Skip to content
FaradAiLab Docs
Enterprise Beta

Fleet Gateway Daemon & Distributed Edge Sync

The Fleet Gateway Daemon (faradaiwire-ee-agent) is a high-performance, single-binary Go background daemon that operates alongside the open-source FaradAiWire Core engine.

It bridges the developer workstation or container runner to the centralized enterprise control plane, handling dynamic policy streaming, mutual TLS (mTLS) certificate lifecycle management, and non-blocking audit export.

graph TD
    subgraph HostWorkstation ["Host Machine / Container Sandbox"]
        direction TB
        AgentClient["AI Agent\n(Claude Code, Cursor)"] -->|"Port 8090"| CorePEP["FaradAiWire Core PEP\n(Open Source Engine)"]


        subgraph SidecarDaemon ["Fleet Gateway Daemon (Go)"]
            LocalIPC["Local Unix Domain Socket / OrderPolicy Hook"]
            BundleCache["Cryptographic Policy Cache\n(Local Disk / Memory)"]
            LogBuffer["Ring-Buffer Telemetry Queue\n(Memory-Capped)"]
            CertManager["mTLS X.509 Certificate Manager\n(Automated ACME / Vault Rotation)"]
        end


        CorePEP <-->|"Low-Latency IPC (<0.2ms)"| LocalIPC
        LocalIPC --- BundleCache
        LocalIPC --> LogBuffer
    end


    subgraph CloudPlane ["Central Enterprise Control Plane"]
        UpstreamSync["mTLS Upstream Hub\n(wire.faradailab.com:8443)"]
    end


    CertManager -->|"mTLS Tunnel & Cert Rotation"| UpstreamSync
    UpstreamSync -->|"Signed Rego Tarballs"| BundleCache
    LogBuffer -->|"Batched JSONL Stream"| UpstreamSync

Zero-Impact Local Latency Guarantee

AI coding assistants require interactive responsiveness. A proxy that introduces network hops on every tool invocation degrades the developer experience. The Fleet Gateway Daemon is engineered under strict performance constraints:

  1. Zero Synchronous Network Calls: During agent tool execution, FaradAiWire Core evaluates policies against the in-memory cached OPA bundle. The daemon never makes outbound WAN calls on the critical evaluation path.
  2. Sub-0.2ms IPC Overhead: Communication between Core and the Daemon occurs over a high-speed Unix Domain Socket (/var/run/faradaiwire-ee.sock) or named pipes on Windows.
  3. Memory Footprint: The Go binary consumes less than 25 MB of resident memory (RSS) and under 0.5% CPU when idle.

Mutual TLS (mTLS) & Key Rotation

Communication between the Fleet Gateway Daemon and wire.faradailab.com is secured using strict Mutual TLS (mTLS 1.3):

  • Hardware-Backed Keys: On macOS and Windows endpoints, private keys can be bound to the Apple Secure Enclave or Windows TPM 2.0.
  • Automated Rotation: Client certificates have short lifespans (72 hours). The daemon automatically renegotiates and rotates certificates in the background via internal ACME / Vault APIs without interrupting running agent sessions.
  • Certificate Revocation: If a laptop is reported lost or compromised, the administrator can revoke the node’s client certificate instantly from the control plane dashboard, disconnecting it from the policy stream.

Offline Resilience Mode (Fail-Safe Strategy)

Developer laptops frequently experience intermittent connectivity (e.g. traveling, flights, spotty Wi-Fi). The Fleet Gateway Daemon features a resilient Offline Mode:

flowchart TD
    Start["Agent Invokes MCP Tool"] --> CheckCache{"Is Upstream Control Plane Reachable?"}


    CheckCache -- "Yes (Connected)" --> EvalOnline["Evaluate Against Live Cached Bundle"]
    CheckCache -- "No (Offline)" --> CheckTTL{"Is Cached Policy within Grace Period (TTL)?"}


    CheckTTL -- "Within TTL (< 7 Days)" --> EvalOffline["Execute Cached Policy in Offline Mode"]
    CheckTTL -- "Expired (> 7 Days)" --> EnforcePolicy{"Workspace Config: Fail-Closed or Fail-Open?"}


    EnforcePolicy -- "Fail-Closed (Default for FinTech)" --> BlockExecution["Block High-Risk Tools\n(Return -32003 ErrPolicyDenied)"]
    EnforcePolicy -- "Fail-Open (Standard Dev)" --> AllowFallback["Allow Execution with Local Audit Flag"]


    EvalOnline --> BufferLog["Buffer Telemetry to Local Disk"]
    EvalOffline --> BufferLog
    BufferLog --> ReconnectCheck{"Network Restored?"}
    ReconnectCheck -- "Yes" --> DrainLog["Flush Buffered Telemetry to SIEM"]

Telemetry Spooling

When offline, audit records are encrypted and spooled to a local SQLite/DuckDB buffer on disk (capped at 500 MB by default). Once the internet connection is restored, the daemon flushes spooled records with backpressure control.

Daemon Configuration (ee-agent.yaml)

The daemon is configured via a system-level configuration file located at /etc/faradaiwire/ee-agent.yaml:

version: "1.0"
tenant:
  id: "tenant_corp_748291"
  control_plane_url: "https://wire.faradailab.com:8443"
  enrollment_token_env: "FAW_ENROLLMENT_TOKEN"


sync:
  heartbeat_interval_seconds: 30
  policy_poll_interval_seconds: 60
  offline_grace_period_days: 7
  fail_strategy: "fail_closed" # Options: fail_closed, fail_open


mtls:
  cert_path: "/var/lib/faradaiwire/client.crt"
  key_path: "/var/lib/faradaiwire/client.key"
  ca_path: "/etc/faradaiwire/ca.crt"
  auto_rotate: true


telemetry:
  batch_size: 100
  flush_interval_ms: 1000
  disk_buffer_max_mb: 500

Deployment Options

  • macOS / Linux Workstations: Packaged as a standard launchd plist (macOS) or systemd service (Linux).
  • Docker / Kubernetes: Available as a lightweight scratch-based container (faradailab/fleet-daemon:latest) deployed as a sidecar or DaemonSet.

Next Steps