System Architecture & Control-Plane Isolation
Detailed breakdown of the four operational planes: Adaptive Agent, Core Data Plane, Isolated Admin Console BFF, and Blind Cloud Relay.
Four-Plane Topology
Madar separates client execution, data-plane traffic, administrative control, and push wake signaling into four distinct planes with explicit cryptographic boundaries:
- 1. Adaptive Agent (madar_app): Built with Flutter for Android, iOS, and Web. Enforces per-vault SQLite encryption, Ed25519 JWS policy verification, and monotonic clock checks.
- 2. Core Data Plane (madar_server): Node.js 24 + PostgreSQL 18 + Redis 7 + S3/MinIO object storage. Enforces all RBAC, DLP, policy inheritance, and Argon2id password verification.
- 3. Isolated Control Plane (madar_admin_console): Standalone BFF service with zero direct database access. Communicates with madar_server over internal authenticated channels using X-Madar-Control-Plane-Key and issues HttpOnly, SameSite=Strict session cookies with per-session CSRF tokens.
- 4. Blind Cloud Relay (madar-relay): Optional wake-signal relay that maps 128-bit opaque handles (rel_<32-hex>) to APNs/FCM tokens without accepting any message body, sender identity, or channel metadata.
Discovery Endpoint (/.well-known/madar-workspace.json)
{
"workspace_id": "9f8c2b10-4e11-4d9a-8c31-0a2b3c4d5e6f",
"workspace_name": "هيئة التقنية والاتصالات",
"deployment_profile": "workspace",
"official_domain": "protosoftdev.online",
"domain_verified": true,
"policy_signing_pub_key": "MCowBQYDK2VwAyEA...",
"cloud_relay_enabled": true,
"sso_providers": [
{ "id": "41c8...", "kind": "oidc", "name": "Corporate SSO" }
]
}