31 KiB
31 KiB
Ops/DevOps Portfolio: Strategic Positioning
Executive Summary
This document analyzes the five-project portfolio from the Ops/DevOps perspective, positioning them against established market tools:
| Project | Domain | Competes With |
|---|---|---|
| Provisioning | IaC + Orchestration | Terraform, Pulumi, Ansible, CloudFormation |
| SecretumVault | Secrets Management | HashiCorp Vault, AWS Secrets Manager, Azure Key Vault |
| Vapora | Agent Orchestration | Jenkins, GitHub Actions, Tekton, ArgoCD |
| TypeDialog | Configuration + IaC Gen | Terraform modules, Cookiecutter, Yeoman |
| Kogral | Knowledge Management | Confluence, Notion, Internal wikis |
1. Ops Functionality Matrix
Capabilities per Project
| Capability | Provisioning | SecretumVault | Vapora | TypeDialog | Kogral |
|---|---|---|---|---|---|
| Multi-cloud | AWS, UpCloud, Local | N/A (storage agnostic) | N/A | Yes (prov-gen) | N/A |
| Declarative IaC | Nickel (typed) | N/A | N/A | Generates Nickel | N/A |
| Secrets management | Integrates KMS | ✅ 4 engines | Uses vault | N/A | N/A |
| Orchestration | Rust orchestrator | N/A | NATS JetStream | N/A | N/A |
| Post-Quantum Crypto | Via SecretumVault | ✅ ML-KEM/ML-DSA | N/A | N/A | N/A |
| Automatic rollback | ✅ Checkpoints | N/A | Pipeline rollback | N/A | N/A |
| Policy engine | Cedar RBAC/ABAC | Cedar ABAC | Cedar multi-tenant | N/A | N/A |
| Audit logging | 7 years retention | ✅ Complete | ✅ SurrealDB | N/A | Git history |
| AI-assisted | MCP + RAG | N/A | LLM routing | Agent backend | MCP search |
| REST API | Axum control-center | Axum vault API | Axum backend | Axum web backend | N/A (MCP) |
| Storage backends | SurrealDB | FS/etcd/SurrealDB/PostgreSQL | SurrealDB + NATS | Multi-format | FS + SurrealDB |
| CLI | 80+ shortcuts | svault CLI | vapora CLI | typedialog CLI | kogral CLI |
Common Technology Stack (Ops Perspective)
┌─────────────────────────────────────────────────────────────────┐
│ SHARED TECHNOLOGIES │
├─────────────────────────────────────────────────────────────────┤
│ Language: Rust (performance, memory-safety) │
│ Config: Nickel (pre-runtime validation, lazy eval) │
│ DB: SurrealDB (multi-model, scopes, time-series) │
│ Web: Axum (async, composable routing) │
│ Messaging: NATS JetStream (at-least-once, persistence) │
│ Policy: Cedar (ABAC, AWS-compatible) │
│ Crypto: OpenSSL, OQS (PQC), AWS-LC, RustCrypto │
│ Logging: tracing (structured, JSON output) │
└─────────────────────────────────────────────────────────────────┘
2. Positioning vs Competition (Ops Tools)
Provisioning vs Terraform
| Aspect | Provisioning | Terraform |
|---|---|---|
| IaC Language | Nickel (typed, lazy) | HCL (untyped) |
| Validation | Pre-runtime (compilation) | Runtime (terraform plan) |
| Multi-cloud | AWS, UpCloud, Local | Yes (100+ providers) |
| AI native | MCP + RAG (1000x Python) | Terraform Cloud AI (limited) |
| Orchestration | Rust hybrid orchestrator | State file + lock |
| Rollback | Automatic with checkpoints | Manual (terraform destroy) |
| Security | 39K lines (12 components) | Vault plugin, external |
| Ecosystem | ⚠️ Small | ✅ Huge (Terraform Registry) |
| Learning curve | High (Nickel + Nushell) | Moderate (familiar HCL) |
| Best For | Rust teams, typed IaC, AI-assisted | General use, large ecosystem |
Key differentiator: Provisioning combines typed declarative IaC (Nickel) with AI-assisted generation (MCP + RAG) and hybrid Rust/Nushell orchestration, eliminating configuration errors at compile time.
Provisioning vs Pulumi
| Aspect | Provisioning | Pulumi |
|---|---|---|
| IaC Language | Nickel (functional) | TypeScript/Python/Go |
| Paradigm | Declarative | Imperative (code) |
| State management | SurrealDB multi-model | Pulumi Cloud / self-hosted |
| Secrets | SecretumVault integrated | Pulumi ESC (SaaS) |
| Multi-cloud | AWS, UpCloud, Local | Yes (100+ providers) |
| AI-assisted | MCP + RAG native | Pulumi AI (experimental) |
| Testing | Nickel contracts | Unit tests in code |
| Best For | Pure declarative, typed IaC | Developers, imperative code |
Key differentiator: Provisioning is pure declarative (Nickel) vs imperative (Pulumi code), with pre-runtime validation and Rust orchestrator for complex workflows.
Provisioning vs Ansible
| Aspect | Provisioning | Ansible |
|---|---|---|
| Paradigm | Declarative (Nickel IaC) | Imperative (playbooks) |
| Agentless | Yes (SSH) | Yes (SSH) |
| Idempotence | Nickel contracts | YAML tasks (depends on module) |
| Performance | Rust orchestrator (10-50x) | Python interpreter |
| Multi-cloud | AWS, UpCloud, Local | Yes (cloud modules) |
| Dependency resolution | Automatic topological sort | Manual (pre_tasks, post_tasks) |
| Rollback | Automatic with checkpoints | Manual (rescue blocks) |
| Best For | Typed IaC, critical performance | Configuration management, ad-hoc |
Key differentiator: Provisioning is declarative IaC (not imperative playbooks) with Rust orchestrator 10-50x faster than Python, automatic rollback and topological dependency resolution.
SecretumVault vs HashiCorp Vault
| Aspect | SecretumVault | HashiCorp Vault |
|---|---|---|
| Language | Rust (memory-safe) | Go (CGO overhead) |
| Post-Quantum | ✅ ML-KEM-768, ML-DSA-65 | ❌ No roadmap |
| Crypto backends | 4 (OpenSSL, OQS, AWS-LC, RustCrypto) | 1 (OpenSSL) |
| Storage backends | 4 (FS, etcd, SurrealDB, PostgreSQL) | 10+ (etcd, Consul, S3, etc) |
| Policy engine | Cedar ABAC (AWS-compatible) | HCL policies |
| Shamir unsealing | ✅ Native | ✅ Native |
| Secrets engines | 4 (KV, Transit, PKI, Database) | 10+ (includes cloud-specific) |
| Ecosystem | ⚠️ Small | ✅ Huge (plugins, integrations) |
| License | Apache-2.0 | BSL (Enterprise paywall) |
| Best For | PQC today, Rust stacks, data sovereignty | General use, mature ecosystem |
Key differentiator: SecretumVault is the only Rust vault with production-ready post-quantum cryptography (ML-KEM-768, ML-DSA-65 NIST FIPS 203/204), providing cryptographic agility for organizations deploying today.
SecretumVault vs AWS Secrets Manager
| Aspect | SecretumVault | AWS Secrets Manager |
|---|---|---|
| Multi-cloud | ✅ Any cloud or on-premise | ❌ AWS-only |
| Self-hosted | ✅ Full control | ❌ SaaS only |
| Post-Quantum | ✅ ML-KEM + ML-DSA | ❌ None |
| Crypto backends | 4 pluggable | 1 (AWS KMS) |
| Dynamic secrets | ✅ Database engine | ✅ RDS integration |
| Vendor lock-in | ✅ Portable | ⚠️ High (AWS-specific) |
| Cost | Self-hosted (infra cost) | $0.40/secret/month + API calls |
| Best For | Multi-cloud, PQC, data sovereignty | AWS-native apps, managed service |
Key differentiator: SecretumVault is multi-cloud and self-hosted with native PQC, vs AWS Secrets Manager cloud-only without post-quantum roadmap.
Vapora vs Jenkins
| Aspect | Vapora | Jenkins |
|---|---|---|
| Paradigm | Agent orchestration (AI) | Pipeline orchestration (CI/CD) |
| Agents | LLM-powered (Claude, GPT, Gemini) | Build agents (workers) |
| Orchestration | NATS JetStream | Master-worker |
| Learning | Expertise profiles, recency bias | No (static) |
| Budget control | Per-role limits, fallback | N/A |
| Pipeline definition | Tasks + agent roles | Jenkinsfile (Groovy) |
| UI | Leptos WASM (Kanban) | Web UI (Java) |
| Best For | AI-assisted operations, LLM orchestration | Traditional CI/CD, build automation |
Key differentiator: Vapora orchestrates intelligent LLM agents with learning and cost control, not traditional build agents.
Vapora vs GitHub Actions
| Aspect | Vapora | GitHub Actions |
|---|---|---|
| Self-hosted | ✅ Kubernetes native | ✅ Self-hosted runners |
| Agents | LLM-powered with roles | Workflow runners |
| Orchestration | NATS JetStream | GitHub infrastructure |
| Learning | Expertise profiles | No (static) |
| Budget control | LLM cost limits | Minutes-based billing |
| Multi-tenant | SurrealDB scopes + Cedar | Repository-level |
| Best For | AI operations, agent coordination | GitHub-native CI/CD, simple workflows |
Key differentiator: Vapora is an AI agent orchestration platform with learning, not a CI/CD workflow runner.
TypeDialog (prov-gen) vs Terraform Modules
| Aspect | TypeDialog (prov-gen) | Terraform Modules |
|---|---|---|
| Input method | TOML forms (CLI/TUI/Web) | Variables (.tfvars) |
| Validation | Nickel contracts (pre-runtime) | Variable validation (runtime) |
| Output format | Nickel IaC | HCL |
| Multi-backend | 6 (CLI/TUI/Web/AI/Agent/Prov-gen) | CLI only |
| IaC generation | Tera templates + validation | Module composition |
| Best For | Interactive wizards, self-service | Reusable modules, Terraform ecosystem |
Key differentiator: TypeDialog unifies input capture (CLI/TUI/Web) with validated IaC generation (Nickel), not just reusable modules.
Kogral vs Confluence
| Aspect | Kogral | Confluence |
|---|---|---|
| Target | Development/ops teams | General teams |
| Git-native | ✅ Markdown + YAML frontmatter | ❌ Cloud/Server |
| Node types | 6 specialized (ADR, Pattern, etc) | Generic pages |
| MCP Server | ✅ Claude Code native | ❌ No |
| Semantic search | fastembed + cloud embeddings | Internal search |
| Self-hosted | ✅ Filesystem + SurrealDB | Cloud or Data Center |
| Best For | Dev/Ops knowledge, AI integration | General documentation, wikis |
Key differentiator: Kogral is specifically designed for technical knowledge (runbooks, ADRs, postmortems) with native AI integration via MCP.
3. Use Cases and Context (Ops Perspective)
When to Use Each Project
┌─────────────────────────────────────────────────────────────────┐
│ "I need to provision multi-cloud infrastructure with IaC" │
│ → Provisioning (Nickel IaC, multi-cloud, orchestrator) │
├─────────────────────────────────────────────────────────────────┤
│ "I want secrets management with post-quantum preparation" │
│ → SecretumVault (PQC ML-KEM/ML-DSA, 4 crypto backends) │
├─────────────────────────────────────────────────────────────────┤
│ "I need to orchestrate AI agents for operational tasks" │
│ → Vapora (DevOps/Monitor/Security agents, NATS, budget) │
├─────────────────────────────────────────────────────────────────┤
│ "I want configuration wizards that generate IaC" │
│ → TypeDialog (prov-gen backend, CLI/TUI/Web) │
├─────────────────────────────────────────────────────────────────┤
│ "I need to preserve runbooks and incident postmortems" │
│ → Kogral (6 node types, MCP, git-native) │
└─────────────────────────────────────────────────────────────────┘
Decision Matrix by Ops Context
| Context | Main Project | Supporting Projects |
|---|---|---|
| Multi-cloud provisioning | Provisioning | TypeDialog (wizards), SecretumVault (certs), Kogral (ADRs) |
| PQC secrets management | SecretumVault | Provisioning (infrastructure), Kogral (policies) |
| Incident response | Vapora (Monitor/DevOps agents) | Kogral (runbooks/postmortems), SecretumVault (credentials) |
| CI/CD automation | Vapora (DevOps agent) | Provisioning (deploy), SecretumVault (secrets), Kogral (guidelines) |
| Infrastructure self-service | TypeDialog (prov-gen) | Provisioning (apply IaC), Kogral (docs) |
| Knowledge preservation | Kogral | Vapora (execution tracking), TypeDialog (export) |
| Disaster recovery | Provisioning (rollback) | SecretumVault (backup), Kogral (procedures) |
4. Why They Are Necessary (Ops Perspective)
Problems They Solve
Provisioning: The Fragile YAML Problem
BEFORE AFTER (Provisioning)
───────────────────────────────── ─────────────────────────────────
Untyped YAML, runtime errors Typed Nickel, compile-time errors
Fragile imperative scripts Declarative workflows with rollback
Terraform state drift SurrealDB with time-series
No AI assistance MCP + RAG (1000x Python)
Manual dependency management Automatic topological sort
SecretumVault: The Quantum Cryptography Problem
BEFORE AFTER (SecretumVault)
───────────────────────────────── ─────────────────────────────────
Vault in Go (no memory-safety) Rust with memory guarantees
Classical crypto only (vulnerable) Post-quantum (ML-KEM, ML-DSA)
Fixed crypto backend Pluggable backends (agility)
SaaS lock-in (AWS, Azure) Complete self-hosted
No quantum threat preparation Deploy PQC today, gradual migration
Vapora: The Manual Ops Coordination Problem
BEFORE AFTER (Vapora)
───────────────────────────────── ─────────────────────────────────
Ad-hoc scripts without coordination NATS JetStream orchestration
LLMs without cost control Budget enforcement + fallback
Agents without historical context Expertise profiles + recency bias
Manual handoffs (deploy → monitor) Automated pipelines with roles
No execution visibility Prometheus metrics + SurrealDB
TypeDialog (prov-gen): The Manual Configuration Problem
BEFORE AFTER (TypeDialog)
───────────────────────────────── ─────────────────────────────────
Error-prone manual configuration Validated forms (Nickel)
CLI ≠ Web ≠ TUI interfaces 1 TOML → 6 backends
No IaC generation prov-gen → multi-cloud Nickel
Runtime validation Pre-runtime validation (contracts)
Kogral: The Lost Ops Knowledge Problem
BEFORE AFTER (Kogral)
───────────────────────────────── ─────────────────────────────────
Scattered Confluence runbooks Git-native, versioned
Unsearchable postmortems Semantic search + MCP
Lost infrastructure ADRs Decision nodes with relationships
Incidents without historical context Execution nodes with timeline
SRE onboarding takes weeks Semantic search in days
5. What Makes Them Different (Ops Perspective)
Unique Features per Project
Provisioning
- Nickel IaC: Only with lazy-eval typed language as primary (not HCL, not YAML)
- Hybrid orchestrator: Rust (performance) + Nushell (flexibility)
- MCP 1000x faster: Rust-native vs Python implementations
- 39K lines security: 12 enterprise components (JWT, Cedar, MFA, audit, KMS)
- 80+ CLI shortcuts: Optimized developer experience with guided wizards
SecretumVault
- Native Post-Quantum: ML-KEM-768, ML-DSA-65 (NIST FIPS 203/204) production-ready today
- 4 crypto backends: OpenSSL, OQS, AWS-LC, RustCrypto (cryptographic agility without code changes)
- 4 storage backends: Filesystem, etcd, SurrealDB, PostgreSQL (deployment flexibility)
- Shamir Secret Sharing: Distributed unsealing with configurable threshold (3-of-5, 5-of-7, etc)
- Cedar ABAC: AWS-compatible authorization policies (portable, no vendor lock-in)
Vapora
- Learning-based selection: Scoring
0.3*load + 0.5*expertise + 0.2*confidencewith 3x recency bias (last 7 days) - Budget enforcement: Per-role hard caps (monthly/weekly) with automatic fallback to cheaper providers
- NATS JetStream: At-least-once coordination, message persistence, distributed
- 12 agent roles: Architect, Developer, CodeReviewer, Tester, Documenter, Marketer, Presenter, DevOps, Monitor, Security, ProjectManager, DecisionMaker
- Native multi-tenant: SurrealDB scopes + Cedar RBAC, complete isolation
TypeDialog
- 6 unified backends: CLI/TUI/Web/AI/Agent/Prov-gen from same TOML
- Prov-gen IaC generation: AWS/GCP/Azure/Hetzner/UpCloud from typed forms
- Nickel contracts: Pre-runtime validation with type-safe schemas
- 3,818 tests: Exhaustive coverage (503% growth), production-ready
- Native multi-language: Fluent bundles for i18n without reimplementing logic
Kogral
- 6 specialized node types: Note, Decision (ADR), Guideline, Pattern, Journal, Execution (for ops/incidents)
- Hybrid embeddings: Local fastembed (privacy) + cloud (production)
- Native MCP: 7 tools for Claude Code, no extra configuration required
- Git-native: Everything versioned markdown, no external SaaS, full control
- Guideline inheritance: Org → Project with priority, cross-team consistency
6. Synergies and Reuse (Ops Workflows)
Ops Integration Flow
┌──────────────────┐
│ Kogral │
│ (Runbooks, ADRs) │
└────────┬─────────┘
│ Operational knowledge
▼
┌──────────────┐ ┌──────────────────┐ ┌──────────────┐
│ TypeDialog │───▶│ Vapora │───▶│ Provisioning │
│ (Wizards) │ │ (Ops Agents) │ │ (IaC Deploy) │
└──────────────┘ └──────────────────┘ └──────────────┘
│ │ │
│ Configuration │ Orchestration │ Infrastructure
▼ ▼ ▼
┌─────────────────────────────────────────────────────────────┐
│ SECRETUMVAULT │
│ PKI certs │ Dynamic DB creds │ API keys │ Encryption │
└─────────────────────────────────────────────────────────────┘
Reusable Components (Ops Stack)
| Component | Origin | Reused In |
|---|---|---|
| SurrealDB schemas | Vapora | Kogral, Provisioning, SecretumVault (optional) |
| Nickel contracts | Provisioning | TypeDialog (prov-gen validation) |
| Cedar policies | Provisioning | SecretumVault, Vapora (multi-tenant) |
| Axum API patterns | Vapora | Provisioning (control-center), SecretumVault (vault API) |
| tracing setup | Vapora | All (structured logging) |
| Crypto backends | SecretumVault | Provisioning (KMS integration) |
| NATS patterns | Vapora | Provisioning (future messaging), SecretumVault (HA) |
Synergy Scenarios (Ops Workflows)
Scenario 1: Zero-Touch Provisioning with AI
1. TypeDialog (prov-gen): SRE completes web wizard
- Cloud provider, region, cluster size, services
- Generates Nickel IaC validated with contracts
2. Kogral: MCP provides deployment guidelines
- "What is our cluster naming policy?"
- "What security groups do we apply by default?"
3. Provisioning: Orchestrator deploys infrastructure
- Servers → networking → storage → services
- Checkpoints per step, automatic rollback if fails
4. SecretumVault: Generates certificates and secrets
- PKI engine: etcd, kube-apiserver, kubelet certs (ML-DSA-65 PQC)
- Database engine: PostgreSQL dynamic credentials (TTL 1h)
5. Vapora: Post-deployment automation
- Monitor Agent: Setup Prometheus alerts, health checks
- Security Agent: Vulnerability scan, compliance check
- DevOps Agent: Deploy baseline apps (Ingress, cert-manager)
6. Kogral: Documents deployment
- Execution node with timestamp, created resources, configuration
- Links to architecture ADRs, maintenance runbooks
Scenario 2: Automated Incident Response
1. Vapora Monitor Agent: Detects anomaly (PostgreSQL down)
- Alert via NATS JetStream
- Trigger incident response pipeline
2. Kogral: Claude Code queries runbooks via MCP
- search("postgresql outage troubleshooting")
- Returns 3 similar postmortems with resolutions
3. Vapora DevOps Agent: Executes automated runbook
- Verify PostgreSQL process (systemctl status)
- Check logs (/var/log/postgresql)
- Restart if needed with adjusted parameters
4. SecretumVault: Rotates compromised credentials
- Database engine generates new dynamic credentials
- Updates connected apps via secret injection
5. Vapora Security Agent: Post-incident audit
- Review access logs, configuration changes
- Generate compliance report
6. Kogral: Documents postmortem
- Execution node with root cause, timeline, resolution
- Links to PostgreSQL configuration ADRs
- Action items to prevent recurrence
Scenario 3: Gradual Post-Quantum Migration
1. Kogral: Documents strategic decision
- ADR: "Gradual migration to post-quantum cryptography"
- Rationale: Preparation for quantum threats (harvest now, decrypt later)
- Timeline: Q1 2026 testing, Q2 2026 staging, Q3 2026 production
2. SecretumVault: Migrates secrets in staging
- Backend switch: openssl → oqs (ML-KEM-768)
- Re-encrypts existing secrets with PQC
- Dual-stack: classical for legacy, PQC for new services
3. Provisioning: Updates PKI infrastructure
- Generates new certificates with ML-DSA-65 (PQC signatures)
- Deploys certificates to services (etcd, K8s API, service mesh)
- Health checks: latency not degraded, handshakes correct
4. Vapora: Orchestrates comprehensive validation
- Security Agent: Verifies correct cryptographic algorithms
- Monitor Agent: Benchmark latency (PQC vs classical)
- DevOps Agent: Integration tests with PQC certificates
5. TypeDialog: Self-service portal for teams
- Form: "Migrate service to PQC"
- Input: service name, migration strategy (gradual/immediate)
- prov-gen: Generates updated configuration (Nickel)
6. Kogral: Migration tracking
- Execution nodes per migrated service
- Metrics: services migrated, performance impact, issues
- Lessons learned: what worked, what to improve
Scenario 4: Multi-Cloud Disaster Recovery
1. Kogral: Disaster recovery runbook
- Procedure: "Failover from AWS to UpCloud in <1h"
- Prerequisites, detailed steps, validation
2. Vapora: Automatic trigger (AWS region down)
- Monitor Agent detects regional outage
- ProjectManager Agent declares disaster recovery mode
- DevOps Agent executes Kogral runbook
3. Provisioning: Deploys replica on UpCloud
- Multi-cloud Nickel IaC (change: provider = "upcloud")
- Orchestrator deploys: servers → networking → K8s → apps
- Checkpoints: rollback to AWS if UpCloud also fails
4. SecretumVault: Synchronizes secrets
- Cross-region etcd replication (AWS → UpCloud)
- PKI engine generates certificates for UpCloud region
- Database engine: new DB dynamic credentials
5. TypeDialog: DNS failover wizard
- Form: Update DNS records (Route53 → NS1)
- Validation: TTL check, propagation time
6. Kogral: Documents incident
- Execution node: timeline, decisions, metrics
- RTO achieved, RPO achieved, issues encountered
- Postmortem: what to improve in runbook
7. Dependencies and Adoption Order (Ops Teams)
Dependency Graph
SecretumVault (standalone)
│
│ provides secrets to
▼
Kogral ◄────────────────────────► Provisioning
(standalone) (can integrate vault)
│ │
│ provides runbooks to │ deploys infrastructure for
▼ ▼
Vapora
(integrates all)
│
│ uses wizards from
▼
TypeDialog
(prov-gen → Provisioning)
Recommended Adoption Order (Ops Perspective)
| Phase | Project | Reason | Dependencies |
|---|---|---|---|
| 1 | SecretumVault | Critical secrets management, no dependencies | None (standalone) |
| 2 | Kogral | Operational knowledge base (runbooks, ADRs) | None (standalone) |
| 3 | Provisioning | Declarative IaC, can integrate SecretumVault (optional) | Optional: SecretumVault (KMS) |
| 4 | TypeDialog | Configuration wizards, prov-gen for Provisioning | Optional: Provisioning (IaC apply) |
| 5 | Vapora | Agent orchestration, integrates all previous | Kogral (runbooks), SecretumVault (creds), Provisioning (deploy) |
Note: Each project is functional independently, but synergies emerge with progressive adoption.
8. Ecosystem Comparison
STRATUMIOPS Ops vs HashiCorp Stack
| Component | STRATUMIOPS | HashiCorp |
|---|---|---|
| IaC | Provisioning (typed Nickel) | Terraform (untyped HCL) |
| Secrets | SecretumVault (Rust, PQC) | Vault (Go, no PQC) |
| Orchestration | Vapora (LLM agents) | Nomad (workload scheduler) |
| Service Mesh | Integrates Istio | Consul Connect |
| Policy | Cedar (AWS-compatible) | Sentinel (HCL) |
| Language | Rust (memory-safe) | Go (garbage collector) |
| AI-assisted | MCP + RAG native | Terraform Cloud AI (limited) |
| License | Apache-2.0 | BSL (Enterprise paywall) |
| Ecosystem | ⚠️ Small | ✅ Huge |
STRATUMIOPS Ops vs AWS Native Stack
| Component | STRATUMIOPS | AWS Native |
|---|---|---|
| IaC | Provisioning (multi-cloud) | CloudFormation (AWS-only) |
| Secrets | SecretumVault (PQC, self-hosted) | Secrets Manager (SaaS, no PQC) |
| Orchestration | Vapora (self-hosted K8s) | Step Functions (SaaS) |
| CI/CD | Vapora DevOps Agent | CodePipeline + CodeBuild |
| Storage | SurrealDB multi-model | DynamoDB + RDS |
| Policy | Cedar (portable) | IAM (AWS-specific) |
| Multi-cloud | ✅ AWS/UpCloud/Local | ❌ AWS-only |
| Vendor lock-in | ✅ Portable | ⚠️ High |
| Cost | Self-hosted (infra cost) | SaaS (per-use billing) |
9. Portfolio Metrics (Ops Perspective)
| Metric | Provisioning | SecretumVault | Vapora | TypeDialog | Kogral | Total |
|---|---|---|---|---|---|---|
| Lines of Code | ~40K | ~11K | ~50K | ~90K | ~15K | ~206K |
| Tests | 218 | 50+ | 218 | 3,818 | 56 | 4,360+ |
| CLI Commands | 80+ shortcuts | 10+ (svault) | 10+ (vapora) | 6 backends | 13 commands | 100+ |
| Storage Backends | SurrealDB | 4 (FS/etcd/SurrealDB/PostgreSQL) | SurrealDB + NATS | Multi-format | FS + SurrealDB | 4 backends |
| API Endpoints | 40+ (control-center) | 20+ (vault API) | 40+ (backend) | 10+ (web) | N/A (MCP) | 100+ |
| Policy Engine | Cedar RBAC/ABAC | Cedar ABAC | Cedar multi-tenant | N/A | N/A | Cedar AWS-compatible |
| Crypto Backends | 5 KMS | 4 (OpenSSL, OQS PQC, AWS-LC, RustCrypto) | N/A | N/A | N/A | 4 backends |
| Multi-cloud | AWS/UpCloud/Local | N/A | N/A | Yes (prov-gen) | N/A | 3 clouds |
10. Conclusion (Ops/DevOps Teams)
This portfolio represents a cohesive ecosystem for modern operations:
- Provisioning is the muscle: deploys multi-cloud infrastructure with typed IaC and automatic rollback
- SecretumVault is the vault: protects secrets with production-ready post-quantum cryptography
- Vapora is the brain: orchestrates Ops agents (DevOps, Monitor, Security) with learning and cost control
- TypeDialog is the interface: configuration wizards that generate validated multi-cloud IaC
- Kogral is the memory: preserves runbooks, postmortems and operational knowledge
The key differentiation versus alternatives (Ops perspective):
- Full Rust stack: Performance (10-50x Python), memory-safety, zero-cost abstractions
- Typed Nickel IaC: Configuration errors detected at compile time, not at runtime
- Post-Quantum ready: SecretumVault with native ML-KEM-768/ML-DSA-65, deploy today
- AI-native from design: MCP + RAG integrated, not retrofitted
- Unified multi-cloud: One Nickel configuration for AWS/UpCloud/Local
- Enterprise security: Cedar policies, audit logging, RBAC/ABAC, 7 years retention
The synergy between projects enables addressing operations with:
- Typed and validated infrastructure (Provisioning)
- Secrets with cryptographic agility (SecretumVault)
- Intelligent Ops agent orchestration (Vapora)
- Configuration wizards (TypeDialog)
- Preserved operational knowledge (Kogral)
Best for: DevOps/SRE teams valuing type-safety, performance, PQC readiness, multi-cloud, and self-hosted infrastructure over mature ecosystems with vendor lock-in.
Document generated: 2026-01-22 Type: info (Ops/DevOps positioning)