Client Layer
API Gateway (chi router)
Tailnet Mesh (WireGuard)
latticed (Single Binary)
Core Services (coderd.go)
Temporal Workers
Data Layer
Governance Engine
Observability
AI Providers (External)
Workbench
Electron · 316K lines
lattice CLI
Go · 120+ cmds
Go SDK
agentsdk pkg
Terraform
IaC Provider
Toolbox
Swift macOS
Operator
Laravel SSH
REST API
100+ endpoints
DRPC
Protobuf bidir
WebSocket
PubSub events
Middleware
12 layers
WireGuard
P2P encrypted
DERP Relay
TCP/WS fallback
Coordinator
Agent discovery
Temporal v1.30
Embedded gRPC:7233
Identity Engine
OAuth2/OIDC/SAML
Policy Engine
Rego → SQL
Budget Engine
Hard/soft limits
Agent Lifecycle
CRUD + Signal
Crypto Keys
Sign/Encrypt/Rotate
PubSub
DB-backed events
Provisioner
Terraform jobs
AgentWorkflow
Durable signal loop
CoordWorkflow
Room management
Task Queue
lattice-agents
PostgreSQL
50+ tables SQLC
Temporal DB
Workflow state
Audit Ledger
SHA-256 chain
424 Migrations
Schema evolution
AI Budgets
lattice_ai_budgets
Agent State
lattice_agents
Crypto Keys
Signing + Encrypt
RBAC
Role-based 744KB
ABAC
Attribute-based
Rego/OPA
policy.rego 427L
Rego→SQL
DB-level enforce
PII Filter
Prompt scan
Model Lock
Restrict models
Tool Gate
Whitelist tools
Audit Chain
SHA-256 linked
Prometheus
Metrics export
OpenTelemetry
Distributed tracing
Net Telemetry
Batch 1min/1000
Anthropic
Claude
OpenAI
GPT
Google
Gemini
Ollama/Local
Inference server
Request Flow
1
Request Arrives
REST/DRPC/WS → 12-layer middleware (CSRF, CORS, rate limit, tracing)
2
Identity Verified
OAuth2/OIDC/SAML/mTLS/API key. Subject constructed.
3
Policy Evaluated
Rego → SQL. RBAC+ABAC. DB queries filtered by policy.
4
Budget Checked
Per-agent, per-org limits. Hard caps halt. Soft caps alert.
5
Temporal Executes
AgentWorkflow durable signal loop. Continue-As-New @1000.
6
Audit Logged
SHA-256(event + prev_hash). Diff captured. Immutable.
Key Specs (from code)
BinarySingle Go (latticed)
TemporalEmbedded v1.30.1 :7233
Namespaceslattice-org-{orgID}
PolicyRego → SQL (regosql)
RBAC cacheLRU SHA256 keys
AuditSHA-256 chain
MeshWireGuard + DERP
DBPostgreSQL 50+ tbl SQLC
Middleware12 layers
Rate limit512/min, 60/min login