The self-hosted platform, layer by layer
Four layers. One platform. All of it in your network.
This document explains, for each layer of the MODERAN platform, how it actually works — the components, the data flow, the safety rules — and what it earns you: in minutes saved, in disputes won, in revenue created. Everything described here installs into your own Kubernetes cluster, inside your country.
A note on numbering: the platform has exactly four layers, numbered L0 to L3. We start at zero because L0 is the foundation everything else stands on — you cannot run L1, L2 or L3 without it. If you have seen "L4" mentioned, that is a miscount; there are four layers, and the last one is L3.
L3Sovereign Edge-AI ApplianceRevenue add-on
L2Compute BrokerRevenue add-on
L1Interop AssuranceIn base fee
L0Observability & Fault CorrelationIn base fee
Your Kubernetes cluster · your servers · your country
Layer 0 Included in base fee
Observability & Fault Correlation
The operational foundation: one truthful view of a multi-vendor radio network.
What it is
L0 continuously listens to every network element from every vendor — radios (RU), baseband units (DU/CU), the RIC controller, transport links, cloud nodes — and turns their separate alarm streams into single, explained incidents with a probable root cause. Its face is the MODERAN Console; its body is a processing pipeline running on your servers.
How it works — the life of an alarm
- Collect. Vendor adapters speak each supplier's management interfaces — the O-RAN O1 interface and gNMI streaming telemetry, including adapters for srsRAN/OAI-based equipment. They pull alarms, counters and health data on a continuous cycle.
- Publish. Every event lands on a high-speed internal message bus (NATS). Nothing talks point-to-point; every consumer sees the same stream, and the bus persists state so a restart loses nothing.
- Normalize. The normalizer translates each vendor's private format into one versioned common information model. From here on, a Nokia alarm and a Mavenir alarm are the same kind of object with the same fields — severity, element, code, timestamp.
- Correlate. The fault-correlator holds a live map of your network topology — which radio hangs off which DU, which DU rides which transport ring. Events that share an ancestor element and a time window are folded into one fault group. In our live demo, 96 raw alarms became one incident.
- Explain. The correlator ranks the probable root cause using evidence it can state in words: ancestor of other affected elements · carries the highest-severity alarm in the group · multiple alarms on the same element — and attaches a confidence score (95% in the demo). No black box: every verdict comes with its reasons.
- Show and alert. The API gateway serves the Console (live updates over SSE — no refreshing), pushes one notification per incident to Slack, Webex or PagerDuty with a cooldown so on-call phones buzz once, not 96 times, and exposes everything as a documented REST API. Matching runbooks — step-by-step repair procedures in plain versioned files — are attached to each fault family.
- Record. Every privileged action and every incident is written to a tamper-evident audit trail, archived to Postgres in write-once form. Your post-mortems, SLA claims and regulator answers come from here.
Under the hood
collector-o1 · collector-gnmi · collector-srsranVendor-facing adapters; add a vendor by adding an adapter, not by replacing the platform.
normalizerVendor formats → one versioned common model.
fault-correlatorTopology + time-window grouping, root-cause ranking, persistent fault-group state.
runbook-serviceVersioned YAML procedures, hot-reloaded — your engineers extend it without vendor tickets.
api-gateway + consoleSSO login (OpenID Connect), role separation, rate-limiting, bilingual EN/FR web console.
notifier · audit-archiverDeduplicated alerts to your chat tools; write-once audit archive; Grafana dashboards and Prometheus rules included.
What it earns you
- Minutes instead of hours to understand a fault. The mean time to understand an outage collapses from cross-referencing four vendor tools to reading one card. Faster understanding means shorter outages, which means fewer lost airtime minutes and fewer regulator penalties.
- Leverage over your suppliers. "Your DU took down twelve radios at 02:14, here is the timestamped evidence chain" wins SLA disputes. Operators without neutral evidence lose those arguments by default.
- Freedom to mix vendors. The management layer is no longer the reason you must buy everything from one supplier. That bargaining power is worth real percentage points on every radio contract you negotiate.
- A NOC that trains itself. The scenario injector produces realistic fault storms on demand — new hires triage safely, and your acceptance team proves the installation end-to-end before live traffic.
- Sovereignty by construction. Alarms, topology and history never leave your servers. The only optional cross-border traffic is an anonymous health heartbeat for our support SLA.
Layer 1 Included in base fee
Interop Assurance
Proof that a vendor mix works — before deployment, and after every vendor update.
What it is
Open RAN's promise is mixing vendors; its biggest operational risk is that a software update from vendor A silently breaks vendor B. L1 is a conformance-testing engine: it runs test campaigns against specific vendor combinations, records a verdict with a fingerprint, and guards approved combinations against regressions.
How it works
- Define the combination. Each vendor mix you care about — say, radio vendor X firmware 5.2 with DU vendor Y release 3.1 — gets a combination ID.
- Run the campaign. L1 drives a test harness against that combination. It ships with a built-in harness for immediate use and an exec mode that wraps your own O-RAN test suites (OTIC-style scripts), so your existing lab investment plugs straight in.
- Get a verdict with a fingerprint. Every run produces pass/fail detail plus a fingerprint of exactly what was tested. Verdicts are listed, retrievable and comparable — an audit trail of interoperability.
- Approve a baseline. When a verdict satisfies you, one action promotes its fingerprint to the approved baseline for that combination. From then on, any new run that deviates is flagged as a regression.
- Catch the silent break. When a vendor ships an update, you re-run the campaign before rollout. If the update breaks the mix, you learn it in the lab — not from subscribers.
What it earns you
- De-risked vendor mixing. The board-level fear about Open RAN — "who do we blame when two vendors disagree?" — gets a technical answer: the baseline says which side moved.
- Cheaper second suppliers. Onboarding a challenger vendor stops being a leap of faith; it is a test campaign with a pass mark. More qualified suppliers means better prices from all of them.
- Updates without fear. Vendor updates go from "hold your breath" to "re-run the campaign." Regressions surface before deployment, with evidence the vendor cannot argue with.
- Regulator and partner confidence. A verdict history demonstrates engineering discipline when you seek spectrum, financing or roaming agreements.
Layer 2 $0 upfront · 15–25% revenue share
Compute Broker
Turns the idle hours of your edge computing hardware into a revenue line — without ever risking the radio network.
What it is
Your edge cloud sites carry processors and accelerators sized for peak radio traffic. Most of the day — and almost all of the night — much of that capacity sits idle, depreciating. L2 sells that idle capacity to paying compute tenants (AI startups, research groups, enterprises) as scheduled jobs, and takes it back the instant the radio network needs it. This is the same "AI-RAN" thesis that MTN, NVIDIA and others funded with $45M in 2026 — L2 is the sovereign, operator-owned version of it.
How it works
- Sense capacity. A capacity sensor reads live telemetry — free accelerator units per node and a radio-demand signal derived from the same L0 metrics pipeline. The broker always knows what is truly spare, per site, right now.
- Accept jobs. Tenants submit compute jobs through a simple API with a priority level. Jobs are queued, placed on nodes with headroom, and metered from the moment they start.
- Enforce the golden rule: radio always wins. A configurable reserve of capacity is never sold. Beyond that, a pre-emption loop watches radio demand continuously; the moment it rises, tenant jobs are pre-empted — suspended or evicted — to hand capacity back. The pre-emption mechanism is deliberately pluggable so it binds to your real infrastructure controls (Kubernetes eviction, container freeze) and is validated before the broker ever touches nodes carrying live radio traffic.
- Account for everything. Every pre-emption is logged against an SLO budget you set — you can see exactly how often tenants were interrupted and prove that radio service was never degraded. Every consumed compute-hour is metered per tenant for billing.
What it earns you
- A new revenue line from hardware you already bought. The capacity is paid for; every brokered hour is close to pure margin. ARGILETTE charges nothing upfront — we earn 15–25% of the revenue we broker, so our incentive is identical to yours.
- Zero risk to the network, provably. The SLO ledger shows regulators, your board and your own engineers that tenant compute never once displaced radio service.
- A seat in the AI-RAN wave on your own terms. The industry (SoftBank/NVIDIA in Japan, MTN/ODC in Africa) is racing to turn networks into compute grids — on foreign platforms. L2 gives you the same economics on infrastructure you own, in your country.
Layer 3 Per appliance + per tenant/month
Sovereign Edge-AI Appliance
In-country AI inference for banks, insurers, hospitals and government — with cryptographic proof that data never left.
What it is
Regulated organisations in West Africa want modern AI but legally cannot send their data abroad — and practically cannot trust a foreign cloud's promise. L3 is an appliance installed in-country (in your data centre or on the customer's premises) that runs AI models locally, meters usage per tenant, and produces signed sovereignty attestations — verifiable evidence, not policy PDFs.
How it works
- Load models locally. The operator loads approved AI models into the appliance's catalogue at deployment. Models run on the appliance's own hardware; no inference request ever transits a foreign API.
- Provision tenants with quotas. Each customer — a bank, a ministry, an insurer — is a tenant with its own credentials, its own model access and a monthly usage quota. Tenants see their own consumption; the operator provisions, suspends and bills.
- Serve inference, meter everything. Tenants call a simple inference API. Every call is counted per tenant and per model — that metering is the billing record, and it flows into the same monthly invoice machinery as the rest of the platform.
- Enforce sovereignty in code, not in promises. The appliance software refuses to start if cross-border egress is enabled without a written override reason — and if an override is ever set, it prints a loud warning in the logs at every startup, forever. A quiet exception is impossible by construction. On demand, the appliance produces a signed attestation a regulator or auditor can verify.
- Inherit the operational floor. The appliance emits its audit events onto the same bus, is watched by the same L0 console, and follows the same runbook discipline — so the infrastructure hosting a bank's AI is run to telco grade, and you can show it.
What it earns you
- Revenue from a market no one else can serve. Regulated enterprises pay a premium for AI they are legally allowed to use. Your first fintech tenant at roughly $60k/year is worth more than a thousand consumer subscriptions — and there are many banks per country.
- The regulator becomes your salesman. Data-protection laws (Nigeria's NDPA, Ghana's DPA, Senegal's CDP, the ECOWAS framework) push regulated buyers toward exactly what only L3 offers: local inference with verifiable proof.
- A leapfrog story you own. Instead of waiting for a hyperscaler region, your country gets sovereign AI capacity hosted by its own operator — with the operator, not a foreign cloud, collecting the rent.
Sovereignty, precisely
What runs where — and what ever crosses the border
Every layer above installs from Helm charts (or fully GitOps via Argo CD) into your own Kubernetes cluster. Operators sign in with your SSO. Here is the complete list of data that can leave your country, and only if you enable it:
| Data | Where it lives | Crosses the border? |
| Alarms, telemetry, topology, incidents | Your L0 cluster | Never |
| Interop verdicts and baselines | Your L1 service | Never |
| Tenant jobs, SLO ledger, compute metering | Your L2 broker | Never (aggregate revenue counts are shared for the revenue-share settlement) |
| AI prompts, model inputs/outputs, tenant data | Your L3 appliance | Never — enforced in code |
| Usage counts for billing | Metered locally | A count — a number — is reported for invoicing. Never content. |
| Health heartbeat | Optional | Anonymous up/down signal only, so we can honor the support SLA. You can disable it. |
The same platform, four audiences
Who gains what
| Role | L0 + L1 give them | L2 + L3 give them |
| CTO / Network Director | One truthful screen over every vendor; proof before every rollout; freedom to negotiate with suppliers. | An AI-era roadmap that runs on infrastructure they already control. |
| CFO | Shorter outages and one flat platform fee instead of per-cell metering and consultant hours. | Two new revenue lines — one at zero upfront cost, one aimed at premium regulated customers. |
| NOC / Operations lead | 96 alarms become one card with the reason attached; runbooks encode the best engineers' judgment; new hires train on injected scenarios. | The same console and discipline extends over the compute and AI estates — nothing new to learn. |
| Regulator / Auditor | Tamper-evident audit trails and timestamped incident evidence. | SLO ledgers proving radio was never degraded; signed attestations proving data never left the country. |