Skip to main content

Live Mode (BYOC Engine)

Run Lumis in your own network. Your container executes the ruleset, and only counters are reported back. Live payloads never enter Lumis infrastructure.

What is Live Mode (BYOC Engine)?

Live Mode is a bring-your-own-container deployment of the Lumis compliance engine. The customer's container runs our Rust image on their own hosts. It polls your workspace's ruleset bundle, evaluates transactions in-memory against that bundle, and reports only counters back to the control plane.

Live payloads — the transaction data sent to /evaluate — never enter Lumis infrastructure. They are evaluated on hosts you control, and the request body is kept in memory only.

Customer-hosted data plane

Our Rust image runs in your container runtime. You control the network, the storage, and the blast radius.

Ed25519-signed bundles

The control plane signs every ruleset bundle; the engine verifies the signature before loading it.

Counts-only telemetry

The heartbeat reports { evaluations_count, period_seconds } and nothing else.

Ed25519 evaluation seals

Every evaluation is signed with a per-deployment key for non-repudiable audit records.

Deployment

The engine ships as a single static binary in a minimal image (alpine-to-scratch build, roughly 8 MB). It has no OpenSSL dependency — TLS uses rustls. The container listens on port 8080 by default.

Run
docker run -d --name lumis-engine -p 8080:8080 \
  -e LUMIS_API_KEY=lmk_live_... \
  -e LUMIS_ENGINE_PUBKEY=<64-hex-public-key> \
  -e LUMIS_CONTROL_PLANE_URL=https://<your-control-plane-url> \
  ghcr.io/nytmmyrrh/fintech-compliance-sandbox/lumis-engine:latest

LUMIS_CONTROL_PLANE_URL is the Lumis-hosted control-plane URL we provide for your workspace — you don't host or deploy it yourself. It appears under Console → Settings → Live Mode. Leave it unset only if you're testing the image locally.

LUMIS_API_KEY and LUMIS_ENGINE_PUBKEY are required at startup; without them the process exits with a clear error. All other variables are optional.

Endpoints exposed by the engine:

  • ›GET /health — Liveness + version/region/environment.
  • ›GET /pubkey — The engine's evaluation-seal public key (64 hex).
  • ›POST /evaluate — Runs one payload through a selected active ruleset — add a ruleset_id field to the body to pick one, otherwise the default runs.
  • ›POST /api/v1/engine/export — Flushes PII-safe evaluation seal records to your SIEM webhook (Enterprise).

Workflow

1. Sync

The engine polls the control plane on an interval (default 300s), downloads every active ruleset bundle, verifies each Ed25519 signature against LUMIS_ENGINE_PUBKEY (all-or-nothing — one failure keeps the previous set), and caches them keyed by ruleset_id.

2. Evaluate

Each /evaluate call runs the payload through the in-memory DAG. The result is sealed with an Ed25519 signature (per-deployment LUMIS_ENGINE_SIGNING_KEY) so audit records are non-repudiable. The engine is stateless — request bodies are never logged or persisted.

3. Heartbeat

The engine reports { evaluations_count, period_seconds } to the control plane, which applies the counts against your monthly simulation quota. No rule names, payload fragments, stack traces, or URLs are transmitted.

Security & threat model

  • ›Bundles are Ed25519-signed by the control plane; the engine refuses to load unsigned or incorrectly signed bundles.
  • ›Evaluation seals are Ed25519-signed per deployment. A compromised engine can be rotated by rotating LUMIS_ENGINE_SIGNING_KEY.
  • ›Telemetry boundary: the heartbeat is { evaluations_count, period_seconds } ONLY — no rule names, no payload fragments, no stack traces, no URLs.
  • ›The engine keeps request bodies in memory only. It never writes them to disk and never ships them to Lumis.

Environment variable matrix

VariableRequiredPurpose
LUMIS_API_KEYRequiredControl-plane engine API key (workspace-scoped). Authenticates sync + heartbeat.
LUMIS_ENGINE_PUBKEYRequiredControl-plane bundle signing public key (64 hex chars). The engine rejects any bundle not signed by this key.
LUMIS_CONTROL_PLANE_URLOptionalControl-plane URL Lumis provides (Console → Settings → Live Mode). Unset disables sync and heartbeat.
LUMIS_ENGINE_SIGNING_KEYOptional64-hex Ed25519 seed used to sign evaluation seals. A random key is generated at startup if unset (seals then rotate on restart).
LUMIS_SYNC_INTERVAL_SECSOptionalDefault 300. Minimum 10.
LUMIS_HEARTBEAT_INTERVAL_SECSOptionalDefault 300. Minimum 10.
LUMIS_EXPORT_INTERVAL_SECSOptionalDefault 60. Minimum 10. How often evaluation seal records flush to your SIEM audit webhook (Enterprise).
LUMIS_DEPLOYMENT_IDOptionalStable identifier shown on the console Live Mode page. Defaults to the engine public key hex.
PORTOptionalDefault 8080.

72h grace & revocation

If the control plane becomes unreachable, the engine keeps serving evaluations from its cached bundle for up to 72 hours (grace period). During grace the license state is grace.

A 401 response to any sync or heartbeat call immediately revokes the license. After revocation the engine returns 403 { error: "license_revoked" } for /evaluate — a hard stop.

The grace window is a safety valve for transient outages, not a license bypass. Keep the control plane reachable to retain continuous service.

FAQ

Does the engine call Lumis?

Only two calls: sync (fetch the signed ruleset bundle) and heartbeat (report counts). Neither contains live payload data.

Where do payloads travel?

Nowhere. Payloads sent to /evaluate stay in your engine's memory on your hosts.

What license tiers support Live Mode?

Pro, Business, and Enterprise workspaces. Free workspaces receive a 401 license_not_active.

Can I run it fully air-gapped?

After a successful sync you have up to 72 hours of service without any connection to the control plane. Beyond that the engine cannot verify or refresh the bundle.

Which ruleset does the engine evaluate?

All of your active rulesets, served from one container. Pass a ruleset_id field in the /evaluate body to select one; without it, the most recently activated ruleset runs. Add a ruleset_id field in the payload to pick a specific one. Draft rulesets stay in the sandbox only — they are never compiled or shipped to the engine.

Does the engine send data anywhere?

Only to the Lumis control plane, and only when you configure an SIEM webhook. Every evaluation produces a cryptographic seal plus a sanitized record (no payload values) which the engine batches and forwards to your configured audit webhook. The original request body never leaves your container.