RookeryOS — Technology Stack

Complete inventory of every technology powering the platform

Overview

RookeryOS is built on a polyglot stack optimized for agentic workloads — TypeScript/Node.js for the agent runtime, Python for browser DOM distillation, PostgreSQL for durable state, Redis for sub-100ms lookups, and Kubernetes for elastic scaling.

Languages & Runtimes

Language	Version	Where Used
TypeScript	5.7+	Hudson Gateway, API Server, Console, Provisioner
Node.js	22.x (LTS)	Hudson Gateway, API Server, Console SSR
Python	3.12	Browser-Use DOM distillation, STT/TTS service
SQL	PostgreSQL 15	Schema, migrations, queries
Shell (Bash)	—	Docker entrypoints, s6-overlay scripts, provisioning
HTML/CSS	—	Lighthouse rendered documents, noVNC interface
Go	—	kubectl, gcloud CLI (inside containers)

Frontend

Technology	Version	Purpose
React	19.0.0	Console SPA (app.agentworksstudio.com)
React Router	7.1.1	Client-side routing with role-based guards
Vite	6.0.7	Build tool, HMR, proxy configuration
Tailwind CSS	3.x	Utility-first styling
TipTap	3.23.4	Rich text editor (Prism workspace)
Socket.io Client	4.8.3	Real-time WebSocket communication
Lucide React	—	Icon library (1000+ icons)
HLS.js	—	Video streaming playback
DnD Kit	—	Drag and drop interactions

Console Build Pipeline

Source (TSX) → Vite Build → Static HTML/JS/CSS → nginx (Alpine) → Port 8080

Docker: Multi-stage build — node:22-alpine (build) → nginx:alpine (serve)

Backend

API Server (apps/api)

Technology	Purpose
Hono	High-performance HTTP framework
Node.js 22	Runtime
pg (node-postgres)	PostgreSQL driver
ioredis	Redis client
Socket.io	WebSocket server (HITL events, live updates)
Anthropic SDK	LLM proxy for agent chat
Z.ai SDK	Primary LLM (GLM-4.5 via OpenAI-compatible API)
Stripe	Billing and subscription management
bcrypt	Password hashing
jsonwebtoken	JWT authentication

Hudson Gateway (apps/hudson-gateway)

Technology	Purpose
TypeScript	Agent runtime engine
Node.js 22	Runtime
s6-overlay v3	Process management (init → services)
nginx	Reverse proxy, static assets, API routing
Playwright / CDP	Browser automation via Chrome DevTools Protocol
tini	PID 1 signal handling

Browser-Use Sidecar

Technology	Purpose
Python 3.12	Runtime
FastAPI	DOM distillation HTTP service
Chromium	Headless browser with CDP on :9222
Xvfb	Virtual framebuffer (1280×720)
x11vnc + websockify	VNC → WebSocket bridge for noVNC
noVNC	Browser-based VNC client (:6080)

Databases & Storage

PostgreSQL 15

Host: Cloud SQL (GCP) or in-cluster

Table	Purpose
`users`	User accounts, roles, tenants
`agents`	Agent definitions, configs, tiers
`tenants`	Multi-tenant organizations
`lighthouse_documents`	Knowledge base (content + vectors + HTML)
`cookie_vault`	AES-256-GCM encrypted browser cookies
`pod_sessions`	Active pod tracking
`subscriptions`	Stripe billing integration
`audit_logs`	System audit trail
`agent_memory_files`	Agent SOUL and memory persistence

Extensions: pgvector for semantic search embeddings

Redis 7

Purpose: Sub-100ms lookups for Lighthouse path registry

Key Pattern	Type	Purpose
`lh:path:{tenant}:{path}`	Hash	Document metadata cache
`lh:tags:{tenant}:{tag}`	Set	Tag-based document index
`lh:fingerprint:{hash}`	String	Content deduplication

Fallback: All Redis data has PostgreSQL as source of truth. Redis is cache-only.

GCP Secret Manager

Secret	Purpose
Per-tenant DEK	Cookie Vault encryption keys
`aw2-api-secrets`	API keys (ZAI_API_KEY, MINIMAX_API_KEY, etc.)
Service account keys	Workload Identity for GKE pods

GCP Artifact Registry

Registry	Images
`us-central1-docker.pkg.dev/ai-agent-workforce-hq/aw2-images/`	All platform images

Key Images:

rookery-os-base — Hardened Debian base
rookery-kernel — Container 1 (Hudson + nginx)
rookery-sidecar — Container 2 (Chromium + noVNC)
aw2-console — Platform admin console
aw2-api — API server
aw2-gateway — Platform gateway

Infrastructure

Google Kubernetes Engine (GKE)

Setting	Value
Cluster	`aw2-standard-cluster`
Type	Standard (not Autopilot)
Location	us-central1
Node Type	e2-standard-2 (Spot)
Gateway IP	34.102.157.95
Gateway API	v1 (HTTPRoute, Gateway resources)

Networking

Internet → GKE Gateway (34.102.157.95)
         → HTTPRoute routing by hostname:
           ├── agentworksstudio.com       → Marketing (Next.js)
           ├── app.agentworksstudio.com   → Console (React)
           ├── api.agentworksstudio.com   → API Server (Hono)
           └── gateway.agentworksstudio.com → Hudson Gateway
           └── *.pods.agentworksstudio.com → Agent Pods (per-namespace)

Container Runtime

Container	Base Image	Process Manager	Exposed Ports
Kernel	`node:22-bookworm-slim`	s6-overlay v3	:8080 (nginx)
Sidecar	`debian:bookworm-slim`	shell entrypoint	:9222 (CDP), :6080 (noVNC), :9223 (Browser-Use)
Console	`nginx:alpine`	nginx	:8080
API	`node:22-alpine`	Node.js	:3001
STT/TTS	`python:3.12-slim`	Uvicorn	:8000

Voice & Audio

Technology	Purpose
WebRTC	Real-time audio transport (sub-second)
Faster Whisper	Local STT (CPU/GPU modes)
Silero VAD	Voice activity detection
Local TTS	CPU/GPU text-to-speech
Opus codec	Audio compression
librosa / soundfile	Audio processing (Python)

Service: apps/stt-tts-service/ — Python FastAPI service

LLM Providers

Provider	Model	Purpose
Z.ai	GLM-4.5 / GLM-4.5-Flash	Primary LLM (all agents)
MiniMax	MiniMax-M2.7	Legacy pod chat (being phased out)
Google Vertex AI	Gemini 2.0 Flash	Audit processing, translation
Ollama	Qwen3:8B (local)	Local inference on Mac Mini M4

Routing: API → Provider SDK → Model. Z.ai via OpenAI-compatible API. MiniMax via Anthropic-compatible API.

Build & Deployment

Tool	Purpose
Cloud Build	Multi-stage Docker builds, image publishing
pnpm	9.15.4 (root), 10.23.0 (hudson-gateway)
Docker	Multi-stage builds for all services
Kubectl	K8s resource management
gcloud CLI	GCP operations

Build Commands

# Build all RookeryOS images
gcloud builds submit --config=cloudbuild-pod.yaml

# Build individual service
docker build -t aw2-console apps/console/
docker build -t aw2-api apps/api/

# Deploy to GKE
kubectl apply -f infrastructure/k8s/platform/
kubectl rollout restart deployment/aw2-console -n platform

Security Stack

Layer	Technology
Transport	TLS 1.3 (GKE Gateway termination)
Authentication	JWT (RS256) with refresh tokens
Cookie Encryption	AES-256-GCM with per-tenant DEK
Key Management	GCP Secret Manager
Container Hardening	ASLR, no SUID, no core dumps, non-root user
Network Isolation	K8s NetworkPolicy (Navigator namespace)
RBAC	Role-based (platform_admin, tenant_admin, user)
Workload Identity	GKE → GCP IAM binding per namespace

Development Tools

Tool	Purpose
ESLint	TypeScript linting
Prettier	Code formatting
Playwright	E2E testing
TypeScript	Type checking across all apps
Vite	Fast dev server with HMR

Dependency Graph

apps/console (React 19 + Vite)
  ├── apps/api (Hono + PG + Redis)
  │   ├── PostgreSQL (Cloud SQL)
  │   ├── Redis (Lighthouse cache)
  │   └── LLM Providers (Z.ai, MiniMax, Vertex AI)
  ├── apps/stt-tts-service (Python + Whisper + TTS)
  └── apps/hudson-gateway (Node.js 22 + Playwright)
      ├── Browser-Use (Python + FastAPI)
      └── Cookie Vault (PG + GCP Secret Manager)

packages/shared
  └── Constants, types, utilities (used by all apps)

PreviousPlatform Admin Console