet started — no os-mediakit VM, combined or per-instance, runs under seL4 today.

What changes vs Phase 1, what stays the same

Property Ubuntu 24.04 (Phase 1, today) seL4 per-instance VMs (Phase 3, planned)
Guest OS Ubuntu 24.04 Linux 6.x (glibc 2.39), one guest for all co-tenant instances seL4 microkernel, one guest per deployment instance
Host QEMU/TCG (x86_64) QEMU/KVM or bare metal AArch64
Service binaries Same (cross-compiled) Same, recompiled for the target seL4 guest
Isolation boundary Process/filesystem separation within one shared guest A full VM boundary per instance
Port assignments Same, host port-forwarded Same, reachable over the PPN mesh
virtio-balloon Present Present (hypervisor layer unchanged)
Key custody OS file permissions Per-VM key material, no shared guest to compromise

Relationship to os-infrastructure and Genesis Protocol

os-infrastructure is the hypervisor boot layer — it runs Genesis Protocol on the physical host to establish the PPN node's WireGuard identity and claim ceremony. os-mediakit is a guest that runs above os-infrastructure. They are different layers and different binaries.

The Genesis Protocol first-boot sequence applies to the host node (os-infrastructure), not to the guest (os-mediakit). A new vm-mediakit guest joins the mesh via the MBA pairing ceremony after the host node is already a PPN member.

See also

Important Information

Corporate structure. PointSav Digital Systems ("PointSav") is currently a trade name of Woodfine Capital Projects Inc. ("Woodfine"), planned to become a wholly-owned Woodfine subsidiary upon incorporation. PointSav does not itself offer, sell, or solicit any security. Any securities offering associated with Woodfine's real-property direct-hold solutions is made exclusively by Woodfine, and only by means of the applicable Private Placement Memorandum.

No investment advice. This wiki's content is provided for engineering, operational, research, and development purposes. Nothing on this wiki constitutes investment advice or a solicitation to invest in any Woodfine partnership or direct-hold solution.

Intellectual property. The PointSav name, trade name, wordmark, and marks, together with all current and future PointSav- and Totebox-branded products, services, and offerings — and the software, source code, documentation, design system, and all related materials — are proprietary to Woodfine and its affiliates, except for components identified as open source. No rights are granted except as expressly set out in a written license or agreement. The full trademark notice appears in the footer of every page on this site.

Open source components. Portions of the platform are made available under permissive open-source licenses identified in the accompanying repository. Use of those components is governed by their respective license terms.

No warranty; informational use. Content on this wiki is provided for general informational purposes only and does not constitute a representation, warranty, or commitment with respect to product functionality, availability, pricing, or roadmap. Some articles describe planned or intended features, capabilities, and milestones — language such as "planned," "intended," "targeted," "may," and "expected" marks this forward-looking content, which is subject to change and does not constitute a commitment regarding future performance.

Confidentiality. Where an article describes an operational or deployment detail that is not intended for public disclosure, that article is not published on this wiki. Content here is general-purpose engineering documentation, not customer-specific configuration.

Jurisdiction. Woodfine Capital Projects Inc. is organized in British Columbia, Canada. References to the Sovereign Data Foundation on this wiki describe a planned or intended initiative only, not a current equity holder or active governance body.

Changes to this notice. PointSav may update this notice from time to time; the version posted on this page governs.

Not a filing system. This wiki is not a securities filing system, an electronic disclosure repository, or a substitute for SEDAR+ or any other regulatory filing system. Formal securities filings are made through the applicable regulatory filing system, not through this wiki.

Full disclaimer. This notice supplements, and does not replace, the full Disclaimers article. In the event of any conflict, the full Disclaimers article governs.

Read the full disclaimer →