Delta Cloud

Overview

The page has three parts. A clickable map of one environment opens a plain-language card for each box — what it is and why it is there — and three animated traces walk a user query, a document ingest, and a deploy across the arrows. A second figure draws the difference between the two GPU compute planes. A table closes with staging beside production: the same shape, different numbers.

Architecture

Each environment is one virtual private cloud with public, application, and data subnets across several availability zones. Only load balancers, behind a managed web application firewall, sit in public subnets. The control plane (DELTA) runs on Fargate with autoscaling and is the only tier that may reach the PostgreSQL database, the Redis cache, the three private object-storage buckets, or a customer's connector roles; its agents call Claude on Bedrock through a private endpoint. The compute engine (GAMMA) holds no credentials at all, receiving a short-lived signed URL per request and reporting back over a VPC-internal load balancer with HMAC-signed webhooks. Container pulls, secret injection, logs, and key-management calls travel through VPC endpoints rather than the NAT gateway.

Compute planes

Heavy models outgrew CPU containers, so the compute engine runs on GPU-optimized EC2 instances in two independent planes split by workload shape. Long, bursty ingest and refinement go to AWS Batch, which scales between a warm floor and a burst ceiling on a pinned instance type so replays are byte-identical; cold starts are mitigated in layers by the warm floor, a boot-time image pre-pull, and a pre-baked machine image that a Lambda adopts into Terraform when a new bake lands. User-facing search runs on a separate always-warm GPU service so a query never waits for a boot. A third, CPU-only Batch plane on Fargate handles ingest that needs no accelerator.

Environments

Staging and production share one Terraform root behind two thin wrappers. Production is the same drawing with larger numbers: more availability zones, more and larger tasks, a warm GPU floor, a failover cache, deletion protection on the database, and a reviewed plan, re-plan, and apply gate behind required reviewers. Both live in one account, and a per-environment deny boundary on each deploy role keeps a staging apply from reaching production state, secrets, or data.

Scope

No Terraform is reproduced. Account identifiers, network ranges, resource and secret names, hostnames, and exact sizes are omitted on purpose, and a unit test refuses those shapes in the map's data. The demo shows infrastructure only, not the product built on it, and does not draw the retired Azure mirror kept in the repository for rollback.

See also

• Agent Memory
• David's Internet

References

1. ^ Katalyxt Infrastructure repository (private), Terraform for AWS: root module, per-environment wrappers, and the architecture decisions README, as read on 21 September 2026.