Architecture and security
Invariant is split into a control plane, which stores specs, schedules and results, and a data plane, which runs your software and touches your data. The data plane can live entirely in your environment.
Control plane and data plane
| Control plane (Invariant) | Data plane (yours, or Invariant cloud workers) | |
|---|---|---|
| Does | Scheduling, run history, statistics, reports, pull request and chat integrations | Pulls images, reads logs, runs simulators and your software, writes outputs |
| Stores | Run records, metric values, verdicts, scenario names and hashes, commit SHAs | Logs, images, model weights, MCAP outputs, all in your bucket |
| Network | HTTPS API | Outbound HTTPS to the control plane and to the storage and registries you configure. No inbound connections. |
By default, Invariant never stores your logs, images or model weights in its own storage. Runners stream or cache inputs on local disk for the job and delete them afterwards. If you use Invariant cloud workers, those workers read your bucket the same way. Reports link to files in your bucket, and your viewer opens them with your credentials.
Deployment options
| Option | Control plane | Data plane | Status |
|---|---|---|---|
| Cloud with your runners | Invariant | Your machines | MVP |
| Fully hosted | Invariant | Invariant cloud workers, reading your bucket | Next |
| Your cloud account | Invariant | Workers in your account | Later |
| Self-hosted | Your environment | Your environment, including air-gapped | Later |
Planned security controls
- Credentials. Runners use short-lived, scoped credentials. Bucket access is read-only for inputs and write-only for outputs.
- Isolation. One run per container, no network by default, resource limits enforced. Cloud workers are single-tenant per job.
- Access. Organization, project and suite-level roles. SSO and SCIM Later.
- Audit log. Every run, gate override and spec change is recorded with who did it and when.
- Encryption. TLS in transit. Encryption at rest for all control-plane data.
- Compliance. SOC 2 is on the roadmap. Ask us for current security documentation during a pilot.
Open source and hosted
Invariant is built to fit the stack you already have. The parts that touch your code, machines and data are planned to be open source, so your tests never depend on a hosted service to run. The hosted service keeps the shared record and does the work that needs it.
| Part | Where it lives | Ships |
|---|---|---|
invariant.yaml spec format | Your repo, open source | MVP, open source Later |
| CLI and local runner | Your machines, open source | MVP, open source Later |
| Adapters and metric packs | Your machines, open source | MVP, open source Later |
| Run records and the web report | Hosted by Invariant | MVP |
| Baselines reused across pull requests | Hosted by Invariant | Next |
| Flaky detection, sequential testing and bisect across runs | Hosted by Invariant | Next |
| Scheduling across your own runners | Hosted by Invariant | MVP |
| Scheduling on Invariant cloud workers | Hosted by Invariant | Next |
| Pull request checks | Hosted by Invariant | Next |
| Rig queues and release evidence | Hosted by Invariant | Later |
The CLI works with the CI you already use (GitHub Actions, GitLab CI, Buildkite, Jenkins or anything that runs a shell command), and with coding agents through the CLI or the MCP server. Logs and outputs stay in your bucket. Run records and results export as JSON, CSV and MCAP, so you can leave with everything you put in.