Skip to main content

alphaswarm-core

The FastAPI gateway for the AlphaSwarm runtime. Every business route (strategies, bots, backtests, RL experiments, analysis runs, agents, ingestion, ml-mcp, terraform, tenancy, paper trading, kill switch) is mounted on this pod. The control plane (alphaswarm-cp) is a sibling service, not a parent — /manage/* lives there.

Identity​

FieldValue
Service idalphaswarm-core
Roleapi
Packagealphaswarm/
Image (key)api
Built fromalphaswarm_platform/Dockerfile (target api, multi-arch amd64+arm64, Chainguard Wolfi base, uv install)

Wire​

FieldValue
ProtocolHTTP/1.1 + HTTP/2 + WebSocket
Port8000
HealthGET /readyz (ready) / GET /healthz (live)
Public URL— (private; reached through the per-cell ingress / app.alpha-swarm.ai BFF for SPA traffic)
OIDC issuer for tokens it acceptsMsalEntraValidator (Entra primary) → Auth0 fallback per identity.md

Deployment surfaces​

SurfaceWhere
Compose (local dev)service api in alphaswarm_platform/compose/docker-compose.yml; also alphaswarm-core in deployments/compose/docker-compose.local.yml
Kustomizedeployments/kubernetes/base/alphaswarm-core/ — Deployment + Service + HPA + PDB
AQP CRAQPMonolith — render path emits Deployment + Service + ConfigMap + (optional) Ingress
Terraform templatereachable through every aws-*-cell / gcp-full-cell / azure-full-cell template (see services.md)

Dependencies​

Upstream services this pod calls:

  • postgres (5432) — primary OLTP + Alembic migrations.
  • redis (6379) — session, semantic cache, kill-switch key, Celery broker.
  • neo4j (7687) — ownership graph + lineage DAG.
  • chromadb (8001) and milvus — vector search (when feature flag on).
  • mlflow (5000) — model registry.
  • otel-collector (4317) — OTLP traces + metrics + logs.
  • polaris / Iceberg REST + minio — lakehouse reads/writes (via DataMCP).
  • alphaswarm-cp (/manage/*) — workload lifecycle calls (control plane).

Downstream callers (HTTP-only):

  • alphaswarm-client — Vite SPA + FastAPI gateway.
  • alphaswarm-ui — Next.js dashboard (BFF routes proxy to here).
  • alphaswarm-admin — internal admin (audit-first surface).
  • alphaswarm-ide — Theia IDE (MCP-driven research copilot).
  • alphaswarm-cli — operator CLI.
  • alphaswarm-worker — Celery worker (calls back for progress / lookups).
  • Bot pods (per-cell QuantBot CRs).

Key routes​

The route tree is the union of alphaswarm/api/routes/*.py. Key prefixes:

PrefixConcept doc
/strategies/*, /bots/*, /backtests/*strategy-framework.md
/agents/*, /workflows/*, /labs/*agents.md
/rl/*rl-framework.md
/data/*, /ingest/*, /lineage/*data-plane.md
/ml/*, /predictors/*ml-framework.md
/terraform/*terraform-control-plane.md
/tenancy/*, /membership/*identity.md
/halt, /kill-switchobservability.md
/mcp/* (multiple servers)data-mcp.md
/ws/*WebSocket progress streams

Operations​

  • Scaling: HPA target cpu=70%, min=3 / max=12 in prod; min=1 / max=3 in dev.
  • Disruption: PDB minAvailable=2 in prod; 0 in dev.
  • Step-up MFA: destructive routes (/manage/terraform/apply, /manage/credentials/cloud-cli/*, /halt) require RFC 9470 acr=high. See auth-stepup-and-byok.
  • Audit: every state-mutating action lands a workload_runs row through WorkloadRuntime; every Terraform action lands a terraform_runs row through TerraformRuntime.
  • Redaction: WorkloadRuntime strips secrets from audit payloads per the always-on alphaswarm-management-engine rule. Token prefixes (4 chars max) are only printed behind an explicit --unsafe-print-token-prefixes operator flag.

See also​