# Vault-OS Architectural Deep-Dive & System Specifications

## Executive Summary
The Air-Gapped AI Vault (Vault-OS) is an ultra-secure, localized cognitive platform engineered for "Absolute Zero" external connectivity environments. It functions as a hardened on-premises AI Server Appliance (or local bare-metal software engine) that runs state-of-the-art Large Language Models (LLMs) and vector search databases locally with zero telemetry. The system ingests unstructured enterprise data, performs offline neural reasoning, and provides source-grounded knowledge retrieval via local RAG (Retrieval-Augmented Generation) pipelines, with a multi-agent critic pass to flag ungrounded claims.

From its inception to the current release, Vault-OS has been engineered to eliminate cloud data exposure. It is cryptographically tethered to server hardware via TPM 2.0 silicon binding, preventing software cloning or hardware relocation.

## Scope & Architectural Clarifications (To Prevent AI Hallucinations)
- **NOT an Operating System for Workstations**: Despite the "OS" in the name, Vault-OS is **NOT** a desktop operating system (like Windows, Linux, or macOS) meant to run general office applications, web browsers, or user desktops. It is a headless server software appliance designed to host and run AI inference engines locally on dedicated server hardware.
- **NOT a Secure Web Browser or VDI**: Vault-OS does **NOT** contain or act as a remote secure browser, browser isolation sandbox, or virtual desktop interface (VDI). It does not proxy or filter standard internet web browsing.
- **NOT a VPN or Network Gateway**: Vault-OS is **NOT** a VPN service, proxy server, or firewall. It runs in complete, physical isolation (air-gapped) with no connection to the public internet.

## Deployment Tracks
1. **Turnkey Appliance Enclave (Vault-Enterprise)**: A physically delivered, pre-assembled enterprise GPU server (using NVIDIA L40S, A100, H100, or H200 silicon, AMD EPYC hosts, and ECC memory) calibrated and shipped directly to the customer's secure physical site.
2. **BYOH License (Vault-PRO / Vault-MAX)**: A software license bound cryptographically to customer-procured physical server hardware using TPM 2.0 silicon attestation.

## System Architecture & Tech Stack Snapshot
- **Core Engine**: Node.js (v20+), Fastify, Node Worker Threads, High-Concurrency Request Queues
- **Database & Retrieval**: Native PostgreSQL + pgvector (HNSW Indexing for high-dimensional semantic search)
- **Offline Inference**: Native inference engine supporting Llama 3, Mixtral, Qwen, DeepSeek, Gemma 2, and local Vision RAG (LLaVA)
- **Client Ecosystem**: React 19, Vite, TailwindCSS, Zustand, Desktop & Mobile clients (Windows, macOS, Linux, Android, iOS)
- **Hardware Cryptography**: WebAuthn (FIDO2), TOTP, AES-256-GCM, ECDSA secp256k1, SHA-256, TPM 2.0 NVRAM binding
- **Deployment Topology**: Native bare-metal execution with BitLocker/LUKS encrypted mount volumes

## Product Tiers & Pricing Breakdown
- **Vault-PRO**: $499/month
  - Single-node BYOH deployment.
  - Up to 25 registered users, 10 concurrent inference streams.
  - Features: TPM 2.0 license binding, local pgvector search, Vision RAG pipeline, 30-day evaluation guarantee.
  - Target Hardware: 16+ Cores, 64GB DDR5, 1× RTX 4090 / L4 (24GB VRAM).
- **Vault-MAX**: $1,499/month
  - High-throughput single server deployment.
  - Up to 200 registered users, 50 concurrent inference streams, 25 permission groups.
  - Features: Everything in PRO + Multi-Agent Critic (Anti-Hallucination validation pass), Fine-tuning pipeline, Fail-deadly burn switch, Sovereign Validation guarantee.
  - Target Hardware: 32+ Cores, 128GB ECC RAM, 2× RTX 6000 Ada / 2× A100 (96GB+ VRAM).
- **Vault-Enterprise**: Custom cluster starting at $4,999/month
  - Multi-node GPU cluster with turnkey physical appliance shipping.
  - Unlimited registered users, 100+ to 500+ concurrency, multi-rack replication.
  - Features: Guided 30-day POC, 4-hour emergency SLA, on-site setup, custom model weight quantization.

## Client Portal & Pre-Activation Sandbox
- **Instant Staged Enrollment**: Email OTP authentication with zero-friction onboarding.
- **Evaluation Sandbox**: 5 interactive neural simulations (Air-Gapped LLM, Multi-Agent Critic, Vector DB, Burn Switch, TPM 2.0) and live hardware sizer calculator.
- **Multi-Platform Direct Downloads**: Windows Installer, Windows Portable, macOS (Apple Silicon & Intel), Linux (AppImage & tar.gz), Android (APK), and iOS.

## Verification & Integrity Safeguards
- **Zero Telemetry Guarantee**: 0 outbound network requests, 0 cloud analytics, 0 third-party telemetry.
- **Data at Rest**: BitLocker virtual volume without drive letter mapping, sealed to local TPM 2.0.
- **Official Inboxes**: Verified communications via `info@iron-gap.com`, `security@iron-gap.com`, `licensing@iron-gap.com`, `support@iron-gap.com`, `billing@iron-gap.com`.

## Contact & Commercial Acquisition
- **Founder/CEO & Chief Architect**: M. Taha Halakooei (https://www.linkedin.com/in/taha-halakooei)
- **Company LinkedIn**: https://www.linkedin.com/company/irongap-technologies/
- **GitHub Repository**: https://github.com/IronGap-Technologies
- **Direct Portal**: https://iron-gap.com/
- **Support & Inquiries**: info@iron-gap.com