Platform capabilities
Platform capabilities
Section titled “Platform capabilities”sigMAX combines application generation with the services needed to run an application: relational data, files, HTTP APIs, routing, authentication, cache and operational visibility. Studio brings contracts, generation, infrastructure settings and project history into one interface.
This catalog describes capabilities present in the inspected implementation. Each project selects its infrastructure extensions, called extents, and each binary declares its permitted host operations. Selecting an extension does not grant unrestricted access to it from WASM.
Build an application around its needs
Section titled “Build an application around its needs”Business application
PostgreSQL schemas and initialization SQL, declared storage operations, generated HTTP routes and OpenAPI documents.
Document or media workflow
MinIO buckets, bounded file operations, object versions and file inspection in Studio.
Web portal
FrontMark pages, Svelte components, Traefik domains and TLS, Authentik login.
Connected backend
Policy-controlled HTTP calls, typed service invocation and Dapr event publication.
Temporary shared data
Redis-backed cache with expiration, namespace quotas and atomic counters.
Private operations
WireGuard client access, project container controls, logs and monitoring.
Verifiable generation
Validated pseudo-code, C or MoonBit compilation, agreements, API test evidence and drift inspection.
VM execution
COS2000’s WASM services, native primitives, module management, local administration and execution metrics for the Pro architecture.
These are building blocks for application designs. The contracts, bindings, selected extensions and delivered deployment determine which are active in a particular installation.
Data and files
Section titled “Data and files”Relational data · PostgreSQL
- Generate storage configuration, schema documents, ER diagrams and versioned initialization SQL.
- Inspect databases, tables, views, routines and row previews in Studio.
- Use AI-assisted schema design, sample-data proposals and component proposals from selected fields or operations.
- Call declared storage operations through the host; handlers receive no database password or arbitrary SQL access.
Files and objects · MinIO
- Named buckets; list, upload, download and delete through the file service.
- Versioned project artifacts, snapshots and restoration tools in Studio.
Application files and project snapshots serve different purposes.
Cache · Redis or local
- Read, write, delete and increment; writes require expiration.
- Redis shares cache across Rust runtimes; without it, cache uses bounded process memory.
- Request-local state has a separate, shorter lifetime.
Networking and identity
Section titled “Networking and identity”Routes and TLS · Traefik
- Publish declared domains and routes for applications, components, handlers or a frontend.
- Rewrite paths; automate certificates with ACME HTTP-01 or DNS-01.
- Keep internal database and file services separate from public routes.
Authentication · Authentik
- Studio generates account and service-token configuration.
- Frontend: OIDC with PKCE. Backend: Traefik forward-auth on configured routes.
- Groups and entitlements can supply roles and permissions.
- The Rust host exposes subject, selected claims and a tenant identifier when supplied by the trusted integration.
Private access · WireGuard
- Manage VPN configuration and clients, with QR codes and standard configuration downloads.
- Monitoring declares a WireGuard dependency; Studio also proxies queries through its own interface.
Explore routing, TLS, identity and VPN
APIs, events and document processing
Section titled “APIs, events and document processing”| Capability | What application code can do |
|---|---|
| HTTP inputs and responses | Read typed inputs, route parameters and headers; select status and headers; return bounded structured responses. |
| Outbound HTTP | Call targets permitted by route policy, with method, path, size and timeout controls. |
| Service invocation | Call a named operation using its declared input and output types. |
| Events | Publish JSON or typed payloads to a configured Dapr pub/sub binding. |
| ObjectIR | Construct typed, nested API output without assembling raw JSON strings. |
| DocIR | Construct documents rendered as escaped HTML, Markdown or bounded PDF. |
| Data helpers | Work with fixed-point decimals, UTF-8, dates, UUIDs, regex, CSV rows, bounded XML and gzip/Zstd compression. |
| Cryptography | Hash and encode data, use HMAC through host-owned secret references, and verify Ed25519 or RSA-PSS signatures through approved public-key references. |
Runtime integrations, primitives and ObjectIR / DocIR explain the contracts and limits behind these operations. A helper family is not an unrestricted system library: filesystem access, raw sockets, native processes and WASI imports are outside the generated business-module profile.
Studio and frontend authoring
Section titled “Studio and frontend authoring”Studio manages projects, contracts, generation jobs and the resulting artifacts. Generation follows dependency graphs with bounded parallelism, visible attempts and task relaunch. Separate C and MoonBit backends produce WASM; agreements connect the output to contracts and validation evidence.
The interface also exposes extension settings, container state and logs, database inspection, buckets, project snapshots and generated API documentation. Its FrontMark workspace manages pages, site settings, branding images and reusable Svelte components, then builds and tests the frontend behind a declared ingress.
Explore Studio · Understand generation · Publish with FrontMark
Observe and diagnose
Section titled “Observe and diagnose”The monitoring extent combines cAdvisor, VictoriaMetrics and Zipkin. Studio displays container CPU, memory and network activity, while runtime primitives provide bounded log, metric and trace events. COS2000 has a separate executor metrics surface for invocations, fuel, memory and engine diagnostics.
Observability distinguishes collected container metrics, application instrumentation and the additional integration needed to correlate a Pro request across its executor VM.
Select the infrastructure extensions
Section titled “Select the infrastructure extensions”The current registry contains eight project extensions:
| Extent | Main role | Declared dependencies |
|---|---|---|
| PostgreSQL | Relational storage, storage service and initialization SQL | None |
| MinIO | Object storage and file service | None |
| Traefik | Public routing and TLS | None |
| FrontMark UI | Application frontend and its runtime | Traefik |
| WireGuard | Private VPN access | None |
| Redis | Shared bounded application cache | Traefik |
| Authentik | Accounts, tokens and frontend/API authentication | Traefik, PostgreSQL |
| Monitoring | Container metrics and tracing services | WireGuard |
These dependencies describe the current project registry. For example, Redis remains a private cache backend used by the Rust runtime; its registry dependency on Traefik does not make it an HTTP reverse proxy. Studio’s own job queues and artifact store are also distinct from application extents.
Core, Pro and COS2000
Section titled “Core, Pro and COS2000”Core runs Host and Config together through Docker Compose, with WASM inside the containerized runtime and no dedicated executor VM. Pro places the platform on Kubernetes and runs COS2000 in KubeVirt VMs. Both editions are proprietary.
The services above describe implemented mechanisms, not an edition pricing matrix. The inspected application topology uses the Docker Engine API. COS2000 supplies its own native executor and host primitives; moving an application to Pro requires compatible bindings and deployment integration, rather than copying the Rust runtime’s configuration unchanged.