Architecture Overview: Artemis, Driad, and the Agent

StateWarden utilizes a decoupled, Zero-Trust architecture. By separating the Control Plane from the Data Plane and assigning processing tasks to the endpoint Agent, the system scales linearly and maintains cryptographic privacy.

1. Core Components

StateWarden operates through three specialized components. Initial provisioning is established using Post-Quantum Cryptography (ML-KEM/Kyber), after which all components communicate exclusively over mutually authenticated TLS (mTLS) channels.

The Agent: Edge-Compute & Cryptography

The StateWarden Agent is a compiled binary deployed on endpoints (Windows and Linux).

• Local Deduplication: The Agent chunks and hashes data locally. It only transmits data blocks that are unique across the Realm, reducing network bandwidth requirements.
• PrimeKEM Engine: Before data transmission, the Agent encrypts data using the Cascade Cryptography model. The encryption key resides only in the volatile memory of the Agent.
• Direct Data Transfer: The Agent interacts directly with the Data Plane for data transmission, avoiding routing data through a central server.

Artemis: The Control Plane (Orchestration)

Artemis is the orchestration layer responsible for scheduling, policy enforcement, Role-Based Access Control (RBAC), and monitoring.

• Metadata Broker: Artemis manages metadata (e.g., backup schedules and status) but does not process or store actual data blocks or decryption keys. During agent pairing, Artemis provisions identities using a PQ-Hybrid Payload (Kyber + AES-256-GCM).
• Quota Engine: Artemis balances load across the Data Plane, schedules tasks to prevent network spikes, and enforces usage quotas per device.

Driad: The Data Plane (Storage)

Driad nodes provide the storage infrastructure for the encrypted data blocks.

• Immutable Blob Storage: Driad receives encrypted chunks from the Agents and organizes them via content-addressable storage (CAS) to support deduplication.
• Distributed Architecture: Driad operates on a "Device Affinity" model. Artemis balances incoming backup streams across the available storage nodes.
• Equivalence Validation: Driad performs Read-After-Write (RAW) verification on chunks to ensure the data written to disk matches the hash generated by the Agent.

2. The Interaction Flow: Backup Execution

1. Command: Artemis evaluates a Backup Policy and dispatches a JSON START_BACKUP payload to the target Agent via a Redis-backed message queue.
2. Processing: The Agent receives the task, creates a snapshot (using Smart CBT or VSS), chunks the data, and encrypts it using PrimeKEM.
3. Transmission: The Agent establishes an mTLS connection to the assigned Driad node and streams the encrypted chunks.
4. Finalization: The Agent compiles a Backup Manifest, encrypts it, sends it to Driad, and signals Artemis that the task has completed.

3. Security Perimeter

Due to the decoupled architecture:

• The Control Plane (Artemis) does not have access to data blocks or decryption keys.
• The Data Plane (Driad) stores encrypted, deduplicated binary blobs without context or decryption keys.

This compartmentalization restricts access to the plaintext data to the endpoint Agent.