JarvisOS Control Plane

• VIN / VPS warm ?No signal

  Standby unit on VIN; needs a reachable Postgres before it will accept work.

Dispatches tasks to worker nodes and owns workspace state.

Class

tier-0 Fleet-fatal: loss stops the estate or risks data. Everything else waits.

RTO (declared)

20m

RTO (achievable)

30m set by home1

RPO

1h

State

rebuildable · held in postgres-primary

Redundancy

active / passive

Failover

manual → vin

Failure domain

fd-home-rack

Health check: self-reported status every 60s — proves the process is running and its own checks pass. Self-reported: nothing outside the service confirms it.
Blind spot: A control plane that has stopped dispatching but still reports 'ok' is invisible here. The check that would catch it — dispatch a canary task and watch it complete — needs the node agent that does not exist yet.

Without it: No work is dispatched and no new workspaces are created. Running worker tasks continue to completion; their results are re-reported when the control plane returns.

A failover costs: None of its own. In-flight tasks are at-least-once and re-run, so handlers must be idempotent.

• ✕ Open gap: Health is self-reported: a wedged process that still answers looks healthy. jarvisos-control-plane
  JarvisOS Control Plane reports its own health (self-reported status every 60s); nothing outside it confirms.

Full classification and SLOs →