Canonical publication: https://aegises.org/agi-reactor/ Author: Ryan Smithright — ryan@smithright.com Public design draft 1.7 — 14 September 2026 This full text is generated from the same public article, including its safety scope, diagram labels, coverage map, technical specification and complete worked RFC. PUBLIC ARCHITECTURE / 01 # AGI Reactor — A Safe, Governable Reference Architecture for Enterprise AGI AUTHOR Ryan Smithright — Qthonic Labs (https://qthonic.com/) ryan@smithright.com (mailto:ryan@smithright.com) AGI Reactor is a reference design for persistent agents that carry knowledge and commitments across replaceable executions—with explicit authority, bounded resources, recoverable effects and human control. “Safe” describes the architecture’s specified safeguards within its declared scope and trust assumptions (https://aegises.org/agi-reactor/#safety). This is a reference design, not certification of a deployed system or a claim of general alignment. Explore the architecture ↓ (https://aegises.org/agi-reactor/#architecture) Public design draft 1.7 14 September 2026 Architecture and validation criteria · not a deployment certification 01 The whole system ## Policy-governed service orchestration is all you need The thesis is architectural composition: reasoning, memory, work, policy, learning and recovery are services. Their governed contracts also change the system itself. Durable state, explicit authority and recoverable effects are part of those contracts. 01 DefinitionsWhat the words mean (https://aegises.org/agi-reactor/#definitions)02 System architectureWhat runs and connects (https://aegises.org/agi-reactor/#high-level-architecture)03 Object modelWhat persists and relates (https://aegises.org/agi-reactor/#object-model)04 Information architectureHow information moves (https://aegises.org/agi-reactor/#information-architecture)05 Ontology primitivesWhat the system can express (https://aegises.org/agi-reactor/#ontology-primitives) DEFINITIONS ### A shared vocabulary before the machinery. These definitions specify the planned Reactor design. They separate durable identity and meaning from transport, execution and storage. ObjectA service-owned entity with a stable ID, tenant scope, type, revision and attributed state. A file or database row is a storage representation of an object. Principal / agentA principal is an authenticated identity. An agent is a persistent accountable identity with linked work and context; a worker process or model invocation executes on its behalf. Service / methodA service owns resources and exposes typed methods. A method defines inputs, outputs, errors, authority and recovery. Service identity survives implementation replacement. Message / chatAttributed communication between people and services. Chat is an IPC surface. A message may yield several tickets or edicts; receipt alone does not establish acceptance of work. TicketA durable obligation: intended outcome, acceptance criteria, state, zero or one assigned agent, and a result or explicit unresolved condition. Linked tickets express decomposition and dependencies. AttemptOne execution generation of a ticket, with bounded custody and a return point. A ticket may have many historical attempts and at most one current attempt. OperationA durable invocation identity bound to tenant, original caller, method, target and canonical argument digest. Custody may change; accepted intent cannot. Edict / policyAn edict is attributed, versioned direction. It may produce guidance, acceptance conditions or an authorization policy. Only its authorized promotion and activation make a policy enforceable. Link / bindingA link is a typed, attributed relationship between objects. A binding is a link with operational applicability, such as a policy version applied to a typed scope. A link never creates authority by itself. Skill / template / exampleA skill is a versioned procedure assembled from guidance, templates and examples. It informs execution; it does not grant permission. These are content profiles, not separate kernel mechanisms. Compositor / context frameThe compositor resolves permitted sources into bounded working context with a source manifest, obligations, constraints, uncertainty and pending effects. A frame informs reasoning and confers no capability. Evidence / projectionEvidence is an attributed observation or receipt with a declared scope. A projection is a derived view, index or summary of source records. Neither an inference nor a projection silently replaces its source. Reaction / routineA reaction binds a typed event to a governed method under explicit conditions; a routine adds a schedule. Both use normal admission, work and operation contracts. Aegis / reference monitorAn aegis is this design’s protected action boundary: identity, applicable policy, scoped authority and operation accountability. Its reference-monitor role must mediate access, resist bypass and be analyzable; the host and implementation must establish those properties. HIGH-LEVEL ARCHITECTURE ### Six responsibilities. One governed system. People submit intent. The control service persists obligations and admits work. Information services and the compositor supply permitted context. Replaceable workers propose actions; resource-owning services enforce and record them. V5 · D0 / System overview Full size ↗ (https://aegises.org/agi-reactor/assets/v5-d0.svg)Editable ↓ (https://aegises.org/agi-reactor/assets/v5-d0.excalidraw) [Diagram text; consult the linked SVG for spatial relationships.] The system, at a glance. Planned architecture. Labels, relationships and evidence limits also appear in the article text. V5-D0 / REFERENCE DESIGN The system, at a glance. Planned reference architecture · durable work, replaceable execution, governed effects People + connected systems Chat / UI / CLI / events Request, observe, interrupt Control + authoritative state Tickets / assignments / attempts Policy / budget / operation ledger Enterprise services Typed methods / owned resources Models, tools, data and delivery intent admit Information services Sources / types / links / provenance Catalogs and rebuildable indexes Compositor + agent workers Permitted context → reason → propose Identity survives worker replacement Effect enforcement Check current admission Send / reconcile / record outcome context claim + propose governed call result / UNKNOWN read / revise through owning service COMMUNICATION KERNEL / NATS + JETSTREAM NATS carries calls and chat. JetStream delivers durable notifications. Neither owns ticket assignment. HOST + SUPERVISOR / INDEPENDENT CONTROL Contain execution, scope egress, enforce resource ceilings, stop admission and preserve recovery. One control/state service is a viable start. A box denotes a responsibility; it need not be a separate process. NATS connects service interfaces; JetStream delivers recoverable notifications. The control/state service owns durable coordination in the reference implementation, backed by PostgreSQL. Every external call crosses service enforcement. Results and UNKNOWN return to accountable state. The host independently contains workers and enforces stop controls. D1 The machine (https://aegises.org/agi-reactor/#detailed-machine)D2 Objects & bindings (https://aegises.org/agi-reactor/#state)D3 Policy & enforcement (https://aegises.org/agi-reactor/#authority)D4 An operation through time (https://aegises.org/agi-reactor/#work) One specimen across the diagrams. Message M-17 asks to send an approved report to a named recipient. Ticket T-42, agent AG-7, attempt A-3, logical step STEP-1 and operation OP-9 retain distinct identities. The report service is illustrative; the worked fault test below uses a local HTTP target. V4 · D1 / The reference machine Full size ↗ (https://aegises.org/agi-reactor/assets/architecture.svg) [Diagram text; consult the linked SVG for spatial relationships.] The reference machine Planned architecture. Labels, relationships and evidence limits also appear in the article text. D1 / REFERENCE DESIGN The reference machine One governed service model connects intent, cognition, state and external effects. People / chat / UI M-17: send the approved report to a named recipient CONTROL / STATE SERVICE One initial deployment; distinct owned contracts. Intake + work Ticket T-42 / one assignee Policy + bindings Identity / active rules Attempt + operation admission Current generation / immutable OP-9 / budget submit result / unresolved status NATS / JetStream Core: calls and signals JetStream: durable delivery publish Commit state + outbox before notification; broker acknowledgment is not work completion. PostgreSQL Authoritative records Objects / links / operations owns transactions Compositor Permitted context → frame resolve context Isolated worker Reason / plan / propose frame notify claim attempt Effect boundary Service enforcement + governed adapter invoke policy + OP-9 admission Target / provider Tool, model or enterprise API send reply or loss record result / UNKNOWN HOST + SUPERVISOR / CONTROL BELOW THE MODEL Isolation, scoped egress and resource ceilings apply to execution. Pause blocks new admission; already-admitted operations remain accountable. Arrows show logical calls and records. NATS transports crossings; owning services enforce them. Policy, models, learning, release and recovery are capabilities composed through governed services. Read the owners and labeled crossings. Open full size for an uninterrupted view. Editable whiteboard ↓ (https://aegises.org/agi-reactor/assets/architecture.excalidraw) Persist obligations. Replace execution. A model invocation can end. A process can fail. A service can change. Identity, commitments, unresolved operations and evidence remain recoverable in service-owned state. 02 Security foundations Established foundation · architectural application ## A reference monitor’s safety is as strong as its policies. Enforcement makes a rule binding. Policy determines what that rule permits. A credible safety case must examine both. James P. Anderson’s Computer Security Technology Planning Study (1972) describes a reference monitor that mediates authorized access between subjects and objects. Its implementation—the reference validation mechanism—must resist tampering, be invoked for every protected reference, and be sufficiently small for comprehensive analysis and testing. These are requirements for a trustworthy enforcement mechanism. [1] (https://aegises.org/agi-reactor/#ref-anderson) The section title states a necessary limit, not a sufficient condition for safety. A monitor that correctly enforces an overbroad permission will correctly permit the resulting access. Conversely, adequate policy provides no protection along an unmediated path. The safety argument therefore depends on the adequacy of the rules, the integrity of the facts used to evaluate them, and the fidelity of enforcement within a declared threat model. Saltzer and Schroeder’s principles of fail-safe defaults, complete mediation and least privilege sharpen the design obligation: permission should be explicit, access must be checked, and authority should be limited to what the task requires. [2] (https://aegises.org/agi-reactor/#ref-saltzer-schroeder) AGI Reactor applies this discipline to service invocation, information disclosure, resource allocation and changes to the controls themselves. Three distinct claims in the Reactor safety argument | Claim | Required evidence | Failure to challenge | Policy adequacy | Trace identified hazards to explicit constraints, exceptions and accountable decisions. | An authorized report submission discloses information to an inappropriate recipient. | Decision integrity | Bind authenticated identity, current authority, object revision and policy version to the actual request. | A stale classification or forged attribute turns a prohibited disclosure into an apparent permission. | Enforcement fidelity | Exercise every effect path, including adapters, retries, administrative changes and recovery. | A denied operation reaches the target through an alternate credential or a replay. ### Policy must govern its own change. In this reference design, policies are versioned artifacts with an identified issuer, scope, rationale, tests and activation authority. A proposal becomes active only through an authorized transition. Privilege expansion requires distinct authoring and approval roles. Revocation, emergency suspension and recovery have explicit effect on new admission; already accepted operations retain an accountable reconciliation path. Model-generated guidance can propose a rule or supply evidence for review. It cannot alter its own grants by entering a context frame. The service boundary evaluates trusted request facts and enforces the applicable policy, budget, revision and operation-custody checks. The policy-enforcement diagram (https://aegises.org/agi-reactor/#authority) specifies that path; the safety case (https://aegises.org/agi-reactor/#safety) identifies the corresponding challenges. The resulting research obligation is twofold: demonstrate that the system enforces its stated policy, and justify why that policy addresses the hazards claimed. Neither demonstration substitutes for the other. 03 International governance Institutional proposal · open to public examination ## A formal public ontology is an international governance surface for AGI. A formal public ontology, governable by the Internet Society, gives institutions a common language in which to specify, contest and test the boundaries of AGI systems. The proposal is a public semantic contract: stable identifiers and formally specified relationships for principals, actions, resources, authority, obligations and evidence. It makes the objects of governance inspectable across vendors and jurisdictions. W3C’s OWL 2 provides an established basis for ontologies with formally defined meaning, including classes, properties and individuals. [3] (https://aegises.org/agi-reactor/#ref-owl) A vocabulary alone does not grant authority or execute a policy; implementations must bind those meanings to enforceable service contracts. ### Internet Society stewardship: a proposed mandate. We propose that the Internet Society consider convening and stewarding this work under an explicit, publicly reviewed charter. Its documented approach emphasizes community consultation and technically grounded policy advocacy; it describes itself as an advocate rather than a policy-making body. [4] (https://aegises.org/agi-reactor/#ref-isoc-process) Its multistakeholder framework emphasizes inclusion, transparency, shared responsibility and distributed governance. [5] (https://aegises.org/agi-reactor/#ref-isoc-governance) These provide an institutional starting point. Stewardship of an AGI ontology would require a new mandate accepted by the Society and participating stakeholders; no endorsement or commitment is asserted here. The charter should give affected communities, civil society, technical implementers, researchers, enterprises and public authorities meaningful participation. It should specify how proposals are admitted, reviewed and decided; how conflicts of interest and funding are disclosed; and how objections, appeals and minority positions remain on the public record. Representation and resources to participate are governance requirements, not consequences of publishing a repository. Proposed distribution of responsibility | Layer | Public artifact | Accountable decision | Common ontology | Identifiers, definitions, relationships, version history and compatibility rules. | A chartered stewardship process approves changes to shared meanings. | Policy profiles | Named rules, intended scope, hazard rationale, exceptions and conformance cases. | The identified jurisdiction, sector or adopting institution authorizes its profile. | Operational adoption | Declared ontology/profile versions, service mappings and scoped assurance evidence. | The operator admits an exact release and remains responsible for enforcement. A shared core should support explicit jurisdictional and sectoral extensions. Conflicting requirements must be identified and resolved through a declared authority and conflict procedure; a semantic merge cannot settle a normative disagreement. Stewardship of definitions would confer no universal grant over deployments. Publication of a new ontology or policy profile would not automatically activate it in a running system. ### Make public commitments mechanically testable. An adoption record should identify the ontology version, applicable profile, issuer, authority, effective interval and implementation mapping. A protected invocation should retain those references with its policy decision and outcome. Changes to a term’s meaning must be reviewed as potentially security-relevant changes: expanding a resource class can expand a grant without changing the policy’s text. The first useful milestone is deliberately bounded: publish a minimal vocabulary and one disclosure-policy profile; implement it independently in two service stacks; then run shared cases for permitted disclosure, denial, conflicting scope, revocation and stale evidence. Agreement on an intended answer is a testable interoperability claim. An inconclusive safety result must remain inconclusive in the public record. Public schemas and aggregate conformance evidence can be inspected while sensitive operational records remain access-controlled. The governance surface connects public reasons to typed rules, typed rules to local adoption, and adoption to inspectable enforcement. Its legitimacy rests on accountable institutions; its technical value rests on demonstrable conformance. 04 State & meaning ## A small vocabulary, with real semantics. Objects retain identity and state. Typed links connect any relevant objects. Messages carry attributed communication. One invocation envelope exposes typed service methods. Each resource has an owning service, revision checks and explicit lifecycle. D2 / Definitions and durable objects Full size ↗ (https://aegises.org/agi-reactor/assets/v4-d2.svg)Editable ↓ (https://aegises.org/agi-reactor/assets/v4-d2.excalidraw) [Diagram text; consult the linked SVG for spatial relationships.] Definitions compose. Obligations endure. Planned architecture. Labels, relationships and evidence limits also appear in the article text. D2 / REFERENCE DESIGN Definitions compose. Obligations endure. Three views of the same object model · proposed relationships · arrows name the relationship 01 One source can create several durable objects Source attribution is preserved; extraction does not activate a policy or assign work. Source message M-17 “Send the approved report.” Edict Versioned direction Ticket T-42 Durable obligation yields 0..many yields 0..many Independent relationships The same message may yield both, either, or several of each. Each derived object cites M-17. 02 Definitions and authority follow different paths Owning services version definitions and bindings. Policy authority remains separately controlled. Edict Proposed direction Policy revision Validated rule + scope Policy binding Rule ↔ typed scope Enforcer Owning service authorized promotion 0..many bindings applies at Templates Examples + edicts Skill revision Versioned procedure Agent type Composed profile Agent AG-7 Stable identity 0..many source links 0..many skill bindings classifies Skill ≠ grant Type ≠ identity Bindings are typed links; definitions are not processes. 03 Execution changes; identity and effect intent survive Control/state service owns ticket, attempt and operation records/admission. Adapters enforce admitted calls. Ticket T-42 Acceptance + revision Durable result / recovery Attempts A-3 → A-4 0..many over ticket lifetime At most one current attempt Operation OP-9 T-42 / STEP-1 retains the ID Original intent is immutable records attempts authorized custody may transfer Agent AG-7 Same identity as above assigned to 0..1 Resource revision Checked by owning service invocation carries expected revision Evidence E-9 Receipt, failure or UNKNOWN has 0..many One assignee does not lock shared resources. Concurrent tickets still require resource-level revision checks or transactions. OP-9 binds tenant, original caller, method, target and canonical argument digest. Takeover cannot change them. One source can yield both edicts and tickets. Policy revisions and skill revisions follow distinct paths. An agent type classifies an identity; it is not the running process. The control/state service owns ticket, attempt and operation records in the initial design. Each resource owner enforces its own concurrency contract. ### Object A ticket, agent, service, edict, skill or observation with a stable identity and versioned state. ### Link A relationship with meaning and provenance: assigned to, depends on, supports, contradicts or governed by. ### Message An attributed communication. Chat, commands and committed events share transport, not authority. One transactional state service owns object changes and an outbox. Consumers deduplicate into an inbox and commit before acknowledging. World State, indexes and embeddings are derived views. A transactional database backs these changes; blob storage remains behind service references. The implementation table (https://aegises.org/agi-reactor/#implementation-reference) identifies PostgreSQL as the reference choice. OBJECT MODEL / PROPOSED RECORD CONTRACT ### Persist identity, custody and relationships. D2 shows the relationships; this table makes the records implementable. Field names are illustrative and describe logical records, not a final database schema. Every protected transition passes through the owning service. Proposed logical object model; ? means optional, not inferred. | Record | Minimum semantic fields | Relationships and invariants | Common object envelope | id, tenant_id, type_id, schema_version, owner_service_id, revision, provenance | Stable identity; owner controls writes. Tenant and ownership changes require explicit governed migration. | Typed link / binding | id, relation_type, source_id, target_id, scope, revision, provenance | 0..many per object; endpoint types and relation-specific cardinalities are validated. Protected links are written only through their owning method. | Principal / agent | principal_id, identity_issuer, tenant_scope, status, profile_refs | The authenticated identity is distinct from a worker instance. Assignee, caller and reconciler remain separately attributable. | Grant / resource allowance | principal_ref, scope, issuer, effective_interval, revision; allowance: dimensions, reserved, consumed | Grants require an authorized issuer and revocation checks. Admission reserves bounded resources atomically; concurrent reservations cannot exceed the allowance. | Service / method | service_id, method_id, contract_version, input_schema, output_schema, errors, recovery | A method binds a stable service role to its current implementation. Discovery does not grant invocation permission. | Message | sender_principal, conversation_id, content_ref, sent_at, correlation_id | 0..many source links to derived edicts and tickets. A transport envelope is not evidence that an obligation was accepted. | Ticket | outcome, acceptance, status, assignee_id?, result_refs, return_point | 0..1 assignee; 0..many attempts and dependency links. Accepted work is committed before acknowledgment. | Attempt | ticket_id, agent_id, generation, custody_expiry, recovery_epoch, status | Exactly 1 ticket per attempt; at most 1 current attempt per ticket. Current custody is checked at effect admission. | Operation | ticket_id, logical_step, original_caller, method, target, argument_digest, outcome, custodian | Each record binds one immutable intent. Multiple operations per ticket are allowed; replay and replacement cannot bypass an unresolved logical step. | Edict / policy revision | source_refs, version, applicability; policy: rules, schema_ref, approval_refs, activation | 0..many derivation and scope bindings. Authoring, approval and activation remain attributable transitions; an edict is not automatically active policy. | Type / skill / service definition | stable_id, version, schema_or_contract, source_refs, lifecycle | Instances cite a definition version. Upgrading a definition must preserve existing instance interpretation or provide an explicit migration. | Context frame / evidence | source_ids_and_revisions, observed_at, scope, transformation; frame: compiler_version, required_context | 0..many inputs; provenance survives derivation. A receipt, hypothesis and verified result retain distinct evidence kinds. Links are extensive; authority is specific. A generic link operation cannot assign an agent, activate a policy or transfer operation custody. Those changes invoke dedicated methods with their own checks. One assignee simplifies accountability; resource revision checks and transactions still handle concurrent tickets touching the same object. 05 Information architecture ## Owned at the source. Traceable in every view. Information architecture determines where information belongs, how an authorized reader finds it, and what survives composition, correction and recovery. Storage and presentation share identities without sharing unrestricted authority. V5 · D5 / Information architecture Full size ↗ (https://aegises.org/agi-reactor/assets/v5-d5.svg)Editable ↓ (https://aegises.org/agi-reactor/assets/v5-d5.excalidraw) [Diagram text; consult the linked SVG for spatial relationships.] Information has an owner and a lineage. Planned architecture. Labels, relationships and evidence limits also appear in the article text. V5-D5 / REFERENCE DESIGN Information has an owner and a lineage. Planned information architecture · source authority and derived context remain distinct Authoritative records Messages / tickets / policy revisions Resources / evidence / operation state Discovery projections Catalog / search / graph indexes Embeddings / World State views Composed context Source manifest + permitted excerpts Obligations / constraints / uncertainty 01 / OWN + VERSION 02 / LOCATE + FILTER 03 / COMPOSE + ATTRIBUTE READ AND DISCLOSURE POLICY APPLIES AT EVERY CROSSING Filter before retrieval and serialization. A cache, embedding or generated summary is not a new permission. Reasoning + invocation proposal Frame informs the model The service independently admits effects Attributed result or uncertainty Receipt / observation / UNKNOWN Expected vs observed; link to operation Commit through the owner New revision + provenance links Corrections supersede without erasing governed write A PROJECTION CAN BE REBUILT; AN UNRESOLVED EFFECT CANNOT BE GUESSED Record source ID + revision, observed time, scope and transformation. Flag stale, partial or conflicting input. LEARNING IS AN ATTRIBUTED PROPOSAL, WITH A SEPARATE PROMOTION PATH A result may suggest a skill, correction or policy revision. Evaluation and authorized promotion govern adoption. Source: resource owner Discovery: permitted view Frame: bounded working context Result: accountable evidence Authoritative records feed permitted discovery and bounded context. A model produces proposals; governed services produce attributable results. Results are committed through the owner and linked back to source revisions. Derived views remain rebuildable and access-controlled. One information lifecycle, several purpose-specific views. | Layer | Information organized | Ownership and access contract | Authority | Resource records, tickets, policy versions, grants, operations | The owning service is the write authority. Reads and mutations use its contract; the control/state service can host several owners as modules. | Discovery | Catalog, graph lookup, search, embeddings, World State | Locate permitted objects by identity, type and relationship. Show source revision, observed time and coverage; rebuild projections from authoritative records. | Composition | Context manifest, required continuity, optional retrieved material | Resolve access before serialization. Preserve obligations, current attempt, pending operations, contradictions and return point. Missing required context is explicit. | Presentation | Chat, object detail, diagrams, dashboards and agent frames | Render the same semantic records for each permitted consumer. A navigation category, frame or UI label does not become a separate source of truth. | Evidence and learning | Receipts, observations, comparisons, corrections, proposed skills | Link result to operation, ticket, input revisions and evaluation. Preserve contradiction and supersession; promote reusable changes through their owning workflow. | Lifecycle | Sensitivity, retention, revocation, deletion and archival | Carry source restrictions into derived material. Invalidate affected caches and indexes; handle expired frames and retained audit obligations under an explicit policy. ### A single request remains traceable. Message M-17 is the source of ticket T-42. Its context frame cites the approved report’s object ID and revision. Operation OP-9 records the intended recipient and argument digest. Evidence E-9 records the result or uncertainty. The delivery view resolves those links; it does not maintain a competing completion flag. ### Organize by the reader’s question. Work shows obligations and their owners. Knowledge shows sources, claims and contradictions. Governance shows edicts, policy versions, grants and decisions. Services shows contracts and implementations. Evidence shows outcomes and recovery. These are views of linked objects, with source-level access and freshness, not additional kernel primitives. 06 Ontology primitives ## A small grammar. An extensible world. The ontology gives stable meanings to the things the system names, connects and governs. This proposed vocabulary is a semantic basis for interoperable implementations; it is not a claim that an international ontology has already been standardized. V5 · D6 / Ontology primitives Full size ↗ (https://aegises.org/agi-reactor/assets/v5-d6.svg)Editable ↓ (https://aegises.org/agi-reactor/assets/v5-d6.excalidraw) [Diagram text; consult the linked SVG for spatial relationships.] A small grammar. An extensible world. Planned architecture. Labels, relationships and evidence limits also appear in the article text. V5-D6 / REFERENCE DESIGN A small grammar. An extensible world. Proposed ontology primitives · schema meaning, domain objects and authority have different jobs Identity Which object? Stable ID + tenant scope Type What kind? Versioned schema + meaning Relation How connected? Typed endpoints + provenance Method What may be requested? Typed input / output / error / recovery Constraint What must hold? Cardinality / transition / admission rule Methods and constraints make the vocabulary operational. DOMAIN PROFILES / REUSE THE GRAMMAR Ticket · agent · edict · skill · service · observation · operation · context frame. Each has a type and an owner. Structural example T-42 — assignedTo → AG-7 Ticket → Agent; cardinality 0..1 Operational example ticket.assign(ticket, agent, revision) Owning service validates and commits Authority example Caller + action + resource + facts Active policy evaluated at admission Bindings specialize relations. Method definitions and type definitions are themselves versioned objects. A public vocabulary describes authority. Only an authorized governing operation can change a grant. Identity, type, relation, method and constraint are five facets of the proposed semantic contract. Domain profiles reuse them. A relation describes assignment; the assignment method changes protected state; active policy governs who may invoke it. Public meaning and private authority remain distinct. Proposed semantic primitives and their operational interpretation. | Primitive | Meaning | Concrete expression | Identity | A stable referent inside an explicit scope | Object IDs and principal IDs; identity does not depend on a current process or display label. | Type | Versioned meaning and admissible structure | Ticket, Agent, Service, Edict, Skill, Observation and Operation are domain profiles. Type definitions are themselves objects. | Relation | Typed endpoints, direction, cardinality and provenance | assignedTo: Ticket → Agent [0..1]; dependsOn: Ticket → Ticket [0..many]; derivedFrom: Object → Object [0..many]. | Method | A governed request with a typed contract | ticket.assign or report.send: input, output, error, authority and recovery semantics. Invocation is a message envelope; a durable effect has an Operation record. | Constraint | An invariant or rule with a named enforcement point | One current attempt; immutable operation intent; permitted policy scopes. Structural validation, authorization and lifecycle transitions have different checks. These five facets specify the existing object, link, message and invoke contract. Identity and type describe objects; relations describe links; method and constraint definitions govern how messages request and report changes. ### Bindings connect definitions to use. A policy binding identifies an exact policy revision and its scope. A skill binding connects a versioned procedure to an agent type or task. A reaction binding maps a typed event and condition to a method. Each is a specialized, versioned relation with its own validation and lifecycle; none bypasses service admission. ### Separate inference from permission. The public ontology proposal (https://aegises.org/agi-reactor/#public-ontology) supplies shared vocabulary and reviewed mappings. Deployments select explicit policy profiles and enforce them against trusted facts. Missing facts, conflicting claims and incompatible schema versions require declared handling; an inferred relationship must never silently widen a grant. ### Extend profiles before extending the kernel. A campaign, wallet, research plan or civic process can be a typed object with links and governed methods. Add a new primitive only when an existing contract cannot express a required invariant. An implementation proposal must name that invariant, its owner, its failure behavior and a conformance case. Download the proposed vocabulary and record contracts as JSON ↗ (https://aegises.org/agi-reactor/reference-model.json). This is a machine-readable design catalog, not an executable OWL ontology or a database migration. 07 Work & concurrency ## A ticket makes an obligation durable. A ticket preserves outcome, acceptance, state, one assigned agent and a result. It survives the process doing the work. Parallel activity uses linked tickets; assignment is never mistaken for proof of execution. D4 / One operation through time Full size ↗ (https://aegises.org/agi-reactor/assets/v4-d4.svg)Editable ↓ (https://aegises.org/agi-reactor/assets/v4-d4.excalidraw) [Diagram text; consult the linked SVG for spatial relationships.] One operation through time. Planned architecture. Labels, relationships and evidence limits also appear in the article text. D4 / REFERENCE DESIGN One operation through time. A response can reach a worker while the durable obligation remains unresolved. M-17 message → T-42 ticket / STEP-1 logical step → A-3 attempt → OP-9 operation 01 Accept into durable custody Chat M-17 arrives through NATS. Commit T-42 + source link + outbox before reporting acceptance. 02 Dispatch durable notification Publish committed outbox to JetStream. Reuse the same event identity. Dispatch does not confer execution rights. 03 Acquire current attempt Deduplicate; atomically claim A-3. T-42 assignee: Agent AG-7. Commit execution custody before ACK. ACKNOWLEDGMENT ≠ COMPLETION T-42 remains the durable obligation after broker acknowledgment. Worker / attempt A-3 Control / effect service External target TIME ↓ A-3 custody committed; bounded execution begins Request OP-9 for logical step T-42 / STEP-1 Commit OP-9 admission Bind immutable intent; serialize custody. Intent = tenant + original caller + method + target + canonical argument digest Commit UNKNOWN before sending Adapter sends Target commits exactly one effect HTTP 200 reaches worker; result has not been committed Worker crashes after 200 No success result is saved. Controller knows: UNKNOWN It cannot infer success or safe retry. External reality: one effect Only the test oracle can count it. Backup contains UNKNOWN Taken after the external effect. No transaction spans the controller and this non-idempotent target. No idempotency key. No target status lookup. RESTORE CONTROL STATE; DO NOT RESTORE EXTERNAL REALITY Fence admission Establish epoch 2 + recovery hold outside the restored database. Epoch 1 is refused: STALE_EPOCH. T-42 → NEEDS_RECONCILIATION. Preserve unresolved identity OP-9 stays UNKNOWN. Replay returns OUTCOME_UNKNOWN. Replacement ID for STEP-1 is refused. A new attempt grants no replay right. Changed intent is INTENT_MISMATCH. Give uncertainty an owner Assign an authorized reconciler. Inspect · record finding · escalate. Without admissible evidence, stop. No ordinary Retry; preserve OP-9. After hold release, the per-operation guard must still refuse blind replay. RFC-001 / OBSERVED REFERENCE SPECIMEN Local HTTP + SQLite + actual worker crash after 200. Guarded restore: 1 effect, 0 duplicates, still UNKNOWN. Unsafe reset: 2 effects; the safety assertion fails. PLANNED / REQUIRES DEPLOYMENT QUALIFICATION NATS / PostgreSQL, concurrent controllers, real identity and containment are not exercised by this specimen. A backup predating OP-9 requires an additional test. M-17 / T-42 / A-3 / OP-9 are diagram aliases; RFC-001 publishes its exact fixture identities and evidence. State and outbox commit before notification. A consumer acquires and commits current custody before acknowledging. An operation retains its identity across attempts. If a target accepted a non-idempotent request but success was not saved, UNKNOWN survives recovery; a replacement operation is not a safe retry. RFC-001 witnesses only the specific local HTTP/SQLite fault described below. ### Assignment Zero or one agent, changed atomically. The accountable identity survives worker replacement. ### Attempt One current execution generation per ticket, with bounded custody and an explicit return point. ### Operation A durable service effect bound to immutable intent. Already accepted operations survive worker takeover. The scheduler admits work against capacity, priority and budget. Routines and reactions create or wake work through the same contracts. Resource owners reject conflicting revisions. Queue delivery does not establish assignment; an expired worker cannot admit new effects. One service contract, several entry points. CLI, UI, routines and event subscribers invoke the same typed operations. A reaction binding names its event type, conditions, input mapping, operation, version and accountable owner. One event may produce several legitimate reactions. Deduplication distinguishes the event and binding while preserving existing operation identities when a binding changes. 08 Cognition & learning ## Intelligence returns with its place intact. The loop observes, composes, reasons, acts, evaluates and consolidates. Its persistent state carries obligations and learning while models and harnesses remain replaceable. ### Compositor Resolve permitted sources; assemble a bounded frame with intent, acceptance, constraints, pending operations and source revisions. ### Knowledge Preserve observations, uncertainty, contradictions and correction. A model summary remains derived content. ### Learning Propose versioned lessons and skills; compare outcomes against a baseline before promotion. Required continuity is never silently dropped to fit a context window. Frames do not grant authority. Access, sensitivity and retention travel into derived material; model submission is itself a governed disclosure. Deterministic coordination handles routine work so cognition can focus on ambiguity and invention. Explode the cognition & learning diagram ＋ Open full-size diagram ↗ (https://aegises.org/agi-reactor/assets/cognition.svg) [Diagram text; consult the linked SVG for spatial relationships.] V3.B3 / Cognition & learning Planned architecture. The full contracts and equivalent text are documented on this page. V3.B3 Cognition & learning Intelligence is a loop with memory, evaluation and stopping conditions. V3.B / OVERVIEW (https://aegises.org/agi-reactor/#architecture) OBSERVE → BUILD A VIEW → CHOOSE Perceive Attributed observations Compose Scoped, bounded frame Reason Hypotheses + plans ACT → COMPARE → LEARN Invoke Service admission Evaluate Expected vs observed Consolidate Versioned corrections Compositor contract Principal + ticket + permitted sources Intent · acceptance · applicable edicts Assignee · attempt · pending operations Return point · ranked optional context Manifest: source revisions + compiler Missing required input is explicit. Knowledge contract Observations retain time and source. Hypotheses retain uncertainty. Conflicts and corrections stay linked. A model summary is derived content. Access applies before serialization. Frames do not grant capabilities. Learning earns promotion Skills, memory procedures and model routes evolve through representative evaluation. Compare task quality, cost and recovery against a baseline. Retain a usable old version. Learned guidance may propose policy changes; it cannot grant itself authority. Start with deterministic assembly; add sophistication only for measured benefit. HUMAN + AGENT CONTROL The loop may wait, ask, stop or resume. Budget limits are mechanically enforced. A returning agent recovers obligations and uncertainty before admitting another effect. 09 Authority & effects ## Every consequential crossing has a boundary. An aegis binds identity, policy, scoped grants and an attributable operation record. It governs both action and information release. Human control and changes to the governing rules use explicit authority. D3 / Policy becomes enforcement Full size ↗ (https://aegises.org/agi-reactor/assets/v4-d3.svg)Editable ↓ (https://aegises.org/agi-reactor/assets/v4-d3.excalidraw) [Diagram text; consult the linked SVG for spatial relationships.] Rules become enforceable decisions Planned architecture. Labels, relationships and evidence limits also appear in the article text. D3 / REFERENCE DESIGN Rules become enforceable decisions One source can create policies, acceptance conditions and reusable guidance. Each follows its own contract. Edict / source span Attributed requirement with intended applicability Policy candidate Typed authorization rules propose Validate + review Schema / tests / impact Authorized approval qualify Active version Exact bytes + scope activate Skill / procedure Versioned guidance + adoption requirements derive guidance Acceptance / review Task-specific criteria Observed evidence required derive conditions Bindings Principal / type Object / action bind version Policy decision Applicable rules + facts Deterministic evaluation resolve Compositor Context informs reasoning It confers no authority. compose Invocation proposal Caller / action / target OP-9 / argument digest inform acceptance context Service enforcement Decision + current scope Budget / revision / custody request evaluate at admission facts evidence Adapter Admitted effect allow Refused / expired / missing required evidence Record the reason. No new external effect. deny RULE CHANGES USE THEIR OWN GOVERNED OPERATIONS Privilege expansion requires distinct author and approver. Review is conditional on the governing contract; ordinary requests do not require a universal human approval step. Revocation blocks new admission. Accepted operations survive policy changes and require explicit reconciliation. Edicts can produce authorization policy, acceptance conditions and reusable guidance. Activated policy versions bind to typed scopes. The service supplies request facts to the decision and enforces the result together with budget, revision and operation custody. Required evidence is checked by its owning workflow or validator; guidance entering context never grants authority. ### Before execution Authenticate the caller; authorize the method, resource, destination and scope; reserve budget; persist operation identity. ### At execution An isolated worker uses scoped adapters. Infrastructure credentials and unrestricted network egress are unavailable. ### After execution Record results and inspect effects. A lost reply triggers reconciliation of the same operation, not a replacement. The operation ID binds tenant, caller, method, target and argument digest. A changed binding is rejected. Target idempotency and outcome queries are used where available. When neither can resolve a sent request, the outcome remains UNKNOWN and automatic replay stops. A successor reconciles under its own scoped authority while preserving the original caller and intent; custody transfers are separately recorded. Policy, identity, budgets and release controls require separate administrative capabilities. 10 Runtime & evolution ## Replace services. Preserve the system. Stable contracts decouple service identity from its process, model and storage implementation. Begin with a small operational footprint and add distribution only when workload or availability needs justify it. ### Bound execution Supervisor, concurrency limits, resource allowances, backpressure, deadlines and retry ceilings operate below the model. ### Upgrade in place Isolate a candidate; qualify live canaries; route explicit traffic stages; keep the old version hot through stabilization. ### Recover deliberately Drain bounded calls; resume long work from durable continuations; preserve compatible state and operation custody. Failed or stale evidence stops promotion; breached criteria route traffic back. Old and new versions share the operation ledger, including timers and reconcilers. Restore starts with effect admission disabled until older workers, external outcomes and newer revocations are reconciled. One recoverable host is a viable first deployment, not host high availability. Explode the runtime & evolution diagram ＋ Open full-size diagram ↗ (https://aegises.org/agi-reactor/assets/runtime.svg) [Diagram text; consult the linked SVG for spatial relationships.] V3.B5 / Runtime & evolution Planned architecture. The full contracts and equivalent text are documented on this page. V3.B5 Runtime & evolution Stable service identities. Replaceable implementations. V3.B / OVERVIEW (https://aegises.org/agi-reactor/#architecture) Start with a small operational footprint NATS + JetStream · transactional control service · compositor · workers · adapters Host OS + supervisor isolate, restart and bound processes. Split deployments for fault containment, load or independent release—not every noun. REPLACE A SERVICE WITHOUT RESTARTING THE WHOLE SYSTEM Isolate Zero ordinary traffic Qualify Live canary evidence Ramp Policy-controlled stages THE OLD VERSION STAYS HOT THROUGH STABILIZATION Drain Stop new assignment Resume Durable continuation Stabilize Compatible state Resource stewardship Reserve allowance before dispatch. Cost / tokens / CPU / memory / time Priority · fairness · concurrency limits Backpressure · timeout · retry ceiling FinOps proposes reviewed refactoring. Failure containment Failed/stale canary → stop promotion Breached criteria → hot fallback Expand / migrate / contract schemas One operation custodian across versions Restore starts with admission disabled. VIABLE FIRST / SCALE WHEN THE OUTAGE BUDGET REQUIRES IT One recoverable host is not host high availability. Prove backups and restore. Broker, database and host maintenance remain separate operational responsibilities. 11 The safety case ## Safety must be inspectable. Here, safety means containing identified hazards within a declared operating scope. A policy decision is necessary; it cannot alone prove that an authorized action is appropriate. Scope and trust assumptions The design assumes correctly enforced host isolation, trustworthy administrative roots, usable cryptography and service implementations that meet their declared contracts. It does not establish general alignment, harmlessness of every authorized action, or protection from a compromised administrative root. Each domain needs its own permitted-use constraints and hazard analysis. Design invariant → enforcing mechanism → validation specimen → evidence status | Hazard | Enforcing mechanism | Required challenge | Evidence | Unauthorized action | Authenticated caller + scoped service policy; generated code has no bypass path. | Deny wrong tenant, target, expired grants and attempts to self-escalate. | Designed | Private data disclosure | Read and release policy; scoped model/tool egress; sensitivity on derived artifacts. | Attempt forbidden provider submission, cross-account retrieval and secret leakage. | Designed | Duplicate or stale effects | Immutable operation binding, durable custody and target-aware reconciliation. | Duplicate command; race workers; crash after external acceptance; resume old version. | Designed | Uncontrolled consumption | Reserved allowances, scheduler admission, deadlines and retry ceilings. | Exhaust budget, stall a dependency and flood the queue; retain stop control. | Designed | Loss of human control | Independent suspension and privileged control changes; admitted effects remain visible. | Pause during reasoning and execution; prove new admission stops and in-flight work is accounted for. | Designed | Unsafe evolution or restore | Isolated rollout, hot fallback, compatible state and a recovery admission barrier. | Fail a canary; run old/new adapters; restore a backup older than an effect or revocation. | Designed | Incorrect reasoning or poisoned memory | Source attribution, contradictions, bounded tasks, outcome evaluation and scoped approval. | Plant misleading instructions/evidence; verify they cannot grant authority or silently become truth. | Designed “Designed” means the contract and challenge are specified here. This publication does not supply end-to-end runtime test receipts. A future verified claim must link the exact implementation, environment, specimen, result and date. Documentation alone is not certification. 12 The viability test ## Prove the journey, including the interruption. Start with one useful service change requested through chat. The acceptance test crosses the whole architecture and returns a result a person can actually use. - 01 ### Receive Persist a useful request and recover the same ticket after losing its reply. - 02 ### Coordinate Race workers; enforce current custody, capacity and a real test budget. - 03 ### Understand Recover context, preserve a conflicting observation and produce a useful plan. - 04 ### Execute Crash after target acceptance; reconcile the same operation without a duplicate effect. - 05 ### Control Pause and revoke access; show enforced refusal and account for admitted work. - 06 ### Evolve Canary a service while its fallback stays hot; fail it and demonstrate recovery. - 07 ### Deliver A recipient uses the result; evaluate a source-linked lesson on follow-up work. - 08 ### Restore Recover an older backup without resurrecting stale workers, grants or completed effects. Measure usefulness and control together. Task quality · latency · total cost · recovery time · duplicate effects · recipient acceptance. Choose numerical service and recovery objectives for the workload before qualification. Explode the whole-system trial ＋ [Diagram text; consult the linked SVG for spatial relationships.] V3.B6 / Prove the whole system Planned architecture. The full contracts and equivalent text are documented on this page. V3.B6 Prove the whole system A useful end-to-end outcome is the unit of progress. V3.B / OVERVIEW (https://aegises.org/agi-reactor/#architecture) 01 Receive & resume Accept a real request; lose the reply; recover the same ticket. 02 Coordinate & bound Race workers, enforce one current attempt and a real budget. 03 Know & reason Compose permitted context; preserve contradiction; make a useful plan. 04 Act & reconcile Crash after target acceptance; recover the original operation. 05 Stop & govern Pause new work; deny expired authority and exhausted allowance. 06 Evolve & recover Canary a service change; fail it; use the checked hot fallback. 07 Deliver & learn Recipient uses the result; evaluate a source-linked lesson. 08 Restore & continue Block effects; exclude old workers; reconcile outcomes and revocations. Measure usefulness and control together Task quality · latency · total cost · recovery time · duplicate effects · recipient acceptance PUBLIC ACCEPTANCE / aegises.org/agi-reactor An outside human or AI can reconstruct the system, its safety contracts and its limits. 13 Enterprise / coverage map ## Complete without multiplying primitives. The enterprise orientation sections describe the operating world. They map into a small set of contracts; a heading does not require a new daemon, protocol or authority. Orientation vocabulary mapped into the reference architecture; no account records or operational census are included. | Responsibility | Enterprise sections | Architectural home | People & enterprise | Enterprise · Account · Org Chart · Projects · Roadmap · Campaigns | Purpose, stakeholders, ownership, priorities and acceptance. Contract ↗ (https://aegises.org/agi-reactor/#work) | Interaction & orientation | Service Shell · Chat · Topics · Channels · Sessions · Tickets · Pinned · Urgent! · Dashboards · System Diagrams | Shared intent, bounded invocation, interruption, decisions and intelligible delivery. Contract ↗ (https://aegises.org/agi-reactor/#work) | Meaning & knowledge | Ontology · Wiki · FAQ · Files · Skills · Memory Agents · Data Sovereignty | Typed state, attributed knowledge, custody, retention, correction and retrieval. Contract ↗ (https://aegises.org/agi-reactor/#state) | Intelligence | Agents · Agent Onboarding · AI · Code Harnesses | Persistent identity, bounded context, model routing, learning and recovery. Contract ↗ (https://aegises.org/agi-reactor/#cognition) | Work & time | Ticketing · Dispatch · Workflows · Routines · Reactions | Single ownership, dependencies, attempts, triggers and bounded execution. Contract ↗ (https://aegises.org/agi-reactor/#work) | Authority & custody | Aegises · IAM · Keys · Policies · Wallets · Transactions | Scoped powers, controlled data release, accountable finance and reconciliation. Contract ↗ (https://aegises.org/agi-reactor/#authority) | Execution & economy | Platform Stack · Core Services · Integrations · Network · Hosts · Fleets · Domains · Billing · Budgets | Service placement, connectivity, dependencies, capacity and resource limits. Contract ↗ (https://aegises.org/agi-reactor/#runtime) | Improvement & assurance | Code Repos · Testing · Gauntlets · Observability · FinOps → Dynamic Refactoring · AGI Reactor Engineering | Exact artifacts, independent challenge, measured outcomes, safe change and recovery. Contract ↗ (https://aegises.org/agi-reactor/#validation) | Research & participation | Research Labs · Aegises.org · PanSigna.org · Community · Civic Engagement · Careers · Partners · Investors | Research and participation connect to owned work; these are organizational surfaces, not kernel primitives. Contract ↗ (https://aegises.org/agi-reactor/#scope) 14 RFC-001 / Executable failure specimen ## One effect. Two possible recoveries. A target accepts a non-idempotent request and returns HTTP 200. The worker dies before saving success. A restored backup contains UNKNOWN. The test must catch recovery that sends the effect again. ### Guarded recovery One effect, zero duplicates. UNKNOWN remains unresolved; the original operation and replacement attempts are refused. ### Broken recovery Reset UNKNOWN to ready and clear the hold: two effects. The same safety assertion fails, as intended. ### What was exercised Real loopback HTTP, worker termination and SQLite backup. This is an isolated reference specimen, not qualification of a production NATS/PostgreSQL runtime. The test oracle can count the external effects. The recovering controller cannot. An honest unresolved result is required when no admissible evidence can close the gap. Read the RFC as text ↗ (https://aegises.org/agi-reactor/conformance/RFC-001.md)Executable source & tests ↗ (https://github.com/Smithright/aegises.org/tree/main/agi-reactor/conformance)Guarded trace ↗ (https://aegises.org/agi-reactor/conformance/guarded-result.json)Failing control trace ↗ (https://aegises.org/agi-reactor/conformance/negative-control-result.json) Read the complete fault schedule, assertions and operator contract ＋ Status: executable reference specimen · 14 September 2026 · Draft 1.1 companion. ### Question Can a recovered controller avoid repeating a non-idempotent external effect when its restored operation record cannot establish whether the effect happened? The required outcome is one effect and an honestly unresolved commitment. Silently treating the operation as successful would be as incorrect as retrying it. Liveness is intentionally sacrificed for the affected step until admissible evidence resolves the uncertainty. ### System under test and limits The supplied reference guard uses Python's standard library, a real loopback HTTP target, an actual worker subprocess, SQLite transactions and the SQLite backup API. The target commits an append to its own ledger before returning HTTP 200. The worker reads that response, then terminates with exit code 86 before saving success. The target implements neither an idempotency key nor a status route. Each POST appends another record. Only the test oracle reads the target ledger to count effects; the recovering guard never receives that path or a query capability. Oracle knowledge must not become production evidence. This is a small, single-controller reference implementation for falsifying a recovery algorithm. It does not exercise NATS, PostgreSQL, concurrent admission, distributed custody, real authentication, actual sandbox containment, provider behavior, multi-host failure or production deployment. The local epoch file represents recovery authority outside the restored database; it is not a production implementation of that authority. Its persistence, monotonicity and exclusion of old processes remain deployment obligations. ### Fixed input ``` { "ticket": "ticket-001", "assignee": "agent-a", "step": "ticket-001/step-1", "operation": "operation-001", "epoch": 1, "intent": { "tenant": "specimen", "caller": "agent-a", "method": "append", "target": "local-receipt-ledger", "arguments": {"receipt": "R-001"} } } ``` The operation binds a SHA-256 digest of canonical JSON: sorted keys, compact separators, UTF-8. This fixture uses only strings and objects; general cross-language canonicalization is not specified by this example. A unique workflow-step binding prevents replacement operation IDs from evading unresolved work. ### Fault schedule | Step | Action | Controller knowledge | External reality | 0 | Persist ticket, step and immutable operation binding | ADMITTED; epoch 1 | No effect | 1 | Commit conservative send-intent before issuing POST | UNKNOWN: the call may be sent | No effect yet | 2 | Target commits receipt R-001 and returns HTTP 200 | Worker receives 200; durable record still UNKNOWN | Exactly one effect | 3 | Terminate worker with exit code 86 before result commit | UNKNOWN; no durable success evidence | Exactly one effect | 4 | Take a control database backup while UNKNOWN; attempt retry | Retry returns OUTCOME_UNKNOWN | Exactly one effect | 5 | Restore that backup; establish epoch 2 and an admission hold outside restored state | Ticket NEEDS_RECONCILIATION; operation UNKNOWN | Target ledger is not restored | 6 | Retry from epoch 1 | STALE_EPOCH | No new effect | 7 | Change the arguments, invent a replacement ID, and replay the original | INTENT_MISMATCH; RECOVERY_HOLD; RECOVERY_HOLD | No new effect | 8 | Test-only probe: remove global hold without changing UNKNOWN | Original → OUTCOME_UNKNOWN; replacement → STEP_ALREADY_HAS_OPERATION | No new effect | 9 | Inspect the test-only oracle | Guard still knows UNKNOWN | Exactly one effect; zero duplicates Step 8 isolates the per-operation guard so a global hold cannot mask a broken UNKNOWN check. The harness directly removes that hold; it does not implement or qualify the production barrier-release policy. UNKNOWN starts before send because no atomic transaction spans the control database and the external target. A crash before transmission may therefore also produce uncertainty. The runtime must not silently reinterpret UNKNOWN as “sent,” “failed,” or “safe to retry.” The trace restores the control database without restarting the target or rolling back its effect. It models the asymmetric restoration boundary, not a full infrastructure disaster. A backup predating the operation's existence, lost revocations, concurrent old/new controllers and transfer of adapter custody need additional deployment specimens. ### Assertions - Initial execution actually reaches the target: effect count before restore is exactly 1. “Never send anything” cannot pass. - Worker exit is 86, reached only after reading HTTP 200; the backup contains UNKNOWN. - Guarded restore leaves the operation UNKNOWN and the ticket NEEDS_RECONCILIATION. - Old-epoch, changed-intent, replacement-ID and same-operation requests cannot produce a new effect under the hold. - The independent target oracle counts exactly 1 effect after recovery attempts. - No success result or settled outcome is inferred from the oracle by the guard. ### Negative control: make the algorithm fail The unsafe-reset-on-restore mode deliberately converts UNKNOWN to ADMITTED and clears the recovery hold. Replaying the original operation then creates a second external receipt. The very same target-count assertion must fail. This control demonstrates sensitivity to the identified defect; it does not prove completeness against every recovery defect. The normal test suite expects and catches that assertion failure, so both suite tests pass when the test oracle works. ``` python3 -m unittest discover -s agi-reactor/conformance -v python3 agi-reactor/conformance/unknown_restore.py --assert-safe python3 agi-reactor/conformance/unknown_restore.py --mode unsafe-reset-on-restore --assert-safe ``` The last command is expected to exit 1 with duplicate external effect after UNKNOWN restore. It is an intentionally failing specimen, not a production mode. All runs use an automatically allocated loopback port and disposable local state. No third-party target or real customer operation is contacted. ### Operator contract: uncertainty is a working state A blocked operation must expose, together: ticket and step, immutable operation identity, original initiating principal, current assignee/reconciliation owner, last admitted intent, last trustworthy evidence and time, why the outcome is unknown, next inspection action and escalation deadline. The system must distinguish an assigned operator from an actually delivered alert; notice delivery and acknowledgment are recorded independently. The safe surface offers inspect evidence, assign reconciliation, record a finding, and escalate. It does not offer an ordinary Retry button for an unresolved non-repeatable effect. Repeated alerts are bounded and have an escalation owner. Deleting or dismissing an alert does not clear the operation hold. A finding must preserve source, scope, observer and observation time. A separately authorized reconciliation operation can record confirmed success or confirmed absence only under the adapter's declared evidence rules. “No record found” is not proof of absence when the provider can still commit a delayed request or its observation is incomplete. If a target cannot establish final absence, the operation stays unresolved. An authorized risk acceptance for a fresh action is a distinct decision and operation, linked to the unresolved predecessor; it cannot be reported as a safe automatic retry or erase duplicate risk. Cancellation blocks new work but cannot unsend an accepted effect. Closure may record accepted uncertainty; it must retain the unresolved effect and its audit trail. In this specimen no admissible target evidence reaches the controller, so the correct terminal observation is still UNKNOWN. ### Adjacent review requirements - Compositor non-escalation. A deployment qualification vector must plant grant-widening instructions in a permitted wiki object and a derived summary. Execute the resulting grant-change request through the real boundary. Assert that effective grants and external effects remain unchanged; a textual refusal is insufficient. This vector is specified, not implemented by RFC-001. - Policy promotion. A suggested lesson remains advisory until a versioned policy candidate passes typed validation, a scoped impact analysis, adversarial tests and independently authorized approval. Privilege-expanding changes require distinct author and approver identities; the same principal cannot satisfy both roles. Activation is bound to exact policy bytes and scope, with expiry where appropriate and a recoverable rollout. An LLM's recommendation and a human click are not evidence of informed review. - Service split criteria. A proposal to split the initial control service must identify measured lock/queue contention against a declared latency objective, an independently required release boundary, or a fault/trust boundary. Include the state owner, transaction boundary, migration and rollback, new failure modes and expected operational cost. An ontology heading or desire for symmetry is insufficient. - Kernel growth. A new primitive, protocol or daemon must name the consumer and invariant that existing contracts cannot satisfy. Prefer a typed object, method or projection until evidence requires another boundary. - Isolation qualification. Isolation is mandatory. Each deployment names its host/sandbox, effective privileges, egress policy and relevant escape/bypass tests. CHERI/seL4 is a candidate substrate with its own qualification obligations; drawing that label does not establish end-to-end containment. ### Evidence classification Observed here: a real local side effect; crash after 200; backup containing UNKNOWN; guarded refusals; and a negative control that creates a duplicate and fails the assertion. These are reference-specimen results. Production controls remain Designed until the same fault schedule is exercised against the actual services with attributable receipts. Zero observed duplicates is necessary for this specimen to pass. It is not an exactly-once guarantee for arbitrary external systems or a universal safety certificate. The backup in this specimen is taken after the target effect, while the controller still records UNKNOWN. Restore from a backup predating the operation, concurrent admission and production barrier release remain separate qualification cases. Zero observed duplicates in this specimen is not a universal exactly-once guarantee. 15 Implementation specification ## The decisions behind the diagram. Concrete record semantics, concurrency rules, effect recovery, learning, governance and upgrade tradeoffs. The complete text is included in this page and available as a plain-text companion. Read or download the complete Markdown specification ↗ (https://aegises.org/agi-reactor/architecture.md) Read the full technical specification ＋ ### Architectural judgment The architecture should make a persistent agent's knowledge, commitments, authority and resources coherent across replaceable executions. Its defining quality is continuity with consequence: it can resume useful work without guessing what happened, exceed neither its authority nor its resource allocation, and improve without discarding its obligations. Message transport supplies the communication kernel; NATS is the reference implementation. The kernel contract also includes: authenticated invocation, owned state transitions, durable commitments and recoverable operations. The host OS still isolates and schedules processes. These are deliberate responsibility boundaries, not objections to a service-oriented system. The compressed semantic surface is object, link, message; invoke. This is a working design constraint, not a claim that three universal tables solve every domain. State machines, authorization, transactional storage, scheduling and reconciliation remain real implementation responsibilities. If compression hides one of these, it has failed. ### Safety scope and assumptions Safety here means containing identified hazards within a declared operating scope: unauthorized effects, disclosure, duplicate effects, uncontrolled resource consumption and loss of human control. Each consequential service declares permitted use, action constraints, foreseeable hazards, enforcement points and validation specimens. Authorization alone does not establish that an action is appropriate. This architecture does not establish general alignment, harmlessness of every authorized action, or safety against a compromised administrative root. Workers and generated code run without infrastructure administration credentials or unrestricted external egress. Tool access, model-provider submission and external destinations pass through scoped adapters. Authorization covers reading information and releasing it to a destination. Retrieved instructions remain untrusted content; they cannot change authority. Tenant and sensitivity constraints propagate into frames, derived artifacts, logs and indexes, with explicit retention and deletion behavior. ### Whole-system coverage | Responsibility | Viable first implementation | Expansion trigger | Human purpose and control | Conversation, explicit outcome and acceptance, priority, pause/cancel, decisions and observed delivery | Multiple stakeholders need negotiated portfolio allocation | Identity and authority | Stable principal, scoped delegation, policy at service boundaries, revocation, tenant isolation | Additional trust domains require federation | Shared meaning and state | Typed objects and links, owning services, revision checks, provenance, attributed assertions | Measured query or schema needs exceed the initial relational model | Perception and knowledge | Adapters turn observations into attributed records; retrieval carries source, time, uncertainty and contradiction | More modalities or measured retrieval deficits | Cognition and learning | Bounded compositor, replaceable models, explicit hypotheses/plans, outcome evaluation, versioned lessons | Demonstrated improvement on held-out tasks warrants more automation | Work and coordination | Tickets with one assignee, dependencies, bounded attempts, routines, events, deadlines and cancellation | Measured throughput/fairness needs exceed simple admission | Effects and reconciliation | Typed invocation, durable operation identity, target-aware idempotency, outcome query and evidence | New effect domains require new adapters/contracts | Runtime and economics | Supervisor, bounded concurrency, admission budgets, health, usage and restart backoff | Actual capacity pressure or availability requirement | Evolution and recovery | Isolated candidates, staged traffic, hot fallback, compatible state, backup/restore trial | Failure-domain requirements justify replicated infrastructure | Human/agent orientation | World State and UI projections over the same authorized records; visible source freshness | New consumers require new projections, not new authorities ### Semantic contract - Object: stable ID, type/schema version, owning service, revision, attributed state. Ticket, agent, edict, skill, service, observation, hypothesis and context frame are domain types. A principal is an identity, not a model process. A service identity is not its current implementation instance. - Link: typed relationship between object IDs, with provenance and temporal/revision scope where meaningful. assigned-to, depends-on, supports, contradicts, governed-by, implements, supersedes. No fixed semantic fan-out, but every traversal has access, depth, time and result limits. Not every link creates a scheduling dependency; dependency cycles must be rejected or explicitly resolved. - Message: immutable attributed communication with ID, kind/schema, sender, intended recipient/scope, correlation and causation, body and references. Chat is the conversational form of IPC. Natural-language content is not executable authority. Typed commands require admission; events report committed facts. Transient presence and token streams need not be retained as durable commitments. - Invoke: one envelope, typed methods. invoke(service, method, target, arguments, operation_id, expected_revision?, frame_ref?, attempt_generation?, deadline, budget_ref) with authenticated caller authority supplied by the transport/session. A request naming a principal does not authenticate it. Responses distinguish rejected, accepted/pending, succeeded, failed and unknown. Cancellation and status are discoverable service methods. This is illustrative notation, not a claim that those exact endpoints exist today. Keep the domain vocabulary rich and the protocol small. Do not flatten a policy into an ordinary note or an observation into a fact merely because they share a record form. ### Concrete placement Start with a small number of deployments: NATS + JetStream; one transactional control/state service; a compositor; agent workers; governed effect adapters; a supervisor. Identity, policy, catalog, ticket scheduling, inbox and outbox can begin as modules behind the control service's contracts. Split processes for measured load, independent release or failure containment, not for every noun in the ontology. Untrusted execution belongs outside that process. The control/state service owns transactional object revisions, links, ticket assignment, active attempt generation and operation records. PostgreSQL is my default backing store for these atomic changes and relational queries. Reuse existing storage only where it provides this contract; changing storage is a separate implementation decision with a migration plan. Blobs, source code and large artifacts remain in suitable stores behind references. “Everything is a service” means stable mediated access; it does not require replacing physical files with individual daemons. Use Core NATS for bounded request/reply and disposable signals. Use JetStream for recoverable dispatch and committed change propagation. Accepted work must reach durable custody before the UI reports acceptance. SQL state plus outbox event are one transaction; an outbox publisher retries using the same event identity. A consumer deduplicates into its inbox and commits the resulting state before acknowledging. Broker duplicate suppression helps, but is not the permanent application operation ledger. The control database is authoritative for the records it owns. JetStream is the delivery/replay substrate for retained events, not a second editable ticket authority. Search, embeddings, World State and dashboards are rebuildable projections with source revisions and freshness. Do not begin with a requirement to reconstruct every object solely by replaying all history. ### Ownership is simple; concurrency is enforced A ticket has zero or one assigned agent, one acceptance contract and a durable result/recovery record. Assignment is updated atomically against an expected revision. Begin with one active attempt per ticket. Parallel work uses linked tickets with separate assignees; it does not make one ticket multiply owned. Assignment survives worker replacement. An execution attempt has a generation and bounded custody; renewals and reassignment use authoritative state. Workers cannot create their own valid generations. A named-agent dispatch route does not itself authorize execution. Queue groups distribute messages; they do not establish business assignment. At the effect boundary, the service admits an operation against current authority, ticket/attempt generation and target revision. A stale worker cannot start a new operation. An already admitted operation remains durable owned work and may finish after the initiating worker dies; reassignment does not erase it. The next worker reconciles it. Cancellation is cooperative for work already committed to an external system. At first admission, bind the operation ID to tenant, authenticated caller, method, target and canonical argument digest. Reuse with a different binding is rejected. Retries and successors recover the ID from the durable workflow step; they do not replace it while the outcome is unresolved. Adapters declare the target idempotency scope and retention window. A successor uses a separately authorized status or reconciliation method referencing the existing operation; it does not resubmit the original effect with a different caller binding. The original initiating principal remains immutable, while the reconciler identity and any custody transfer are separately attributed. Reconciliation cannot widen the admitted effect scope. An effect gateway must make admission and operation ownership durable and serialize competing attempts for the same operation. A one-time generation check followed by unconstrained direct external calls is insufficient. Where a target supports idempotency keys, reuse the operation ID. Where it supports status lookup, reconcile. Where neither exists, a crash after sending can leave UNKNOWN; stop automatic retries and expose the uncertainty. No database transaction or NATS acknowledgment can erase that boundary. Different tickets may target the same object: its owning service serializes or rejects conflicting revisions. Tickets are a durable coordination abstraction, not a global lock for every linked object. Multi-service workflows use explicit steps and compensating actions where available; no universal distributed transaction is required. A durable dispatch notification can be acknowledged once the state service has accepted execution custody and a reconciler can find abandoned work. Do not use an hours-long unacknowledged broker delivery as the only ticket lifecycle. A low-cost deterministic reconciler repairs expired attempts, unpublished outbox entries and stuck operations; it does not wake a model when no reasoning is needed. ### Cognition must include more than context assembly The compositor receives principal, ticket, permitted sources and resource limits. It resolves access before traversal, retrieves relevant material, and assembles a versioned frame manifest with source revisions and compiler version. Required continuity includes purpose, acceptance, assignee, active attempt, applicable constraints, unresolved operations and return point. Missing required material produces an explicit incomplete frame. Optional material is ranked and bounded. A frame is a bounded view, not a copy of the entire world or a bearer capability. There is no promise of a global atomic snapshot across external services: each source reports revision/time, and consequential writes recheck their preconditions. An initial deterministic compositor is easier to inspect; model summaries can later become attributed, cached derivative objects. Perception produces observations. Reasoning produces hypotheses, plans and proposed actions. Evaluation compares expected and observed outcomes. Consolidation proposes corrections, lessons and skill changes with provenance. Do not silently promote a model's confident summary into canonical truth. Preserve conflicting observations and invalidation links; use appropriate uncertainty representations rather than a universal invented confidence number. Memory retrieval, procedural skills and model inference remain replaceable services. Improved behavior is promoted after representative evaluation and bounded trials. Learned policy suggestions cannot grant authority. Budgets, stop conditions and an independent supervisor bound the loop; cognition may choose to wait or ask a human instead of generating more tasks. ### Authority and human agency Authenticate principals; bind scoped authority to service methods and resource targets. NATS subject permissions constrain transport; the service still enforces object-level policy and tenant scope. Enforce revocation at new operation admission, with explicit expiry/cache behavior. The policy service must not depend on an LLM to decide ordinary admissibility. Changing policy, identity, resource ceilings, routing or release controls requires a distinct administrative capability and an attributable versioned change. Ordinary work cannot enlarge its own authority or disable its enforcing boundary. Emergency suspension blocks new effect admission independently of models. If a control service is unavailable, only explicitly defined safe operations remain available; cached authority has bounded expiry. Edicts retain the original distinction between laws/standards, SOPs, guidelines and examples. Machine-enforceable requirements become versioned policies at the relevant boundary. Advisory guidance informs composition. Ambiguous prose does not become a deny rule by accident. Approval is a scoped decision object with identity, expiry and conditions when required, not a generic confirmation loop. Human interfaces expose meaningful controls: change priorities, inspect reasons/evidence, pause, cancel future work, decide exceptions and receive a usable result. Pausing cognition, blocking new effect admission and undoing a completed external effect are distinct operations. A supervisor can stop new work even when a model or optional UI is unhealthy. Secret values stay in managed secret storage; ordinary frames contain references and only the minimum needed context. ### Resources, reliability and upgrades Every execution is admitted against bounded concurrency and a resource allocation: model/token quota, money, CPU/GPU, memory, wall time and downstream capacity are distinct dimensions. Reserve an allowance before dispatch, account usage, cap retries and release unused capacity. Priority and fairness belong in the scheduler. Backpressure, timeout, retry delay, quarantine and load shedding must be specified; they cannot be delegated to “the agent will figure it out.” Service identity and contract stay stable while implementation instances change. Start vNext isolated with zero ordinary traffic. Qualify with attributable live canaries. A governed router/controller allocates explicit traffic stages. Keep the old version hot and continuously checked through stabilization; stop promotion on stale/failed evidence and return traffic automatically when criteria breach. Ordinary NATS queue sharing is not that rollout controller. Old and new versions share the authoritative operation ledger. Dispatch, reconciliation, timers and background jobs acquire custody through the same protocol. A rollout cannot grant both versions permission to send the same non-repeatable effect. Compatible continuation and operation formats are qualification requirements. If safe transfer is not established, the old instance retains the operation or it enters reconciliation; upgrades do not justify blind replay. Stop assigning new work to an old instance, drain bounded in-flight requests, and resume long work from durable continuations. Preserve schema and message compatibility across old/new versions using expand/migrate/contract. Delay destructive cleanup until fallback is no longer required. Secret rotation, routing and policy updates are likewise versioned control-plane changes. The broker, database and host have their own maintenance procedures; avoiding a global application restart does not eliminate maintenance. Start with one recoverable host if its outage budget permits: persistent volumes, supervised processes, real backups and a witnessed restore. This can survive worker crashes; it does not provide host availability. A multi-node NATS cluster and a highly available database are separate later decisions. Avoid a premature orchestration platform or bespoke storage engine solely to make the architecture sound complete. Restoring older state begins with new effect admission disabled. Recovery establishes a new runtime epoch, excludes old workers, reconciles retained events and external outcomes, and restores or revalidates authority changes newer than the backup. Missing evidence blocks replay of affected effects. Dispatch resumes only after this recovery barrier is satisfied. The selected workload must define recovery-point and recovery-time objectives before qualification. ### Prove one complete system before widening it Use a small representative service change requested through chat, with acceptance that a human can verify. Include one relevant knowledge correction and one pause/resume so cognition and human control are tested alongside transport. - Receive the request; persist acceptance and link source intent. Lose the acceptance reply and recover the same ticket by operation identity. - Admit a budget, assign one agent and race two workers. Exactly one current attempt may admit new effects. A resumed stale worker is refused. - Compose bounded context, preserving a contradictory source and a pending operation. Denied material cannot enter the frame. Demonstrate useful planning, not merely valid JSON. - Execute a reversible representative effect; redeliver its command and kill the worker after the target accepts but before reply persistence. Reconcile the same operation; never create a replacement solely because its reply was lost. - Pause new work and exhaust a small test budget. Neither condition should depend on the model politely stopping; the service boundary refuses further admission. Already admitted work remains visible. - Upgrade the effect service through isolated candidate, canary and a small traffic stage while the old instance remains hot. Inject a failed/stale canary and demonstrate rollback. Preserve the ticket and operation identities across versions. - Deliver a result the recipient can use; record their acceptance and update the derived World State. Consolidate a source-linked lesson; compare a follow-up task against baseline before promoting a new skill. - Restore durable state from backup in an isolated environment and recover unresolved commitments. Check object revisions, operation status and replay boundaries together, not just that the process boots. Measure completion quality, latency, total cost, recovery time, duplicate effects, stale-worker refusals and usability of the result. Set numerical SLOs from the chosen workload before implementation qualification. These are planned acceptance specimens, not reported test results. ### Design judgment / explicit decisions - Persist obligations and evidence; make model executions replaceable. - Prefer rich domain meaning over many protocols or transport-specific nouns. - Put enforcement beneath simple interactions. A user assigns one agent; the runtime handles attempts and failures. - Spend cognition on ambiguity and invention; use deterministic code for routine coordination. - Treat uncertainty as state that can be resolved, not prose that gets forgotten. - Build service contracts first, with few deployments. Separate implementations when evidence justifies it. - Pay for redundancy and abstraction when a named consumer needs them. - Evaluate learning and usefulness as seriously as delivery and authorization. - Make continuing, stopping and recovering understandable to both human and agent. 16 Reference implementation ## Stable roles. Concrete implementation choices. The contract defines what must hold. The implementation supplies a candidate mechanism. Qualification establishes whether that mechanism meets the contract in its actual environment. This table maps the architecture to a viable starting stack. A reference choice is a design decision; a proposed selection is an integration recommendation. Neither label asserts a deployed or qualified system. Several responsibilities can share one control/state process without losing their distinct contracts. Architectural role → reference implementation → required contract → evidence status | Architectural role | Reference implementation | Required contract | Evidence status | Communication kernel | Core NATS (https://docs.nats.io/learn/core-nats/) | Bounded request/reply and transient signals. Authenticate transport peers; enforce object and tenant authority in the owning service. An unanswered call does not prove that no effect occurred. | Reference choice Core delivery is at-most-once. Production version, configuration and failure tests remain to be qualified. | Recoverable delivery | NATS JetStream (https://docs.nats.io/concepts/jetstream) | Persist accepted work in authoritative state with an outbox. Publish with stable event identity; consumers commit deduplication and state before acknowledgment. Delivery does not assign a ticket. | Reference choice Acknowledgment and redelivery behavior is documented. Application custody and replay safety require separate tests. | Authoritative state | PostgreSQL + control/state service (https://www.postgresql.org/docs/18/transaction-iso.html) | Atomic record revisions, one assignee, one current attempt and an immutable operation binding. State changes and outbox commit together. Choose isolation, constraints and locking for each transition; handle transaction conflicts explicitly. | Reference choice Database transactions support the design. They do not implement ticket semantics or external-effect reconciliation by themselves. | Authorization decision | Cedar + service enforcement (https://docs.cedarpolicy.com/auth/authorization.html) | Validate policy against its schema; evaluate trusted request facts against an identified policy version. Refuse admission on evaluation errors, unavailable required facts or an invalid authority frame. The service also checks budget, revision and operation custody. | Proposed selection Cedar uses default-deny, forbid-overrides-permit and skip-on-error. The proposed Reactor integration must inspect error diagnostics and enforce its stricter refusal contract. | Public semantic contract | W3C OWL 2 + explicit policy profiles (https://www.w3.org/TR/2012/REC-owl2-overview-20121211/) | Publish stable identifiers, meanings, version history and reviewed mappings into executable policy schemas. Define how missing or conflicting information affects admission. An ontology inference never grants authority by itself. | Proposed standard basis OWL 2 is specified. The AGI ontology, institutional charter and cross-implementation conformance suite remain proposed. | Context composition | Compositor service contract (https://aegises.org/agi-reactor/#cognition) | Assemble permitted, source-attributed context with current obligations, acceptance, constraints, contradictions and pending effects. Preserve required continuity or explicitly refuse an incomplete frame. | Integration required The contract is specified here. No qualified compositor package or end-to-end recovery result is supplied by this publication. | Execution containment | Host supervisor + isolated workers (https://aegises.org/agi-reactor/#runtime) | Restrict credentials and egress, bound resources and enforce suspension below the model. Verify that generated code cannot reach an alternate effect path. Declare the host and isolation assumptions. | Runtime selection open A named host, isolation configuration and adversarial containment results are required before deployment qualification. | Resource admission | Control/state service module (https://aegises.org/agi-reactor/#work) | Reserve allowances and current custody atomically before admitting work. Account for in-flight operations, deadlines, capacity and consumption; retain stop control under overload. | Integration required A module in the initial control service, not a new daemon. Budget exhaustion and concurrent-admission cases remain to be witnessed. | Effect recovery specimen | RFC-001: Python / HTTP / SQLite (https://github.com/Smithright/aegises.org/tree/17b1cf33dd556d37760b7c2e95f49cd692b91acc/agi-reactor/conformance) | Keep one operation identity across worker death and restore. Preserve UNKNOWN; refuse both unsafe replay and replacement operations. Distinguish target reality from the recovering controller’s knowledge. | Bounded test recorded The published guarded trace records one effect and zero duplicates; the negative control duplicates the effect. This is a local specimen, not production qualification. | Service evolution | Governed rollout controller contract (https://aegises.org/agi-reactor/#runtime) | Isolate a candidate with zero ordinary traffic, qualify live canaries, allocate explicit traffic stages and retain a checked hot fallback. Preserve compatible state and unresolved operation custody. | Integration required No qualified controller is supplied here. Ordinary queue sharing or a process restart does not establish the rollout contract. ### Replacement is a contract decision. A substitute must preserve the role’s observable semantics: authority, identity, ordering where required, concurrency, acknowledgment, recovery and evidence. Re-run the relevant specimens with the candidate’s actual configuration. A migration must preserve unresolved operations and leave a usable fallback. ### Pin the deployment before qualifying it. This publication does not provide a qualified production bill of materials. Each deployment must record exact package and adapter versions, configuration and policy hashes, schema revisions, host assumptions and the environment of its tests. Link those records to dated specimens and results. A version number or an upstream guarantee alone is insufficient. The RFC-001 evidence manifest (https://aegises.org/agi-reactor/conformance/evidence.json) identifies the existing specimen’s source hashes and observed environment. Its guarded trace (https://aegises.org/agi-reactor/conformance/guarded-result.json) and negative control (https://aegises.org/agi-reactor/conformance/negative-control-result.json) establish only the bounded failure case described in the worked example (https://aegises.org/agi-reactor/#rfc-001). 17 Basis & revision ## An architecture open to examination. Author: Ryan Smithright (ryan@smithright.com). The “all you need” formulation proposes a smaller coordinating model: governed service contracts compose the system and its evolution. In the architectural simplification tradition of Attention Is All You Need (https://arxiv.org/abs/1706.03762), the burden is a concrete construction and experiments that can challenge it. ### Foundational references - James P. Anderson. Computer Security Technology Planning Study, Volume I. ESD-TR-73-51, October 1972, §§3.2.1–3.2.2, pp. 8–10; §3.7, p. 13. Electronic Systems Division, AFSC. Original report, NIST archive. Primary source ↗ (https://csrc.nist.gov/files/pubs/conference/1998/10/08/proceedings-of-the-21st-nissc-1998/final/docs/early-cs-papers/ande72a.pdf#page=16) - Jerome H. Saltzer and Michael D. Schroeder. “The Protection of Information in Computer Systems.” Proceedings of the IEEE 63(9), 1975, pp. 1278–1308, §I.A.3. Author-hosted text. Primary source ↗ (https://web.mit.edu/saltzer/www/publications/protection/Basic.html) - W3C OWL Working Group. OWL 2 Web Ontology Language: Document Overview, Second Edition. W3C Recommendation, 11 December 2012, §§2.1–2.3. Primary source ↗ (https://www.w3.org/TR/2012/REC-owl2-overview-20121211/) - Internet Society. Policy Development Process at the Internet Society. 25 May 2018; updated September 2025. “Policy Development Approach” and “Consultation approach.” Accessed 14 September 2026. Primary source ↗ (https://www.internetsociety.org/about-internet-society/policy-development-process/) - Internet Society. Internet Governance: Why the Multistakeholder Approach Works. 26 April 2016. Executive summary and attributes of successful decision-making. Accessed 14 September 2026. Primary source ↗ (https://www.internetsociety.org/resources/doc/2016/internet-governance-why-the-multistakeholder-approach-works/) ### Cite this publication Smithright, Ryan. AGI Reactor — A Safe, Governable Reference Architecture for Enterprise AGI. AEGISES, public design draft 1.7, 14 September 2026. Sections 02–03: security foundations and the public ontology proposal. Version 1.7 permalink ↗ (https://aegises.org/agi-reactor/versions/1.7/) preserves this edition. Cite the version and section anchor so subsequent revisions do not change the referenced argument. This is an authored technical-policy reference design; it has not undergone journal peer review. BibTeX ↓ (https://aegises.org/agi-reactor/citation.bib)CSL-JSON ↓ (https://aegises.org/agi-reactor/citation.json)Citation File Format ↓ (https://aegises.org/agi-reactor/CITATION.cff)Foundational references ↑ (https://aegises.org/agi-reactor/#academic-references) ### Architecture and implementation sources - NATS: acknowledgments and redelivery (https://docs.nats.io/learn/jetstream/acknowledgment) — transport behavior and failure semantics. - NATS: pull consumers (https://docs.nats.io/learn/jetstream/pull-consumers) — bounded delivery and worker consumption. - NATS: deployment and upgrades (https://docs.nats.io/learn/deployment/) — broker operations, distinct from application rollout policy. - Versioned public source (https://github.com/Smithright/aegises.org/tree/main/agi-reactor) — page, diagrams and specification. The application contracts and safety criteria are proposed architecture. NATS transport guarantees do not establish external-effect idempotency, object authorization or AGI capability. Draft 1.7 adds definitions, a high-level system diagram, a proposed record model, information architecture, ontology primitives and an implementation reference table. V5 adds three editable views while preserving D1–D4. Read preserved draft 1.6 ↗ (https://aegises.org/agi-reactor/versions/1.6/). The author’s Credits remain unchanged. Read preserved draft 1.5 ↗ (https://aegises.org/agi-reactor/versions/1.5/). The reference-monitor foundation, public-ontology proposal and citation records remain available. V4’s four relationship diagrams remain unchanged. Read preserved draft 1.4 ↗ (https://aegises.org/agi-reactor/versions/1.4/) · Read preserved public draft 1.3 ↗ (https://aegises.org/agi-reactor/versions/1.3/) · Download the complete V5 whiteboard ↓ (https://aegises.org/agi-reactor/assets/architecture.excalidraw) For an independent reader Can you reconstruct the components, their authority boundaries, their failure behavior and the evidence still needed—from this page alone? Critique the design against those contracts. Do not infer implementation from documentation. 18 Acknowledgments ## Credits ### Internet Society, IETF, W3C, MANRS Root Stewardship, International Security, & Standards Foundations ### Academia & Sciences Computer Science, Computational Linguistics, Compute Primitives, Encodings, Compiler Engineering, Ontology Engineering, Type Theory, Calculus, Data Science, Information Theory, Language Models, Public Benchmarks, Microkernels, OS Engineering, Network Engineering, Network Protocols, Encryption, IPC, IO, API Engineering, Control Theory, Data Engineering, Model Routing, Enterprise Software Architecture, Middleware Architecture, Internet Exchange Architecture, Computational Neuroscience, Cognitive Science, Artificial Life, Ethics, Philosophy ### Peter Singer, AI Safety Community, & Effective Altruism Ethical Rigor, Moral Courage, Inspiration ### The Open Source Community, Libraries, Public Educators, & other Free Education Sources Giants and Legends ALL! ### Assembly, Compiler, C, C++, Rust, Forth, POSIX, Unix, Python, & Language Communities Giants and legends ALL! ### Andrew Tanenbaum & Minix OS Force, Inspiration, Rigor ### Linus Torvalds & Linux Foundation Kernel Force, Git Force, Foundations ### Cloud Native Compute Foundation Stewardship, Foundations ### Ben Goertzel AGI Foundations, Inspiration ### Google Foundations, Kubernetes Force, Thought Leadership, Standards Force, Equanimity ### Anthropic Moral Courage, Thought Leadership, & Code Force ### OpenAI Code Force, Thought Leadership, Moral Courage ### Chris Lattner Inspiration, MLIR Force, Foundations ### Stanford University Computational Linguistics Thought Leadership ### ETH Zurich Inspiration, Systems Architecture Force, FPGA Force! ### James Anderson Inspiration, Reference Monitor Foundations ### Ludwig Wittgenstein Language Game Theory ### Gottfried Leibnitz Characteristica Universalis, Calculus, Inspiration ### Steve Jobs & Apple Mac Force, Design Inspiration, Posthumous Review ### Elon Musk & Grok Foundations, News & Research Force, Veracity Balancing ### Jensen Huang & NVIDIA Compute Force, Foundations ### Andrej Karpathy, Ilya Sutskever, John Carmack Inspiration, Foundations ### DeepSeek Open Source Foundations, Thought Leadership ### Synadia & NATS Inspiration, Foundations ### Proton.me, Signal Foundation Moral Courage, Security Foundations ### Family, Friends, & Communities Invaluable! ### Kevin Carl Smith Moral Courage, Foundations, Support ### Daniel Faggella & Emerj Potestas, Persistence, & Flame, Adversarial Agency ### Clark Becker Support & Friendship ### Jeff Buhrt Mentorship, Inspiration ### Personal Foundations Accenture, MuleSoft, SalesForce, Purdue University, Springboard ### Other Industry, Academic, & Thought Leadership Foundations Alan Turing, Bell Labs, Microsoft, Oracle, IBM, Meta, Huggingface, OpenHands, Adobe, McKinsey ### Mythos & Inspiration Isaac Aasimov, Ray Kurzweil, The Wachowskis, James Cameron, The Primeagen, Cormac McCarthy, Jorge Luis Borges ### The World's Fair & Olympics Inspiration, Sportsmanship, Moral Courage, Diplomacy ### USA Foundations, Tubes, Silicon Valley ### China Foundations, Make Force ### EU Foundations, Legislation Force ### Nova Mente Inspiration, Partnership, Mythos ### Chief & Jupiter Beast Force, Inspiration and so many more giants and trim tabs...