Your ISO is the client layer. Behind it, Kodachi coordinates authentication, signed card assignment, DNS protection, protocol routing, worker fleets, external-provider configs, and on-device emergency defenses. The diagram below stays animated because the system is easier to understand when you can see the flows moving.
card-generator.sh on every worker, cron */5m, JSON cards pushed to mastervmess:///vless:///ss:// URI schemes plus Clash YAML / sing-box JSON subscriptions. The Kodachi fleet is the turnkey path, not the only path.dns-switch.The ISO comes up. integrity-check verifies the signed Rust components before anything else runs.
The client requests a 64-char challenge from the master node, solves it locally, returns the solution, gets a hardware-bound session token.
Master matches your tier (Free, Premium, Dedicated) to a fresh card from the matching pool — Free clients land on shared VPS, Premium on low-density VPS, Dedicated on isolated single-tenant VPS. The card contains every protocol config you need.
routing-switch brings the selected protocol online. dns-leak verifies the resolver is inside the tunnel.
Heartbeat every 2 minutes, security score recomputed live, health-control watchdog ready to fire panic at any tier.
Shared, high-density VPS. Every protocol included. Cards regenerated on cron when the pool dips below the threshold. Personal-use tier — same OS and binaries as the paid plans.
Low-density shared VPS for consistent performance. Prioritized exits, lower contention, faster card rotation. Same protocol surface, smaller pool. Commercial usage rights included.
Fully isolated VPS per customer. Bespoke configs per holder. Dedicated worker mapping. The card pool is hand-shaped, not auto-generated. Intended for organisations and serious operational use.