{
  "hybrid": {
    "nodes": 3,
    "cpuPerNode": "8 vCPU",
    "memPerNode": "32 GiB",
    "storage": "~50GiB PVC",
    "kubernetes": ">=1.28",
    "arch": "amd64",
    "network": [
      "egress to deployment-manager.xpander.ai (or PrivateLink)",
      "egress to your LLM providers"
    ],
    "extras": [
      "ingress controller + wildcard DNS optional",
      "fleet runtime (the agent runtime, always rendered, a PodSecurity baseline pod on any cluster: one executor per node plus one slot container per turn slot, root with the default capabilities, RuntimeDefault seccomp, no node preparation; the installer refuses an install whose cluster cannot run it - --allow-degraded-fleet is the dev-only way past, agents then run degraded): namespace PodSecurity 'baseline' (or unlabelled), any ReadWriteOnce StorageClass (fleet.storage.className, \"\" for the cluster default; fleet.storage.createClass renders an XFS one on AWS), the agent-harness image from the platform release that ships slot executors (0.0.182+); KEDA optional; +2-8 vCPU, 8-28 GiB, 500 GiB volume per executor (each CLI turn gets fleet.turn: 8 GiB / 4 vCPU / 1024 pids; an agent may raise its own up to 24 GiB / 8 vCPU)",
      "harness LLM (Claude Code default = Fable 5.1 on Anthropic direct): an Anthropic key on the proxy's Anthropic leg, or Amazon Bedrock (defaultProviders.claudeCode: amazon_bedrock) on an account whose Bedrock data retention mode is opted in (provider_data_share or aws_review) in every region a global. inference profile can route to - the default mode answers 400 \"data retention mode 'default' is not available for this model\"",
      "resident harness processes (on for every harness agent, no switch): a harness task stays In progress until the agent finishes it, runs as parkable CLI segments and waits for events at zero fleet cost; needs the agent-harness image pinned at or after the first resident-capable build (install.sh preflight prints the pin), 20 GiB per-agent quota on the executor volume (fleet.storage.quotaPerAgent; ~25 agents at full quota on 500 GiB), and optionally an S3 bucket for the sweeper's cold tier (fleet.storage.archive) and a GitHub App for the git credential broker (github.app)",
      "LLM gateway (optional, llm-gw.enabled): +1 vCPU / 2 GiB requested at the minimum of 2 pods, up to 20 pods of at most 1 vCPU / 4 GiB on CPU autoscaling, no database; the llm-gw.<domain> host (llm-gw.ingress) is private until published, internal: true serves it on a private load balancer; any load balancer in front needs an idle timeout of at least 1500 s for long streams"
    ]
  },
  "airgap": {
    "nodes": 5,
    "cpuPerNode": "16 vCPU",
    "memPerNode": "64 GiB",
    "storage": "300-500GiB PVC (RWO StorageClass)",
    "kubernetes": ">=1.28",
    "arch": "amd64",
    "network": [
      "NO internet required",
      "LLM endpoint reachable in-network"
    ],
    "extras": [
      "license file from xpander",
      "container registry with synced images",
      "optional SMTP relay (invites and password resets)",
      "optional GPU node (voice/local inference)",
      "Supabase migration 20260908190800 for channel credential vault resolvers",
      "fleet runtime (the agent runtime, always rendered, a PodSecurity baseline pod on any cluster: one executor per node plus one slot container per turn slot, root with the default capabilities, RuntimeDefault seccomp, no node preparation; the installer and the preflight hook refuse an install whose cluster cannot run it - --allow-degraded-fleet is the dev-only way past, agents then run degraded): namespace PodSecurity 'baseline' (or unlabelled), any ReadWriteOnce StorageClass (global.fleet.storage.className, \"\" for the cluster default; global.fleet.storage.createClass renders an XFS one on AWS), the agent-harness image from the platform release that ships slot executors (0.0.182+); KEDA optional (image_sync.sh --with-keda); +2-8 vCPU, 8-28 GiB, 500 GiB volume per executor (each CLI turn gets fleet.turn: 8 GiB / 4 vCPU / 1024 pids; an agent may raise its own up to 24 GiB / 8 vCPU)",
      "harness LLM (Claude Code default = Fable 5.1 on Anthropic direct): an Anthropic key on the proxy's Anthropic leg, or Amazon Bedrock (defaultProviders.claudeCode: amazon_bedrock) on an account whose Bedrock data retention mode is opted in (provider_data_share or aws_review) in every region a global. inference profile can route to - the default mode answers 400 \"data retention mode 'default' is not available for this model\"",
      "resident harness processes (on for every harness agent, no switch): a harness task stays In progress until the agent finishes it, runs as parkable CLI segments and waits for events at zero fleet cost; needs the agent-harness image pinned at or after the first resident-capable build (install.sh preflight prints the pin), 20 GiB per-agent quota on the executor volume (global.fleet.storage.quotaPerAgent; ~25 agents at full quota on 500 GiB), and optionally an S3 bucket for the sweeper's cold tier (global.fleet.storage.archive) and a GitHub App for the git credential broker (global.github.app)",
      "LLM gateway (optional, llm-gw.enabled): +1 vCPU / 2 GiB requested at the minimum of 2 pods, up to 20 pods of at most 1 vCPU / 4 GiB on CPU autoscaling, no database; the llm-gw.<domain> host (llm-gw.ingress) is private until published, internal: true serves it on a private load balancer; any load balancer in front needs an idle timeout of at least 1500 s for long streams"
    ]
  }
}