The forge is canonical. GitHub is a mirror. Write to https://git.hanzo.ai/hanzo/universe — that is the repository cd.hanzo.ai reconciles from, and the one every release's pin step pushes to. This GitHub copy is published FROM the forge and carries the same history; a commit that exists only here has not shipped and cannot ship.

Why the rule is stated instead of assumed. The two copies diverged badly — 158 commits on the forge that were not here, 23 here that were not on the forge, including real deploys (id 0.2.22, www 0.1.9, console v8.5.35) that therefore never reached production. The cause was a split remote: origin.url pointed at the forge while origin.pushurl pointed here, so git fetch read one repository and git push wrote to another, and every push reported success. Nothing compared the two, so nothing said otherwise.

Both sides have since been MERGED — no commit from either was dropped — and the divergence is now watched rather than trusted: scripts/ci/mirror-drift.sh fails when the two disagree, so the next split is a red check instead of a quiet six-month drift.

If you have an old clone, check it before you push: git remote -v must show the same URL for fetch and push on each remote.

Hanzo Universe

Monorepo for the Hanzo AI ecosystem. Contains all services, infrastructure manifests, and deployment tooling.

Repo: github.com/hanzoai/universe (private)

Ecosystem

Repo	Domain	Description
hanzo/hanzo.ai	hanzo.ai	Marketing site -- "The Open-Source AI Cloud"
hanzo/llm	api.hanzo.ai	LLM Gateway (100+ providers, OpenAI-compatible)
hanzo/mcp	--	Model Context Protocol (260+ tools)
hanzo/agent	--	Multi-agent SDK
hanzo/chat	hanzo.chat	Hanzo Chat (14 Zen models + 100+ third-party)
hanzo/dev	--	AI coding agent
hanzo/jin	--	Multimodal LLM (text/vision/audio/3D)
hanzo/aci	--	AI Chain Infrastructure
hanzo/gui	--	Hanzo design system (@hanzo/gui)
hanzo/cloud	api.cloud.hanzo.ai	AI-native PaaS backend
hanzo/iam	hanzo.id	Identity and Access Management (OIDC)
hanzo/kms	kms.hanzo.ai	Key Management Service (secrets)
hanzo/platform	platform.hanzo.ai	PaaS (Dokploy-based, CI/CD + deployments)

Supporting Services

Repo	Domain	Description
hanzo/console	console.hanzo.ai	Observability dashboard (traces, scores, prompts)
hanzo/commerce	commerce.hanzo.ai	Billing, payments, subscriptions (Stripe/Square/crypto)
hanzo/analytics	analytics.hanzo.ai	Web analytics (Umami-based)
hanzo/flow	flow.hanzo.ai	Visual workflow builder
hanzo/bot	hanzo.bot	Bot framework
hanzo/search	search.hanzo.ai	AI-powered search with generative UI
hanzo/operative	operative.hanzo.ai	Computer use (browser/desktop agents)

Production Infrastructure

DOKS Clusters

hanzo-k8s (24.199.76.156, DO SFO3) -- all Hanzo services:

• IAM, Console, Cloud, Gateway (LLM), Commerce, KMS, Platform, App
• Bootnode API/Web (HPA 3-20 / 2-10)
• Bot Gateway, Bot Site, Operative
• PaaS (monitor, studio, sync)
• PostgreSQL, MongoDB (FerretDB), Redis, MinIO, Datastore
• Docker Registry (IAM token auth)

lux-k8s (24.144.69.101, DO SFO3) -- Lux blockchain:

• 15 luxd validators (mainnet/testnet/devnet, 5 each)
• Gateway, Markets
• Bootnode API/Web
• PaaS, Registry
• PostgreSQL, Redis, Datastore

Data Stores (in-cluster, no managed DBs)

Service	Image	Purpose
PostgreSQL	hanzoai/sql:17	Relational (IAM, Cloud, Console, KMS, Platform)
DocDB	hanzoai/docdb + FerretDB	MongoDB wire protocol over PostgreSQL
Valkey	hanzoai/kv:8	Cache, sessions, rate limiting
Datastore	hanzoai/datastore	Analytics, LLM usage tracking
MinIO	hanzoai/s3	S3-compatible object storage
Qdrant	hanzoai/vector	Vector search
Meilisearch	hanzoai/search	Full-text search

Observability

Service	Domain	Purpose
O11y	o11y.hanzo.ai	Logs, traces and metrics — one ClickHouse telemetry store, written over ZAP
Grafana	dashboards.hanzo.ai	Visualization
OTEL agent	internal	The fleet's one OTLP door; terminates OTLP on every node and re-emits ZAP

Nothing scrapes. Services push all three signals to the same store, and o11y's in-process ruler and embedded Alertmanager evaluate against it.

Identity

Multi-tenant IAM via OIDC:

Domain	Organization
hanzo.id	Hanzo AI
lux.id	Lux Network
zoolabs.id	Zoo Labs
pars.id	Pars

CI/CD

• Images: ghcr.io/hanzoai/<service>:<tag> (always linux/amd64 + linux/arm64)
• Build runners: ARC scale sets (DO for amd64, GKE T2A Ampere for arm64, max 30 each)
• Deploy runners: hanzo-deploy-linux-amd64 (DO, max 20)
• Secrets: KMS (kms.hanzo.ai) synced to K8s via KMSSecret CRDs
• DNS: Cloudflare (proxied, full SSL)

Repository Structure

universe/
├── compose.yml                 # Local dev (Docker Compose)
├── Makefile                    # Automation targets
├── init-db.sql                 # PostgreSQL database init
├── infra/
│   └── k8s/                    # Production K8s manifests (Kustomize)
├── services/
│   └── tests/                  # Playwright E2E production tests
├── iam/
│   └── init_data.json          # Multi-tenant IAM bootstrap (4 orgs, 9 apps)
├── cloud/                      # Cloud API backend
├── gateway/                    # API gateway config
├── e2e/                        # E2E test suites (web2 + chain)
├── hips/                       # Hanzo Improvement Proposals
├── papers/                     # Academic/technical whitepapers (LaTeX)
├── docs/                       # Architecture and API docs
├── scripts/                    # Automation scripts
├── Cargo.toml                  # Rust workspace root
└── LLM.md                     # AI assistant context

Quick Start (local dev)

git clone git@github.com:hanzoai/universe.git
cd universe
cp .env.example .env            # configure secrets
make up                         # start all services
make status                     # check health
make logs                       # follow logs

Deploy (production)

cd infra/k8s
make apply                      # kubectl kustomize . | kubectl apply -f -
make validate                   # verify rollout

All secrets come from KMS. Never hardcode credentials in manifests or env files.

License

Proprietary -- Hanzo AI, Inc. All rights reserved.