Deployment
Raincurve runs inside your environment by default. This page covers deployment models, components, security boundaries and how a rollout is staged.
Deployment models
| Model | Where Raincurve runs | Typical fit |
|---|---|---|
| Private | Entirely inside customer-owned infrastructure, including open-weight models | Regulated operators, GPU clouds, carriers |
| Hybrid | Collection and execution on-premises; reasoning in a dedicated environment you control | Multi-site enterprises |
| Cloud | Dedicated single-tenant environment operated with Raincurve | Cloud-first platform teams |
In every model, collection and any execution against your infrastructure happen inside your boundary.
Components
| Component | Role |
|---|---|
| Collectors | Read telemetry, inventory and change data from existing systems; read-only by default |
| Contract service | Compresses raw signals into Compact Contracts and links them to raw evidence |
| Topology service | Maintains the live cross-layer dependency graph |
| Curve-1 reasoning | Pre-filter scoring, trajectory encoding, hypothesis generation and incident clustering |
| Verification service | Checks proposed actions against live state and in-flight work |
| Sandbox runners | Execute diagnostics and approved actions in isolated Firecracker microVMs |
| Console and APIs | Incident views, approvals, reports and integrations with your tools |
Security boundaries
- Data residency. Operational telemetry stays inside the deployment boundary you choose.
- Least privilege. Collectors start read-only. Write access is granted per action type, only when automation is enabled for it.
- Isolated execution. Each task runs in its own microVM, restored from a clean copy-on-write snapshot; a failed or compromised run cannot reach the host, other sandboxes or anything outside its task.
- Audit trail. Proposals, verification results, approvals and executions are recorded with their evidence.
- Permissive open source. The underlying stack uses permissively licensed components (Apache 2.0, MIT, BSD-3, MPL 2.0).
Staged rollout
- Read-only. Collectors connect; the dependency graph is built and validated with your engineers.
- Shadow reasoning. Raincurve produces incidents and hypotheses alongside your current process; results are compared, not acted on.
- Recommendations. Hypotheses and verified action recommendations appear in your ticketing and chat tools.
- Approved actions. Engineers approve verified actions; Raincurve paces and executes them in sandboxes.
- Automatic actions. Specific, well-understood action types run automatically inside agreed limits.
Progressive automationEach step has explicit exit criteria agreed during the pilot. Moving to automatic actions is always a per-action-type decision.