Architecture and security

Trust boundaries

• Panel: identity, authorization, AI orchestration, dynamic automation, approval policy, Plugin runtime and durable audit history.
• Daemon: generic host execution with signed, scoped and replay-resistant command capabilities.
• Registry: independent publisher identity, package review, signing, immutable public catalog and revocation data.
• Wiki: static, reviewed Markdown. It has no account, database, business API or runtime secret.

Panel reads only Registry public metadata and immutable package content. It does not send Panel sessions or users to Registry. Wiki and Registry share only ordinary public navigation links.

Authorization

Server-side permission checks are repeated at the final transaction or command boundary. Dynamic jobs inherit their owner and Workspace assignment; a schedule does not create additional authority. Cross-server file operations require the same user to hold access to every source and destination Workspace.

Failure isolation

Registry downtime does not stop core Panel operation or already installed Plugins. Wiki downtime affects documentation only. Redis loss may reduce cache availability but does not replace PostgreSQL policy authority. A Daemon cannot use Plugin or AI credentials because it never receives them.