Architecture Overview
The GRAFOMEM platform is five layers; the GMP protocol itself is layer-agnostic (it specifies semantics, not transport).
Core server layers
| Layer | Responsibility |
|---|---|
| 1 · Network / MCP Gateway | FastAPI app: routing, Bearer-token auth, tenant extraction, MCP (stdio + SSE) tool surface. |
| 2 · Ingestion Queue | Async batch worker with backpressure; writes are enqueued and flushed in batches. |
| 3 · Storage | SQLiteGMPBackend — sentinel-encoded schema, composite B-tree indexes, WAL mode for concurrent reads. |
Each layer maps to a module: src/aml/server/app.py, src/aml/server/ingestion.py, and the backends under src/aml/backends/.
Cloud governance layers
When Cloud mode is enabled (--cloud flag or CLOUD_MODE=1), four additional governance modules are mounted:
| Layer | Module | API Prefix | Purpose |
|---|---|---|---|
| 4 · Decision Trail | src/aml/cloud/decision_trail.py | /v1/decisions/ | Immutable inference audit log with Ed25519 provenance |
| 5 · Erasure Proof | src/aml/cloud/erasure_proof.py | /v1/erasure/ | GDPR Article 17 signed erasure certificates |
| 6 · Governance Gateway | src/aml/cloud/governance.py | /v1/governance/ | Pre-execution policy engine (7 policy types, 4 actions) |
| 7 · Regulatory Reports | src/aml/cloud/regulatory.py | /v1/reports/ | EU AI Act / GDPR / DORA compliance packages |
Supporting services:
| Service | Module | Purpose |
|---|---|---|
| Tenant Manager | src/aml/cloud/tenant.py | Multi-tenant isolation |
| Compliance Tracker | src/aml/cloud/compliance.py | GMP conformance tracking |
| Metering | src/aml/cloud/metering.py | Usage metering for billing |
| Portal Auth | src/aml/cloud/portal_auth.py | Email/password signup + JWT sessions |
Cryptographic primitives
All layers share a common provenance module (src/aml/provenance.py):
| Primitive | Algorithm | Usage |
|---|---|---|
| Content addressing | BLAKE2b-128 | Fact IDs, decision IDs, certificate IDs |
| Corpus integrity | BLAKE2b-256 | Report hashes, corpus manifests |
| Signatures | Ed25519 | Decisions, erasure certificates, conformance reports |
Module dependency graph
app.py (FastAPI)
/ | \
ingestion cloud/* backends/*
| | |
backends/* provenance.py |
| | |
wire.py wire.py wire.py
A backend does not need the server: any object implementing the MemoryBackend protocol is directly conformance-testable in-process.
For full Cloud Platform documentation, see Cloud Platform Overview.