Architecture
A live control plane, a frozen interface, and a substrate that can be swapped.
SisiDesk is deliberately split in two. Everything that defines the product is built and running. Everything that needs data-centre capacity sits behind one interface, so the substrate is a supplier — not the architecture.
How the pieces fit
A client never talks to a machine directly. It asks the control plane for a session; the control plane asks the broker adapter to provision or attach; the adapter returns a short-lived stream credential that is handed straight to the client and never persisted. Minutes and gigabytes are metered server-side as they accrue.
Browser / tablet / laptop
|
| session token (short-lived, never stored)
v
+---------------------------+
| SisiDesk control plane | accounts · metering · billing · teams
| (live today) | audit · notifications · admin
+---------------------------+
|
| SessionBroker interface (frozen)
v
+---------------------------+
| Substrate adapter | provision · attach · status
| mock -> cloud | suspend · resume · terminate · rates
+---------------------------+
|
+------+---------------------------+
| |
streaming pipe per-tenant instance
(UDP, H.264/AV1) microVM · encrypted volume
in-instance index + embeddingsControl plane
LiveAccounts and magic-code auth, workspaces, session lifecycle, per-minute metering, billing and invoices, teams and shared workspaces, device trust and handoff, an append-only audit trail, notifications, an operator console with role separation, and a nine-language interface.
Session broker interface
FrozenA single contract — provision, attach, status, suspend, resume, terminate, rates — that every substrate must satisfy. A mock adapter implements it today; the cloud adapter drops in behind the same interface with no change above it.
Streaming pipe
SubstrateManaged remote-display streaming over UDP with H.264/AV1, adaptive bitrate and a browser client. Target: P95 glass-to-glass under 80ms in-region.
Isolation and capacity
SubstrateOne microVM-backed instance per tenant workspace, with its own network namespace, encrypted volume and snapshot/restore path. Suspend on idle, restore on attach.
Tenant-bound intelligence
SubstrateIndexing, OCR, embeddings and the vector store run inside the tenant instance on open models. The control plane holds no index and has no read path into workspace contents — a structural guarantee, not a policy promise.
Why the interface is frozen
Substrate contracts are the easiest place for a young company to lose its footing — pricing moves, regions lag, terms change. Confining the substrate to seven methods means a migration is an adapter, not a rewrite, and it keeps the unit economics negotiable.
- One adapter file per substrate, with no substrate types leaking upward.
- Stream credentials are minted per attach and expire on their own — nothing to migrate.
- Workspace volumes export as standard disk images, so a tenant can leave with their machine.
- Metering is computed by the control plane from its own clock, not from supplier invoices.
What the substrate is for
Per-session capacity is the dominant cost line, and it scales with usage rather than headcount: a streaming pipe, GPU and general-compute instances, encrypted block storage, snapshot archives, and regional egress. Pricing is set per minute against the measured cost of that capacity, which is why the ledger and the invoice are built from the same events.
Where we are
The control plane is in private beta and running against the mock adapter end to end — you can create a workspace, start and meter a session, record and share a clip, hand off between devices, and read the whole thing back in the audit trail. Regional capacity is being brought online in cohorts. Engineering decisions are written up on the blog, and shipped changes on the changelog.