KAirOS
The right route. Right now.

Safer, smarter commute in Metro Manila.

One app for every leg of your trip — jeepney, bus, MRT, LRT, and walking — powered by MMDA data and on-device AI.

Listening…
"Take me to Ayala at 8 AM"
Plan ahead · Trip Watch

Choose a future departure. KAirOS builds an MMDA-aware forecast now, then keeps checking planner-published conditions before you leave.

Personal route details stay local · anonymous zone, time window, and mode inform aggregate demand

Overview

Demo clock · --:-- PHT Aggregated · zone-level only
Low demand Moderate High Demand, safety, closure, and route lenses stay in place as evidence moves into action.

Production architecture

schematic · live preview

Target scale-out topology for KAirOS at city scale — SSE push + Pub/Sub backbone, two independent ingest paths, zone-level aggregation.

Target topology — not running in this demo. The demo is fully client-side (static JSON over python3 -m http.server, no API server). This is the planned production architecture, consistent with the spec's aspirational GraphHopper + Liquid AI stack. See the README "Roadmap" section for the honest mapping.
MMDA Server EXTERNAL Mobile phones CLIENTS · UPLINK MMDA Ingestion FIXED · CACHED READER Aggregation nodes AUTOSCALED · BY ZONE Pub/Sub Broker Redis / NATS · 3-node quorum · the spine SSE Gateway ACTIVE-ACTIVE · HA Routing engine GRAPHHOPPER + OR-TOOLS Admin dashboard OD FLOWS · ANALYTICS pull (cached) POST uplinks push: alerts, crowding, routes normalized events normalized events route req / resp
External (MMDA) Client Fixed funnel Autoscaled (stateless) HA (stateful) Broker spine Synchronous call
The spine

The Pub/Sub broker is the spine — every normalized event flows through it, decoupling which node produced data from which node holds a client connection. Run as a 3-node quorum: an odd count avoids split-brain on failover. It is the single highest-leverage HA component; if it is down, nothing flows.

Two scaling strategies

Different tiers scale differently — on purpose. Ingestion is a fixed, rate-limited funnel: one polite cached reader protects MMDA from overload (and protects us from their rate limits). Aggregation + Routing are stateless and autoscale freely with demand. Scaling the aggregator does not affect MMDA load — they never talk.

Stateful HA

The SSE Gateway is the only stateful consumer tier — it holds open sockets. Run it active-active and drain connections on scale-in so no client is dropped mid-stream. This is where naive autoscaling breaks; the broker + drain pattern is what makes it survivable.

Designed for three nines

99.9% uptime (≈8.76 h downtime/year) is an operational property, not a box-count property. The real levers: HA broker (quorum) + safe deploys (blue/green or canary, one-click rollback, health-checked auto-restart). Availability multiplies across tiers, so each tier carries headroom above the composite target.

Privacy boundary

The aggregation nodes are not just a performance tier — they are the privacy mechanism. Individual phone points collapse to zone counts before they are published to the broker. No individual trip or personally identifiable detail reaches consumers. This matches the spec's "all commuter data is aggregated at the zone level before display."

The product loop

The dashed round-trip is the core loop: one commuter's phone uplink → aggregation → broker → SSE Gateway → all phones receive an updated crowding/alert view. One rider's telemetry becomes everyone's live intelligence, fanned out in milliseconds.

Composite availability caveat: across ~5 tiers, per-tier availability multiplies. 0.999⁵ ≈ 99.5% composite, so each tier needs headroom above three-nines individually. The HA broker is the multiplier that drags the whole product down if it is weak.