Omega edge runtime

Omega is Golain’s edge runtime — a single Rust binary (omega-agent) that connects a device to the platform over MQTT and runs the modules that device needs: over-the-air updates, inventory, data sync, posture, remote control, and more. It runs on Linux, macOS, and Windows. Repository: golain-io/omega-rs

Two binaries

Binary	Role
`omega-agent`	The runtime. Loads a profile, enrolls/connects, and runs modules.
`omega-launcher`	A tiny stable supervisor. It is what the OS service actually runs; it execs the current `omega-agent` slot and handles self-update slot flips and crash-loop reverts. The agent binary updates itself; the launcher does not, so the service target never moves.

Architecture

┌───────────────────────────────────────────────────────────┐
│ Profile (config.yaml)                                      │
│   connection · modules.required · security.capabilities    │
└───────────────────────────┬───────────────────────────────┘
                            │  loaded at startup
┌───────────────────────────▼───────────────────────────────┐
│ omega-agent                                                │
│   transport (MQTT/QUIC) · enrollment · cert renewal        │
│   module lifecycle · security (signing, capabilities)      │
│   OTA engine + inventory (SBOM/HBOM/PBOM) · your modules   │
└───────────────────────────┬───────────────────────────────┘
                            │  supervised by
┌───────────────────────────▼───────────────────────────────┐
│ omega-launcher  →  OS service (systemd / launchd / NSSM)   │
└───────────────────────────┬───────────────────────────────┘
                            │  MQTT (+ HTTPS for enrollment)
┌───────────────────────────▼───────────────────────────────┐
│ Golain platform (MQTT broker + API)                        │
└────────────────────────────────────────────────────────────┘

The two-layer model

Everything about a device is set by two independent things — keep them distinct:

The build (a SKU)

Cargo features decide which modules a binary can run. A feature that isn’t compiled in doesn’t exist in that binary.

The profile

config.yaml decides which of those modules actually run, the device’s identity and broker, and its security policy.

The two are validated against each other at load time. A profile that names a module or capability the binary doesn’t provide is fatal — Omega never runs half-configured, so an online device is one whose declared behavior the binary can honor.

What’s always there (the core)

Every build includes, without any feature flag:

Transport — the MQTT (or QUIC) connection to the broker, with keepalive and reconnect-with-backoff.
Enrollment (JITR) — first-boot identity: generate a key, get a device certificate. See Enrollment.
Certificate manager — background renewal before expiry.
OTA engine — signed deployments, and self-update via A/B binary slots with health-confirmed commit.
Inventory — SBOM / HBOM / PBOM collectors and the node capability framework (hosted by the OTA subsystem).
SQLite sync — change-data-capture replication of a device’s SQLite database to the platform.
Module lifecycle & security — starting the profile’s modules, control-message signing, capability gating, storage/payload quotas.

Everything else — zero-trust posture, hardware-backed keys, FIPS crypto — is a feature you compile in for the device classes that need it.

Life of a device

Enroll (first boot only)

With a connection.jitr block, the device generates its own key, proves possession of the factory bootstrap key, and receives its device certificate. See Enrollment (JITR).

Connect

It opens an mTLS MQTT session to the broker and subscribes the control topics for every module it runs. A topic the broker denies is fatal — the device won’t come up half-controllable. See Connect.

Run modules

Each module in modules.required starts, subscribes its control topics, and begins reporting. Nothing that isn’t listed runs.

Operate

The platform sends signed control messages; the device reports telemetry, inventory, and status; OTA delivers updates. Certificate renewal runs in the background.

Where to go next

Build Omega

The Cargo feature system and composing a SKU for a device class.

Configure Omega

The complete profile reference.

Connect

Transports and the MQTT topic namespace.

Enrollment (JITR)

Provisioning a device its first certificate.

OTA & self-update

Signed deployments and A/B self-update with automatic revert.

Troubleshooting

When a device won’t come up — where Omega writes the reason.