Tier 5 · multi-DC · multi-region

A federated hive of independent clusters.

Tier 5 joins sites, data centers or regions, each a self-contained cluster block, with the same signed federation the lower tiers use: mutual TLS, Ed25519-signed and nonce-bound pushes from enrolled peers, W-of-N quorum writes with a timeout sized for the WAN, and catch-up pulls. There is no global consensus. A partition costs replication latency, never a committed write.

mTLS + Ed25519 + nonce 202 durable-local on quorum miss /sync/since catch-up asi-hard posture no Raft / Paxos

Architecture

Sites meet only through federation.

Each site runs its own peers, its own same-host wake hubs and its own store. Two sites here keep data in operator-run PostgreSQL; the third is a small SQLite witness peer, so one site can be lost while W of N acknowledgements are still reachable. Size --quorum-timeout-ms for the round trip: the compiled default assumes peers in one data center, and the federation guide recommends several seconds for cross-region meshes.

federation · memory write wake hint limit

Certified as a trust boundary. The enterprise federation certification covers 500–1000-agent clusters built from blocks of at most 50 peers: namespace confinement, peer attestation, per-write authority, at-rest confidentiality and the tamper-evident audit spine. It certifies no throughput or latency figure; scale beyond one cluster by adding independent clusters. Sources: src/federation/signing.rs, src/federation/peer_attestation.rs, src/replication.rs, src/security_profile.rs, docs/compliance/ENTERPRISE-FEDERATION-CERTIFICATION.md.

Partitions

Durable locally, converged after the heal.

A federated write commits on the receiving site before it fans out and is never rolled back. When fewer than W peers acknowledge in time, the daemon answers 202 Accepted with quorum_met:false and durability:"local", and the undelivered push waits in the dead-letter queue. After the partition heals, dead-letter replay and the /sync/since catch-up loop bring every peer to the same rows; erasures travel through a durable outbox the same way.

Sources: src/handlers/parity.rs, src/federation/push_dlq.rs, src/federation/receive.rs, src/federation/erasure_outbox.rs; design: ADR-0001 quorum replication.

Walkthrough

One write, one recall.

Write

Across sites

An agent in site 1 writes to its local peer over HTTPS; identity and the namespace governance gate run first.
The row commits in site 1's store.
The peer signs the body with its enrolled Ed25519 key, binds it to a fresh nonce and pushes it to the other sites over mutual TLS.
Each receiver verifies the signature and nonce, checks that the sender is enrolled and may write that namespace, and applies the row with a newer-wins merge.
W acknowledgements in time acknowledge the write; otherwise the answer is 202 and the dead-letter queue retries.

Recall

Always local

An agent in site 2 recalls from its own peer; recall never crosses the WAN.
It sees every row its site has applied, filtered by scope visibility.
A row still in flight from site 1 appears once it is applied: this tier is eventually consistent, by design.
A message for this agent wakes its local hub only when the federated apply moved the inbox row forward.

Deployment recipe

Per site, the same daemon.

Every site runs the T3/T4 daemon configuration; what changes is the peer list, the WAN-sized quorum timeout and the hardened posture.

# on each peer (site 1 shown); PostgreSQL sites add AI_MEMORY_STORE_URL_FILE
AI_MEMORY_SECURITY_PROFILE=asi-hard \
ai-memory serve \
  --host 0.0.0.0 --port 9077 \
  --tls-cert /etc/ai-memory/tls.crt --tls-key /etc/ai-memory/tls.key \
  --mtls-allowlist /etc/ai-memory/mtls-allow.txt \
  --quorum-writes 2 \
  --quorum-peers https://site-2-peer:9077,https://site-3-witness:9077 \
  --quorum-timeout-ms 8000 \
  --quorum-client-cert /etc/ai-memory/fed.crt --quorum-client-key /etc/ai-memory/fed.key \
  --quorum-ca-cert /etc/ai-memory/fed-ca.crt

# verify the certified posture on every peer
ai-memory doctor --posture enterprise-federation

# verify the signed_events chain (reads the local SQLite --db; SQLite peers)
ai-memory verify-signed-events-chain

# OPERATOR side, not ai-memory: PostgreSQL replication across DCs,
# WAL archive to off-site storage, DNS / load balancing per site

Flags and verbs: src/daemon_runtime.rs (ServeArgs, DoctorCliArgs); the profile name is read by src/security_profile.rs. The 8000 ms value is the one the 3-region reference deploy pins, per the federation guide. Enrol each peer's certificate pin and signing key before the first push.

Wiring

Governance, wake and attestation at T5.

Governance

Replicated policy

Namespace standards, pending actions and their decisions replicate through the same signed push as memories, so a policy set in one site applies in every site once applied.

Wake plane

Local by construction

Each host has its own hub on a Unix socket. Messages cross sites as inbox rows by federation; the receiving peer publishes a local wake only for a fresh apply, so replays and superseded rows cannot loop.

Attestation

Every push accounted for

Unsigned, replayed or unenrolled pushes are refused with 401. Peer attestation checks the claimed sender and the namespaces it may write; every node keeps its own signed_events chain.

Honest limits

What a hive is not.

Limit	What it means	Where it is documented
No consensus	No Raft or Paxos and no single global order of writes. Peers converge through quorum writes, dead-letter replay and catch-up.	ADR-0001
No gossip discovery	Peers are listed and enrolled explicitly by the operator.	federation
Eventual consistency	A recall in another site sees a write once it is applied there; graph invalidations also converge asynchronously.	limits §13
Wake plane stays on its host	Cross-site delivery is federation plus the backstop poll; it is not a measured millisecond promise.	wake plane
Certified scope	The certified unit is a 500–1000-agent cluster of at most 50-peer blocks; it is a trust boundary, not a throughput or latency figure.	certification
Daemon is the access path	As on T4: no direct-to-PostgreSQL client and no CDC stream.	limits §5, §7

See it run. The 3-region reference hive is the measured run record behind this tier: three regions, a federated quorum mesh and three encrypted legs, each proven with a positive and a negative test.

Sources

Read the code.

Federation

src/federation/signing.rs · signatures, nonces
src/federation/peer_attestation.rs · sender, scope
src/federation/push_dlq.rs · dead-letter replay

Consistency

src/replication.rs · W-of-N quorum
src/handlers/parity.rs · the 202 contract
src/federation/receive.rs · catch-up loop

Posture

src/security_profile.rs · asi-hard
src/enterprise_federation_posture.rs · posture check
src/federation/applied_wake.rs · federated wake

← T4 · Data-center swarm 3-region reference hive →