Sokrates System Architecture
Summary
The Sokrates architecture is a distributed managed service providing on-premises AI department capabilities to Icelandic SMEs. Four subsystems — The Box, Fleet Command, the Claude Teams Surface, and The Basis — are connected by a strict security model that separates channel I/O (Hermes) from intelligence (Eidos + customer credentials).
Details
Subsystem Overview
| Subsystem | Role | Environment |
|---|---|---|
| The Box | On-premises appliance. Runs the Sókrates Agent (Hermes periphery + intelligence layer), Eidos/Hyle knowledge graph, and MCP connectors. Two hardware tiers: DGX Spark (primary — local inference via finetuned Gemma 4 31B) and CWWK N305 (budget — coordination only, inference via Anthropic API; future: Fleet Command routing). | Customer’s office (NixOS) |
| Fleet Command | Central coordination. Hosts basis registry, distributes updates (pull model). Future: central MoE model on DGX Station GB300 for inference routing from CWWK N305 boxes. | Sokrates-controlled infrastructure |
| Managed Environments | Conversational interfaces for employees (primarily Claude Teams). Curated Skills and Projects. Integrates with The Box for operational context. | Third-party infrastructure (Anthropic, etc.) |
| The Basis | Accumulated enterprise AI deployment principles (Meta + Domain tiers). | Distributed (canonical in Fleet, cached on Box) |
The Periphery/Intelligence Split
The stack rejects monolithic agent frameworks in favor of a functional split:
- Periphery (Hermes Agent): “Ears and mouth.” Multi-channel I/O (Slack, Teams, Discord, WhatsApp, Telegram), heartbeats, session management. No access to customer system credentials.
- Intelligence (Eidos + agents): “Brain.” Knowledge graph queries, MCP tool execution, Socratic dialogue orchestration. Holds customer credentials (encrypted via
sops-nix).
This containment ensures that a communication channel compromise (e.g., Slack token theft) cannot lead to customer data exfiltration.
Security Tiers on The Box
- Tier 1 — NixOS Flake (OS-level): Declarative
nftablesrestricts outbound to Fleet Command + Anthropic API only. Auditable by customer IT. - Tier 2 — Routing Layer (Application-level): Holds encrypted credentials, manages mTLS to Fleet Command via private CA. Enforces the Generalization Boundary — scrubs telemetry via Logfire pattern scrubbing + OTel Collector with customer-specific rules.
- Tier 3 — Intelligence (Eidos/agents): Deep local access via MCP servers and knowledge graph. No direct network access — communicates outward exclusively through the Routing Layer.
Hardware Tiers
DGX Spark (Primary) — NVIDIA GB10 Grace Blackwell Superchip, 128 GB unified coherent memory, 1 PFLOP FP4. Runs the full stack including local inference via finetuned Gemma 4 31B Dense. The primary selling target — complete data sovereignty, no reasoning queries leave the building.
CWWK N305 (Budget) — Intel i3-N305, 8C/8T, up to 32GB DDR5, fanless. Coordination tier only: runs Hermes, Eidos, Neo4j, MCP connectors. Complex inference routes to Anthropic (Claude) by default, or another provider if the customer explicitly requests it. Future evolution: routes to Fleet Command (central MoE model on DGX Station GB300 owned by Sokrates).
Memory budget (CWWK N305):
- NixOS + Docker + Kernel: ~700MB
- Neo4j (Eidos): ~1.75GB
- Hermes (Python): ~500MB-1GB
- Sokrates Agent (Python): ~200MB
- Total: ~3.2-3.7GB, leaving substantial headroom for Neo4j pagecache
Fleet Command and The Basis
Boxes poll Fleet Command for NixOS flake updates, configs, and Basis changes. CWWK N305 boxes additionally route complex inference to Fleet Command when the central MoE model becomes available (DGX Station GB300). The Basis divides into:
- Meta-principles: Socratic discovery and questioning methodologies
- Domain-principles: Vertical-specific workflow patterns (e.g., Icelandic financial service approval chains)
When a Box discovers a new pattern, it’s scrubbed by the Routing Layer and sent to Fleet Command for deduplication and fleet-wide distribution.
Product Tiers
Sókrates ships in three progressive bundles — Cowork, Code, and Compound — each expanding the agent’s autonomy and integration depth (see Sokrates Product Bundles (Cowork, Code, Compound) for full definitions).
Exit Architecture
“Exit with Dignity”: customer retains hardware, Eidos knowledge graph, and MCP connectors on cancellation. Intelligence components (basis-driven reasoning, Fleet Command connection) are deactivated.