# AIVA CORE: DEPLOYMENT ARCHITECTURE

This document specifies the target infrastructure and deployment procedures for AIVA (The Genesis Mother). AIVA runs as a persistent, 24/7 daemon process on a managed Elestio instance.

---

## 1. INFRASTRUCTURE REQUIREMENTS

| Component | Specification | Purpose |
| :--- | :--- | :--- |
| **Instance Type** | Elestio Ollama (GPU-Accelerated) | LLM Inference host. |
| **CPU** | 8 vCPUs | Coordination and file processing. |
| **RAM** | 32 GB (Minimum) | Support for QwenLong 30B model (Q4 quantization). |
| **Storage** | 100 GB NVMe SSD | Audit logs, Vector DB, and knowledge cache. |
| **Runtime** | Python 3.11+ | Implementation logic. |
| **OS** | Ubuntu 22.04 LTS | Standardized environment. |

---

## 2. DEPLOYMENT RUNBOOK (DevOps)

### Step 1: Provisioning
1.  Deploy the Ollama service on Elestio.
2.  Enable the **Private Network** bridge to connect with the existing Genesis Redis/PostgreSQL instances.

### Step 2: Model Preparation
```bash
# Pull and verify the QwenLong orchestrator model
ollama pull qwenlong:30b-q4
ollama run qwenlong:30b-q4 "ping" # Verify responsiveness
```

### Step 3: Environment Configuration
Initialize the `.env` with AIVA-specific credentials:
```env
AIVA_MODEL=qwenlong:30b-q4
POSTGRES_URL=postgresql://aiva_user:password@genesis-db.local:5432/audit
REDIS_URL=redis://genesis-cache.local:6379
QDRANT_URL=http://genesis-vector.local:6333
ANTHROPIC_API_KEY=sk-ant-...
TELEGRAM_BOT_TOKEN=...
```

### Step 4: Daemon Installation
Install the `genesis-aiva-daemon` service using `systemd` to ensure 24/7 persistence.

```ini
[Unit]
Description=AIVA Genesis Mother Daemon
After=network.target redis.service postgresql.service

[Service]
Type=simple
User=genesis
WorkingDirectory=/E/genesis-system/aiva
ExecStart=/usr/bin/python3 aiva_daemon.py --mode=production
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
```

---

## 3. SECURITY HARDENING

1.  **Strict IP Whitelisting**: The AIVA instance accepts incoming connections only from Kinan’s verified VPN IP and the n8n webhook proxy.
2.  **No-Root Execution**: AIVA runs as a restricted `genesis` user with write access ONLY to pre-defined directories.
3.  **Encrypted Volume**: The `E:\genesis-system` drive must be encrypted at rest (AES-256).

---

## 4. MONITORING & HEALTH CHECKS

AIVA implements a **Self-Monitoring Heartbeat**:
- **Liveness Check**: `GET /health` returns model status and uptime.
- **Resource Alerting**: If memory usage exceeds 90% or inference latency > 10s, AIVA triggers a non-critical Telegram alert to Kinan.
- **Auto-Restart**: If the Ollama model hangs, the daemon automatically restarts the `ollama` service.

---

## 5. UPDATE PROCEDURE (Zero-Downtime)

1.  **Stage**: Pull latest `genesis-system` repository to `stage/` directory.
2.  **Validate**: Run `AIVA_CORE/TESTING_FRAMEWORK.md` scenario tests against stage build.
3.  **Swap**: Update the `systemd` symlink to point to new directory and `systemctl restart genesis-aiva`.
4.  **Verify**: Monitor log for "Dawn Phase" initialization success.

---

*AIVA Deployment Principle: Stability is the foundation of trust. Infrastructure is the architecture of life.*
