← Back to Architecture & Engineering Studies
Study 01 · System Architecture · 8 min visual read · By Rasnu Systems Architecture

From Alert to Approved Fix in 13 Seconds: The RasnuOS Incident Response & Fleet Architecture

Why do production outages take 30 minutes to resolve when the actual remediation command takes 4 seconds to run? Below is the complete visual systems architecture of how RasnuOS connects live 15-second host telemetry to human-gated execution, multi-server canary waves, and peer-to-peer server migration.

Chart 01 · Mean-Time-To-Resolution (MTTR) Telemetry Study

Where 30 Minutes of Outage Time Actually Goes

99.2% Faster Root-Cause Triage
A. Traditional Incident Loop (Manual SSH + Log Grep + Context-Blind Chat Window) Total: 30m 00s
VPN/SSH 4.5m
Manual Log & Process Triage (18.5m)
Config & Backup 5m
2m
00:00–04:30: Locate bastion credentials, connect VPN, open multiple SSH terminals.
04:30–23:00: Manually inspect CPU/RAM, tail Nginx & DB logs, correlate timestamps.
23:00–28:00: Copy log snippets into an external AI chat, copy-paste untested commands.
28:00–30:00: Restart services manually with zero automatic snapshot or audit log.
B. RasnuOS Control Plane Loop (Continuous 15s Telemetry + Parallel AI Triage + 1-Click Approval) Total: 13 Seconds
1. Connection0.0s

Outbound TLS 1.3 WebSocket already active on port 443. Zero SSH key hunting.

2. Live Triage6.0s

Correlates 15s CPU/RAM/disk stream, process table, and recent service error logs.

3. Safety & Diff3.0s

Passes multi-phase safety check, stages `.bak` file backup & pre-computes rollback.

4. Approval4.0s

Engineer reviews Approval Card, clicks Approve, and execution is hash-chained.

Flowchart 02 · Control Plane & Agent Data-Flow Topology

Closed-Loop Diagnostic & Approval Pipeline

Outbound WSS (Port 443) · 15 MB Agent
Customer Infrastructure Boundary
Managed Host (Linux / macOS / Windows)
15-Second Telemetry Collector
Streams CPU, memory, swap, disk I/O, top processes & service health.
Compiled Host Guardrails
Blocks filesystem wipes, disk formatting & permission destruction locally.
Snapshot & Undo Engine
Saves automatic `.bak` copy before any config edit for 1-click restoration.
Firewall Rule: 0 Inbound Ports Open
RasnuOS Cloud Control Plane
Diagnostic & Safety Orchestrator
Persistent Server Memory
Retains server topology, installed services & past incident resolutions.
Multi-Phase Cloud Safety Engine
Obfuscation blocker, blast-radius classifier & multi-OS RBAC policy rules.
Ephemeral Credential Vault
Injects secrets into task memory only during approved execution; zero disk residue.
Transport: TLS 1.3 Encrypted Frame Stream
Human Governance & Audit Layer
Operator Workspace & Change Board
Interactive Approval Card
Displays exact shell command, visual file diff, risk score & rollback command.
External Team Webhooks
Routes high-risk approvals to ServiceNow, Telegram, Email & Custom Webhooks.
SHA-256 Hash-Chained Ledger
Records prompt, approver, command, exit code & output with CSV export.
Invariant: Zero Unapproved State Mutations
Flowchart 03 · Multi-Server Swarm Rollout Topology

Staged Canary Waves with Automatic Reverse-Order Rollback

Blast-Radius Containment

When applying a security patch, Nginx configuration update, or service restart across a 10-server or 100-server fleet, running the change on all nodes simultaneously risks a fleet-wide outage. RasnuOS executes fleet changes in staged waves with automatic health gates between each wave:

WAVE 1 · CANARY (1 Node)
api-prod-01

Applies config snapshot + change on a single canary server first while the rest of the fleet serves traffic untouched.

GATE · HEALTH PROBE
15s Verification Window

Verifies process exit code `0`, systemd unit active state, and HTTP/TCP health probe response before advancing.

WAVE 2 · FLEET ROLLOUT
api-prod-02 .. api-prod-10

Advances across remaining fleet waves only after Wave 1 passes every health verification check.

AUTO-ROLLBACK BRANCH
Instant Snapshot Restore

If any node fails its health probe, RasnuOS halts the rollout and restores `.bak` snapshots in reverse order.

Flowchart 04 · Direct Server-to-Server Migration Topology

Zero-Relay Encrypted Peer-to-Peer Workload Transfer

Source Server (Node A)
Generates a single-use ephemeral keypair scoped strictly to the approved migration directory.
Direct Encrypted Stream (Rsync over SSH)
Node A ———→ Node B
Data flows directly between your servers at line rate. Zero customer files touch RasnuOS cloud storage.
Destination Server (Node B)
Verifies transfer checksums and automatically purges the temporary authorization key upon completion.
Step 1: Control Plane coordinates a temporary, single-session public key authorization between Source and Destination agents.
Step 2: Source agent streams compressed delta blocks directly to Destination agent with live progress telemetry in your console.
Step 3: Temporary keys are revoked and wiped from both hosts automatically the moment the transfer finishes or is canceled.

Connect your first server free — $5.00 welcome balance included

Install the open-source agent in 30 seconds on Linux, macOS, or Windows and test human-approved AI diagnostics live.

Start Free on 1 Server → Inspect Platform Specs
Next Architecture Studies
State Machine

Why Autonomous Server AI Fails & How Our Approval State Machine Works

45-second staging cascade timeline, execution state graph, and role-based RBAC matrix.

Open study →
Defense-in-Depth

Inside the Dual-Layer Guardrail Pipeline

4-gate command inspection funnel across Cloud Control Plane and Host OS rules.

Open study →
Supply-Chain Security

Zero-Trust Agent Supply Chain & Fail-Closed Updates

Offline release signing, compile-time public key pinning, and outbound port 443 topology.

Open study →

Ready to manage your servers in plain language?

Start free with 1 server and $5.00 in welcome credit. Connect your server in 30 seconds and run your first safe health check right away.

1. Create your free account (1 server + $5.00 usage credit included immediately).
2. Paste the one-line install command on your Linux, macOS, or Windows server.
3. Ask any question in plain language or open a live browser terminal.
No credit card required Prepaid wallet prevents surprise bills Cancel or switch plans anytime