The Architecture
At the absolute foundation of the Synrc Virtualization Environment lies the HYPERVISION plane, a highly secure layer powered by the seL4 microkernel. Operating as the bedrock, it manages memory via strict capability derivations and runs the native SYSTEM planes in complete isolation. Depending on the desired UNIX semantics, administrators can deploy either the ALPINE or NETBSD flavors, establishing a deterministic and strictly MAC-sandboxed environment tailored for Unikernels and NanoVMs.
Upon this solid foundation, the capability-driven CONTROL plane takes charge. Here, the CHIMERA broker allocates all system resources. It acts as the sole authority managing namespace isolation via LAND, firewall networks through NET and VPN, and overarching cluster orchestration with CD and OS. Within this plane, secure DNSSEC namespaces are governed by NS, while identity and directory structures are maintained by LDAP and IAS, all rigorously regulated by the certified Attribute-Based Access Control logic of ABAC.
Yet, despite its vast authority, the Control plane holds no secrets. All long-term cryptographic materials are strictly confined to the SECURITY plane. This highest-assurance BEAM enclave utilizes hardware TPM 2.0 via TSS to securely store and process keys using KVS-TSS. It operates as the root Certificate Authority (CA) and guarantees that every single privileged action across the entire stack is indelibly recorded by the append-only AU (Audit) log. Desired system states are immutably tracked by the CM (Configuration Management) database.
With the infrastructure firmly secured, the SERVICE plane provides the unprivileged application boundaries. Userland processes—such as rootless window managers running X11 and WM, or real-time communication bridges handling CHAT, MQTT, TURN, and GST—operate here entirely without ambient authority. They dynamically lease rights via capability tokens, minimizing the blast radius in the event of any compromise.
Driving the core logic of the enterprise is the APPLICATIONS plane, where the scalable Business Process Engine (BPE) seamlessly converts complex BPMN diagrams directly into Erlang runtime execution. Persistent states and vast data structures are robustly handled by polymorphic cursor databases within KVS, and high-performance WebSockets are terminated by N2O.
Finally, sitting at the very top of the stack is the PRODUCTS plane (ІКС). This is a comprehensive suite of domain-specific enterprise applications—ranging from Healthcare platforms parsing HL7 to Education, Accounting, and complex Analytics (OLAP). These products deliver pristine, deeply specialized user experiences without ever needing to intrinsically trust the hypervisor layers beneath them.
