Your ISO is the client layer. Behind it, Kodachi coordinates authentication, signed card assignment, DNS protection, protocol routing, worker fleets, external-provider configs, and on-device emergency defenses. The diagram below stays animated because the system is easier to understand when you can see the flows moving.
card-generator.sh on every worker, cron */5m, JSON cards pushed to mastervmess:///vless:///ss:// URI schemes plus Clash YAML / sing-box JSON subscriptions. The Kodachi fleet is the turnkey path, not the only path.dns-switch.The ISO comes up. integrity-check verifies the signed Rust components before anything else runs.
The client requests a 64-char challenge from the master node, solves it locally, returns the solution, gets a hardware-bound session token.
Master matches your tier (normal, VIP, custom) to a fresh card from the pool. The card contains every protocol config you need.
routing-switch brings the selected protocol online. dns-leak verifies the resolver is inside the tunnel.
Heartbeat every 2 minutes, security score recomputed live, health-control watchdog ready to fire panic at any tier.
Shared resources. Every protocol included. Cards regenerated on cron when the pool dips below the threshold.
Prioritized exits, lower contention, faster card rotation. Same protocol surface, smaller pool.
Bespoke configs per holder. Dedicated worker mapping. The card pool is hand-shaped, not auto-generated.