Architecture

Architecture

Kiln separates the supervisor from application processes. Interfaces such as SSH call the same command layer that enforces identity and operation policy. A terminal button or an AI tool does not bypass that boundary.

SSH dashboard / local console
             |
       command policy
             |
       runtime supervisor ---- local ingress
             |
       application processes

An application groups independently deployed modules. A module release identifies an executable and its configuration. Installing or replacing one module does not require replacing the supervisor. Stable local ingress can send new connections to the ready generation while existing connections drain on the old one.

Swift package targets are build-time libraries. Runtime modules are separate executables. Loading a new application does not mean loading its native code into the supervisor's address space. Process separation contains ordinary crashes, but is not a security sandbox when workers share an OS user.

The peer layer supports explicit adoption and typed administrative operations. Scheduling, consensus, fencing, automatic failover and replicated storage are separate design work.

Details: module loading, deployment, supervision, peer control.