Aarkam.IO Management Portal & Gateway Backbone

Aarkam.IO (Module 1) is the primary enterprise-facing control tower of the entire Aarkam sovereign data fabric. It operates as both a comprehensive graphical management portal (Web UI) and the high-performance API gateway backbone that fronts distributed storage clusters.

1. The UI Management Portal

The Aarkam.IO Web Portal provides enterprise administrators, compliance officers, and tenant operators with a centralized, secure interface to orchestrate the sovereign storage fabric:

A. Multi-Tenant Organization Management

• Hierarchical Tenancy: Provision independent tenant accounts, departments, and project boundaries with zero cross-tenant metadata leakage.
• Enterprise Identity & MFA: Native support for TOTP Multi-Factor Authentication (Google Authenticator / Microsoft Authenticator), SAML 2.0, and OpenID Connect (OIDC) integration for Microsoft Entra ID.

B. Visual Cluster & Node Observability

• Real-Time Topology: Live visual telemetry mapping storage nodes, coordinator quorums, physical disk wear levels, and network latency meshes.
• Abodi Integration: Visual display of predictive health scores, impending drive degradation alerts, and automated rebalance progress.

C. Bucket & Policy Governance

• Visual Bucket Management: Create, configure, and inspect S3-compatible buckets with granular capacity quotas.
• Compliance & WORM Ledgers: Configure immutable Object Lock policies (Retention Days, Legal Holds) and view append-only audit events (FullAuditingLog).

D. Cryptographic Key Management (BYOK)

• Zero-Knowledge Key Dashboard: Manage Key Encrypting Keys (KEKs) hosted in customer-operated Hardware Security Modules (HSMs) via PKCS#11 / KMIP.
• Automated Lifecycle: Track 90-day key rotation schedules and cryptographic shredding execution logs.

2. The Gateway Backbone & S3 Pipeline

Aarkam.IO is not merely an administrative portal—it is the mandatory architectural backbone that powers the storage gateway:

Why Aarkam.IO is Mandatory for Cluster Operations

1. Authentication Broker: Validates incoming S3 SigV4 HMAC-SHA256 signatures against secure tenant credentials stored in the encrypted relational metadata store.
2. Topology Coordinator: Resolves dynamic hash ring node allocations from Rokka.Coordinator to determine the exact replica or Cauchy parity placement.
3. Client-Side Envelope Encryption Engine: Generates ephemeral Data Encryption Keys (DEKs) and encrypts object streams before network transmission, ensuring physical storage nodes never observe plaintext.
4. Stream Multiplexer: Manages concurrent, non-blocking gRPC streaming channels across all active Rokka.StorageNode endpoints.

3. Cross-Engine Coordination

As the top-level orchestration plane, Aarkam.IO interfaces continuously with the other five engines:

• Rokka (Consensus Quorum & Hash Ring): Queries the active Raft MON leader on port 57774 for consistent hash ring state and partition placement.
• Kdouja (Storage Core): Routes encrypted 4KB pages to storage nodes where Kdouja persists them via Direct I/O segment files.
• Ahmodi (Erasure Coding): Invokes vectorized Cauchy Reed-Solomon math during S3 stream slicing and speculative reads.
• Abodi (Health Telemetry): Ingests periodic node heartbeats on /api/v1/nodes/heartbeat and renders hardware health indicators on the dashboard.
• Aarkam.AM (Operator CLI): Shares unified role-based access control, cryptographic identities, and audit records with CLI operators.

4. Configuration & Master Ports Matrix

Aarkam.IO adheres to the unified dual-range port scheme (7770 + N for HTTP, 57770 + N for HTTPS):