# Architecture in one paragraph

F∆I has three concepts you'll meet everywhere: **Hub**,
**Module**, **Flow**.

**The hub** is a single Rust binary called `fai`. It runs as a
gRPC server, loads modules, executes flows, and writes events
to a SQLite database. One binary, no Docker, no message broker,
no cluster. You can run it on a laptop, a Raspberry Pi, or a
locked-down KRITIS server — same artefact every time.

**A module** is a small WebAssembly component that does one
thing well. Modules are sandboxed: each one declares the
network endpoints, files, and environment variables it needs,
and the hub enforces that list. A module that doesn't ask for
network access can't reach the network. Modules ship as `.fai`
bundles with a CycloneDX SBOM and a sigstore signature.

**A flow** is a YAML file with three top-level keys:
`inputs:`, `steps:`, `outputs:`. Steps run in declared order,
each step calls one module, and outputs from one step can feed
inputs of the next. Flows are deterministic — same inputs
produce the same audit trail.

## How the pieces fit

```
Studio ──gRPC──▶ Hub ──loads──▶ Module (WASM)
                  │
                  ├──executes──▶ Flow (YAML chain of modules)
                  │
                  └──writes────▶ Audit log (hash-chained, in
                                  SQLite; WORM-1 by construction)
```

## What you don't need

- No container runtime. The hub doesn't shell out to Docker
  or Podman. Modules are WASM components loaded in-process.
- No external database. SQLite ships with the hub.
- No background services. One process; restart with
  `fai daemon restart` — see Doctor → Daemon control.

## Where to go next in this app

- **Store** to discover modules and federated MCP / n8n
  capabilities, install them in one click.
- **Flows** to run the sample flows that ship with the hub
  (e.g. `extract-summarize`).
- **Audit** to see every event the hub recorded — the
  hash-chained log is the platform's source of truth.