5-layer architecture for the Clarity + Pulse platform. Each layer is verified against source files; items without confirmed connector code are omitted.
graph TB
%% ─── LAYER 1: OT / DATA SOURCES ───────────────────────────────────────────
subgraph L1["① OT / Data Sources"]
PI["OSI PI Historian"]
MQTT_SRC["IoT / MQTT Devices"]
HTTP_INGEST["HTTP Edge Clients\n(HTTPS ingest API)"]
end
%% ─── Security Boundary L1→L2 ─────────────────────────────────────────────
B12(["🔒 TLS / HTTPS · Self-signed cert (clarity.local)\n· mDNS local discovery (clarity.local:3030)"])
%% ─── LAYER 2: CONNECTIVITY ────────────────────────────────────────────────
subgraph L2["② Connectivity Layer"]
PI_CONN["PI Web API Connector\n(Basic Auth, HTTPS)"]
MQTT_CLIENT["MQTT Client\n(127.0.0.1:1883)"]
INGEST_EP["HTTP Ingest Endpoint\n(10 MB limit · 1000 req/min)"]
end
%% ─── Security Boundary L2→L3 ─────────────────────────────────────────────
B23(["🔒 WAL-mode SQLite · File permission hardening\n· Scheduled backups · Scope validation"])
%% ─── LAYER 3: DATA LAYER ─────────────────────────────────────────────────
subgraph L3["③ Data Layer"]
TS_DB["Time-Series Storage\n(mmap .bin day files\n512-entry pool)"]
SQLITE_DB["Asset Hierarchies\n(SQLite · pulse-db.sqlite)"]
end
%% ─── Security Boundary L3→L4 ─────────────────────────────────────────────
B34(["🔒 Schema validation · Path-traversal block\n· Process isolation · Resource limits\n· DB encryption (roadmap)"])
%% ─── LAYER 4: CAPABILITIES ────────────────────────────────────────────────
subgraph L4["④ Capabilities Layer"]
AI["Agentic AI\n(pulse_multi_agents)"]
EMS["EMS Service\n(Python FastAPI proxy)"]
ANALYTICS["Calculations & Analytics\n(aggregator pipeline)"]
SECURITY["Data Security & Governance\n(JWT · Argon2 · RBAC)"]
TSRW["Time-Series R/W\n(QueryEngine · WriteBuffer)"]
BACKUP["Backup System\n(SQLite + timeseries)"]
end
%% ─── Security Boundary L4→L5 ─────────────────────────────────────────────
B45(["🔒 RBAC (admin / read-write / read-only)\n· Input validation · JWT Bearer on API calls\n· Auth rate limit (30 req/60 s)"])
%% ─── LAYER 5: APPLICATION ─────────────────────────────────────────────────
subgraph L5["⑤ Application Layer"]
VIZ["Visualization\n(web frontend)"]
ALERTS["Alert Management\n(monitor rules + events)"]
AI_COPILOT["AI Co-Pilot\n(ADK proxy → port 8000)"]
ONBOARD["Asset Onboarding\n(PI connector UI)"]
end
%% ─── Cross-cutting ────────────────────────────────────────────────────────
subgraph CROSS["Cross-cutting Services (all layers)"]
PM["Process Manager\n(child process lifecycle)"]
MDNS["mDNS Discovery\n(clarity.local)"]
LICENSING["License Verification\n(challenge-response, hourly checks)"]
end
%% ─── Connections ──────────────────────────────────────────────────────────
PI --> B12 --> PI_CONN
MQTT_SRC --> B12 --> MQTT_CLIENT
HTTP_INGEST --> B12 --> INGEST_EP
PI_CONN --> B23 --> TS_DB
MQTT_CLIENT --> B23 --> TS_DB
INGEST_EP --> B23 --> TS_DB
PI_CONN --> B23 --> SQLITE_DB
TS_DB --> B34 --> ANALYTICS
TS_DB --> B34 --> TSRW
SQLITE_DB --> B34 --> EMS
SQLITE_DB --> B34 --> AI
ANALYTICS --> B45 --> VIZ
TSRW --> B45 --> VIZ
AI --> B45 --> AI_COPILOT
EMS --> B45 --> VIZ
SECURITY --> B45 --> VIZ
BACKUP --> B45 --> VIZ
ALERTS --> B45 --> VIZ
PI_CONN --> B34 --> ONBOARD

🎞️ Hand-maintained SVG (assets/pulse-stack.svg) — a styled rendering of the Mermaid diagram above. The Mermaid stays the regenerable source of truth; update both on structural change. Amber ✦ marks the agent layer (Pulse Copilot), absent in Historian-only installs.
External data producers. OSI PI Historian is connected via the PI Web API connector (HTTPS, basic auth). IoT/MQTT devices publish to the Mosquitto broker on port 1883. HTTP edge clients push data directly via the HTTPS ingest endpoint. OPC-UA has no native connector in the source — OPC-UA sources reach the platform via the external OPCConnect gateway, which converts UA reads to MQTT pushes (see OPC-UA).
Protocol adapters running inside the Clarity binary. The PI Web API Connector (clarity:backend/src-tauri/src/connectors/webpi/) uses HTTPS with basic auth and supports metadata crawl, live streaming, and historic backfill. The MQTT client (clarity:backend/src-tauri/src/mqtt_services/client.rs) connects to 127.0.0.1:1883 using rumqttc. The HTTP Ingest endpoint (clarity:backend/src-tauri/src/processing_api/ingest.rs) enforces a 10 MB payload limit and 1000 req/min rate limit with a 3600 s token cache.
Persistent storage. The time-series store (clarity:backend/src-tauri/src/api/storage/mod.rs) uses memory-mapped binary day files with a bounded read-mmap pool (512 entries). The SQLite database (pulse-db.sqlite) stores asset hierarchies, users, connections, units, and all dynamic entities managed by the SQLite API.
Business logic and services. Agentic AI runs as a separate process (pulse_multi_agents) connected via the Google ADK proxy. EMS and other Python services are managed by the Process Manager and proxied through Warp. Analytics aggregation runs in Rust (clarity:backend/src-tauri/src/api/aggregator.rs) with 14+ operators. RBAC and auth are handled in clarity:backend/src-tauri/src/auth.rs.
Deployment note: the Agentic AI layer runs only in the AI bundled (edge) / AI separate (cloud) topologies; Historian-only installs have no AI service.
Client-facing capabilities. The web frontend is served as static assets from the Warp HTTPS server. Alert management is driven by the monitor subsystem (clarity:backend/src-tauri/src/monitor/). AI Co-Pilot is the browser-facing chat interface proxied to the ADK binary. Asset Onboarding is the PI element crawl and tag mapping UI.
Deployment note: the AI Co-Pilot chat is present only when the agent layer is deployed (AI bundled or AI separate topologies).
Last updated: 2026-05-23 — verified from clarity source code