## 5 The COGNIFOG Project
### Deployment Model and RunTime Services  
Referring to Figure 2, we can identify four classes of components: Infrastructure management components (red) that collectively work to define and manage resources across the continuum, security (yellow) that ensures the safety and security of the system; monitoring (green) that work together to model and then monitor resources and applications; and finally application (blue) components that support real-time data and analysis of IoT devices. Assuming proper deployment, interconnection, and availability of the corresponding CEI continuum resources, the COGNIFOG workflow typically begins with the _modelling stage_, which is carried out by the end-user operating the entire framework. After user authentication, the system requires the introduction of infrastructure resources, application descriptions, and SLA policies via the front-end dashboard. Finally, constraint modelling, via the PolyGraph [46] modelling tool, specifies the time and resource constraints of deployed applications and allows them to be monitored later in real time, ensuring that consistency and processing time constraints are met. The _deployment stage_ works closely with a CI/CD framework [47], which is responsible for automating and streamlining the software development associated with the applications to be deployed. Then, both the outputs from the modelling stage and the consolidated software are received by the multi-cluster orchestrator, which conducts the proper match-making among workloads and available resources, according to the existing constraints and predefined policies. The _runtime stage_ extends these capabilities over time, so that the multi-cluster orchestrator is able to perform new deployments and modify the existing ones in a dynamic and automatic way, thanks to the assistance of the AI-enabled smart allocator. This last element is fed not only with the set of requirements stated by the end-user, but also with real-time information gathered by the monitoring and telemetry agents deployed in all the managed resources of the underlying infrastructure. Although fully functional AI modules are not yet available in the COGNIFOG framework, several reinforcement learning (RL) techniques are currently under study in COGNIFOG, and in the sister project CODECO [48] recognizing RL's effectiveness in solving resource allocation problems within the IoT-edge-cloud continuum. In the COGNIFOG context, RL agents would be trained using data collected from monitoring agents, leveraging insights derived from the nodes' operational dynamics and energy utilization patterns. Once trained, the validated RL agents would be integrated into the smart allocator, which would then be able to provide RL-based placement plans to the orchestrator. When run iteratively, this process would refine the system's configuration to achieve an optimal solution that balances multiple criteria effectively. Safety and security issues are handled throughout the CEI continuum by means of Arca Trusted OS. The trusted and secure OS used in the project is provided by project partner CYSEC [49], a hardened Linux-based micro-distribution that protects against system intrusions and prevents data compromise within software containers. It features seamless system updating, an immutable file system, and a hardware root of trust. This minimalist OS not only limits the attack surface for cybercriminals, but also ensures that  
Figure 2: The COGNIFOG architecture. potential attackers do not alter the operating system images by using a secure boot with a Trusted Platform Module (TPM). Lastly, the suitability of the COGNIFOG framework for typical IoT-based Smart City applications is ensured with the use of three more elements. First, the IoT edge gateway functions as an entry point for heterogeneous wireless sensors, thus easing the collection, pre-processing, and transmission of city data.