Overview
This is the parent tracking issue for the OBLISK v2 Metropolis architecture upgrade — a ground-up cloud-native reimagining of OBLISK v1 (codename: Gotham).
OBLISK v1 was your Batman — encrypted, solitary, effective in the shadows.
OBLISK v2 is your Superman — faster than a speeding bullet, leaping tall data centers, powered by the yellow sun of cloud-native infrastructure.
📄 Full architecture document: docs/OBLISK_Metropolis_Architecture.md
Gotham vs. Metropolis at a Glance
| Dimension |
Gotham (v1 Current) |
Metropolis (v2 Target) |
| Agents |
Python classes in memory |
Containerized micro-agents with gRPC APIs, multi-language SDK |
| Vault |
Local AES-256-GCM file |
HashiCorp Vault + cloud KMS, dynamic secrets, Shamir sharing |
| Planning |
Greedy forward search |
Temporal.io workflows + Monte Carlo Tree Search |
| Governance |
In-memory policy lists |
OPA (Open Policy Agent) sidecars with Rego |
| Messaging |
Python pub/sub |
NATS / Kafka event mesh |
| Observability |
File logging |
OpenTelemetry → Jaeger + Prometheus + Grafana |
| Identity |
Hardcoded 32-byte keys |
SPIFFE/SPIRE workload identities, mTLS everywhere |
| Scale |
Single machine |
Kubernetes-native, KEDA auto-scaling, Istio service mesh |
The New Skyline Components
| Codename |
System |
Technology |
| 🏰 Fortress of Solitude |
Vault 2.0 |
HashiCorp Vault, HSM, dynamic secrets |
| 🦸 Justice League Registry |
Agent Mesh |
gRPC, Rust/Go/Python SDKs, WebAssembly |
| 👻 Phantom Zone |
Immutable Audit |
QLDB/immudb, zero-knowledge proofs |
| 👁️ X-Ray Vision |
Observability |
OpenTelemetry, Jaeger, Prometheus, Grafana |
Build Phases
| Phase |
Name |
Focus |
Tracking Issue |
| 1 |
🧱 Foundation |
Containerize, gRPC, NATS, local k8s |
#20 |
| 2 |
🏗️ Towers |
HashiCorp Vault, Temporal.io, Helm charts |
#16 |
| 3 |
🌤️ Sky |
Rust SDK, Istio mTLS, KEDA autoscaling |
#19 |
| 4 |
⭐ Stars |
GPU planner, WASM sandbox, FedRAMP package |
#18 |
Security Posture: The Lex Luthor Defense
| Threat |
Countermeasure |
| Memory dump |
Intel SGX / AMD SEV enclaves |
| Supply chain |
SLSA Level 3, signed SBOMs |
| Insider threat |
RBAC + ABAC + M-of-N dual control |
| Quantum future |
CRYSTALS-Kyber hybrid post-quantum TLS |
Migration Strategy from Gotham
- Dual-run mode — Gotham and Metropolis operate in parallel
- Shadow traffic — Mirror production traffic to Metropolis
- Gradual cutover — Migrate agent by agent
- Vault migration — Export/import encrypted secrets with HSM ceremony
- Decommission — Sunset Gotham after 30-day validation period
Dependencies
This epic builds upon and supersedes the Gotham hardening issues:
Performance Targets
| Metric |
Target |
| Agent task latency (p99) |
< 50ms |
| Vault secret retrieval |
< 10ms |
| Workflow start latency |
< 100ms |
| Event mesh throughput |
> 100K msg/s |
| Trace ingestion |
> 10K spans/s |
| KEDA scale-out time |
< 15s |
| Recovery time (RTO) |
< 5 minutes |
| Recovery point (RPO) |
< 1 second |
Definition of Done
"OBLISK Metropolis isn't just an upgrade — it's a different species."
Overview
This is the parent tracking issue for the OBLISK v2 Metropolis architecture upgrade — a ground-up cloud-native reimagining of OBLISK v1 (codename: Gotham).
📄 Full architecture document:
docs/OBLISK_Metropolis_Architecture.mdGotham vs. Metropolis at a Glance
The New Skyline Components
Build Phases
Security Posture: The Lex Luthor Defense
Migration Strategy from Gotham
Dependencies
This epic builds upon and supersedes the Gotham hardening issues:
Performance Targets
Definition of Done
"OBLISK Metropolis isn't just an upgrade — it's a different species."