Architecture
One Rust process serves the production console and runs Tally's application services. PostgreSQL and ClickHouse remain separate databases.
Production runtime#
| Component | Role |
|---|---|
| tallyd | HTTPS, embedded HTML/JavaScript/CSS, authentication, API, database migrations, connector worker, registry, and upgrade runtime. |
| PostgreSQL | Control, accounts, governance, findings, scheduling, and audit state. |
| ClickHouse | AI observation retention and durable inventory aggregates. |
The web console is built with Next.js, exported to static assets, and embedded at compile time. Production serves those assets and the API from the same origin; it needs no Node.js server or nginx.
Development separates the Next.js live-reload server from the Rust process. The application behavior is shared, while development-only routes proxy to the private Rust listener.
From a source to a finding#
- A connector reads a bounded source page, stream batch, or authorized upload.
- Normalization validates identifiers and reduces the source to the allowed observation metadata.
- Detection and resolution match provider/model identities against the registry and classify the evidence.
- ClickHouse stores admitted AI observations and inventory. PostgreSQL records ingestion receipts, findings, attribution links, and governance state.
- The console presents individual activity and its supporting evidence. Idempotent receipts keep retries from duplicating accepted work.
Unclassified cloud flows may be held briefly in an in-memory correlation window. That pending window is not durable raw-log storage and is cleared on restart.
Code and trust boundaries#
tally-core defines domain contracts; connector crates normalize source data; storage crates own database behavior; tally-api exposes product routes. apps/tallyd composes the Tally runtime, including authentication and roles.
External connector data is untrusted. Credentials use sealed storage, scanning requires explicit authorization, and browser mutations are checked against the configured public origin. The internal upgrade listener is restricted to loopback and accessed through an authenticated administrator bridge.
Gate can depend on Tally's reusable crates and web components. Tally does not depend on Gate. Gate supplies its own IAM, deployment, and enforcement, and continues to run in Docker.