Skip to content
APUNA — open by default

Technical reference for developers and evaluators. For the method and field context, start with the devlog.

Platform architecture & build pipeline

Open by default · EU-first · a person greenlights every change.

Principle 01
Everything talks through a defined contract
Every part of the system connects through a standard, versioned contract. No component reaches directly into another's data — so each one can be replaced, audited, or handed over independently.
Principle 02
You own the code
The code is yours to keep, read, and run — licensed under Apache-2.0, a standard free licence. Managed components are used only where they earn it; everything else is open source and can be moved to your own infrastructure.
Principle 03
EU-first · DE preferred
Data resident in the EU; Germany wherever technically & financially acceptable.
Principle 04
A person decides
The guardrail lives in the architecture: no agent change ships without a human gate.
AThe stack

The full stack is in the open — every dependency, every version. github.com/apuna-dev/core

BSovereignty zoning
Germany — preferred

Where technically & financially acceptable: GCP Frankfurt · OSS repatriable to German infra (e.g. Hetzner) · the client runs the open core on their own infrastructure.

Europe — default

Cloudflare EU data localization · Brevo (FR) · Workspace EU region · EU-resident inference. Nothing leaves the EU without a named reason.

US-HQ vendors

Used only with EU data localization and an open-source exit path. Honest caveat: US-headquartered vendors carry US government data-access risk — mitigated by storing data in-region and the right to move every layer to EU infrastructure.

CPlacement — one architecture, three substrates

Sovereignty zoning answers which jurisdiction; placement answers whose hardware. Because every layer sits behind the OpenAPI contract bus, the substrate is a dial, not a rewrite — the contract is the invariant, and the same delivered system runs in any of three places, chosen per workload by which one's properties fit.

Setting 01 · own metal
Apuna bare metal

Ubuntu services plane — k3s, PostgreSQL, MinIO (S3), Ory/Zitadel, observability. AMD 7500X3D · RTX 5090 · 64 GB DDR5 inference plane — open-weight models via Ollama, on-device.

Best for: sovereign & sensitive-data processing, steady-state inference, dev/test. Most sovereign, no egress, cheapest at steady load.

Setting 02 · managed · default
Cloudflare + GCP Frankfurt

The four managed pillars carrying the public surface, burst load, and email — where the value bought is transferred operational responsibility, not raw compute.

Best for: the public SLA surface, availability promises, email deliverability, spiky demand. You buy the pager, not the box.

Setting 03 · client cloud
The client's AWS / Azure / GCP

Containers → EKS/ECS · Postgres → RDS · OIDC federates to their IdP · objects → S3 · IaC re-targets · Claude → Bedrock. The deliverable redeploys; it does not get rewritten.

Best for: clients with an existing cloud commitment or their own residency mandate. The system lands inside their account, perimeter, and keys.

Two honest ceilings

Frontier reasoning is always a hosted call — Claude is closed-weight, so it is reached by API (Agent Platform, or Bedrock on a client's AWS) wherever the rest runs; the AMD 7500X3D + RTX 5090 serves the open-weight tier via Ollama, the contract bus routes between them. And production email wants a relay on every substrate — deliverability is an IP-reputation game a self-hosted mail server loses. Everything else genuinely moves.

How I build — for developers and evaluators

Contract before code · agents propose, a person disposes · reproducible, auditable, reversible.

Development pipeline

Contract before code · agents propose, a person disposes · reproducible, auditable, reversible.

DFrom contract to Care — the loop
  1. 01

    Contract first

    Every feature begins as an OpenAPI contract and a scoped brief. The contract is the spec — code follows it, internal components included.

  2. 02

    Agentic build

    Claude Code agents generate small, atomic pull requests against the contract and its tests. Narrow diffs, each independently reviewable.

    Claude Code · Agent Platform authGitHubOpenAPI tests
  3. 03

    /meeting — human greenlight, on real devices

    No agent change merges without a person reviewing and testing the atomic PR across the device fleet — desktop, laptop, tablet, phone — seeing the change as a user will.

    AMD 7500X3D + RTX 5090MacBook Air M4iPad AiriPhone 17 Pro
    A person decides — by design. The daily drivers double as the first hardware test bench, and the AMD 7500X3D + RTX 5090 (64 GB DDR5) hosts open-weight models locally via Ollama — that inference stays on-device. This gate is non-negotiable and never automated away.
  4. 04

    Continuous integration

    Lint · typecheck · OpenAPI conformance · unit & integration · SAST/DAST security scan — the zero-trust, break-it-first ethos in the gate.

    GitHub ActionsOpenAPI conformanceSAST · DAST
  5. 05

    Infrastructure as code

    Cloudflare and GCP provisioned declaratively — reproducible, auditable, and repatriable to EU/German infra by changing a target, not a rewrite.

    OpenTofuOCI images
  6. 06

    Deploy — isolated per tenant

    The static site and dynamic edge routes ship through the chain below; heavier services deploy to Cloud Run / GKE in GCP Frankfurt. One isolated build per customer, handed over to run on their own infrastructure.

    GitHubGitHub ActionsWranglerCloudflare Pages / Workers
  7. 07

    Observe

    OpenTelemetry → Prometheus / Grafana; live dashboards shipped to the client; incidents routed to the direct channel.

    OpenTelemetryGrafanaBrevo channel
  8. 08

    Care loop

    Automation handles the deterministic ~80% of maintenance; humans take the judgement calls; usage is metered per tenant for honest pass-through billing — and feeds back into the contract.

EOpen-source posture

Managed only where it earns it — open everywhere else, repatriable always.

Four managed pillars carry what they do best: Cloudflare (edge), GCP (heavy compute & data, Frankfurt), Brevo (EU communications), Google Workspace (internal office). Every other layer is open source, and every managed dependency keeps an OSS, EU-hostable exit — so no single layer is a lock-in, and the client always owns the core under Apache-2.0.

Managed third-party (EU-localized)
Open source · self-hostable
Human decision point
The honest line

Cloudflare, Google, and the GitHub code host are US-headquartered; that is named, not hidden. EU data localization, a maintained open-source exit on every layer, and a distributed Git history that mirrors out in a single command mean residency is enforced today and repatriation is available tomorrow — the same principle as the product: open by default, reliable by subscription, and reversible by design.

The VDMA Praxistag report maps these same layers to a live predictive maintenance deployment — Section D on agent requirements, Section F on the reference architecture.

VDMA Praxistag KI — Field Architecture Report

Apuna · platform architecture & pipeline · June 18, 2026