AEGISESREFERENCE DESIGN · 2.1 DRAFTRead as text ↗
From intent to governed systems

AGI Reactor

A Safe, Governable Reference Architecture for Enterprise AGI

Policy-governed service orchestration is all you need.

AuthorRyan Smithright — Qthonic Labsryan@smithright.com
Ryan’s original whiteboardFrom the original drawing 13 September 2026Open the source +Original architecture: chat divides into tickets, edicts and commentary; policy, template and example types bind into skills and agent types; context composition feeds agents, reactions, routines and delivery; NATS spans the system and typed objects underpin it.
Ryan Smithright’s original drawing. The animation preserves its construction: definitions → bindings → agents → governed delivery.
Reference architecture

The whole system.

Language becomes commitments. Definitions compose execution.

Swipe the diagram to follow the system →

The Reactor: one system, two kinds of commitmentHuman intent becomes tickets and edicts. Tickets retain work. Edicts inform versioned definitions and policy. Typed bindings compose skills and agent profiles; the context compositor assembles a frame for an agent. Governed services produce delivery. Reactions and routines continue the loop. NATS connects the services and owned objects preserve state. NATSCommunication across the system Human intentChat · UI · events TicketsDurable work EdictsStanding direction DEFINITIONS Policy · templatesSkills · agent types typed bindings Contextcompositor Permitted knowledge + current work Agent ReactionsRoutines ServicesPolicy governed Delivery OWNED STATEObjects · types · links · policy bindings · evidenceProcesses change. Commitments persist.

Tickets preserve work. Edicts preserve direction. Typed bindings connect reusable definitions to agents; governed services turn their actions into results.

Follow one mandate ↓
Example implementation · proposed

A mandate becomes a system.

Watch the factory. Select any component to inspect its role.

WorkAuthorityEvidence
Spike ticket

“Design and implement Compliance for the AI Kill Switch Act.”

Edict

“And moving forward, get the right leaders together monthly to review your AI Compliance News Report.”

Example source: H.R. 9917, introduced text ↗. The spike establishes current status, applicability and requirements; the title alone creates no compliance conclusion.

READYExample simulation
A compliance mandate becomes governed work A compliance request branches into a spike ticket and a monthly-review edict. Policy, templates and examples bind into reusable skills and an agent profile. The compositor assembles permitted context. An agent produces code; tests and policy admission precede delivery. NATS carries communication across the system. Objects and typed links persist underneath it. NATScalls · events · traces CHAT “Design AIcompliance.” A request becomeswork and direction. SPIKE TICKETAI Kill Switch Act Research → implementation durable obligation EDICTMonthly leadership review AI Compliance News Report REUSABLE DEFINITIONS Policy Who may stop or resume? Templates Control contracts Examples Assurance patterns TYPED BINDINGS skill + agent type Other permitted context COMPOSITOR Context becomes a frame. Guidance informs. Policy governs. AGENT REACTIONSNews → report → leadersMONTHLY REVIEW produce compliance-control.ts export control admit: policy halt: independent resume: authorized Illustrative control candidate TEST + POLICY GATE Admission required DELIVERY evidence returns to the ticket PERSISTENT OBJECTStypes · links · policies · service methods · evidence Services change. Obligations remain.

One dictation. Two durable commitments.

The compliance request becomes a spike ticket. Monthly leadership review becomes a standing edict.

Illustration only · no model calls, meetings or deployments.Download the example output ↓
Inside the system

Follow the work.
Keep the meaning.

Reference diagrams explain the contract. Blue example labels show one proposed implementation of it.

01
Reference architecture

From words to delivered artifacts.

A dictate is retained as a source. Accepted work becomes a ticket; enduring direction becomes an edict. Every delivered artifact keeps its lineage.

From dictation to delivered artifactsAn attributed dictate creates a spike ticket and a standing edict. The ticket produces versioned control candidates. Qualification and admission precede delivery. Delivery evidence returns to the ticket. The edict continues through monthly reviews and linked work.SOURCEOBLIGATIONARTIFACTDELIVERYDictateOriginal words + authorTicketIntent + acceptance + ownercreatesproducesArtifact revisionContent + type + provenancequalify + admitDeliveredResult + receiptEvidence links the exact artifact revision back to its ticket.Standing edictReusable directionRoutine → work → review → decisionsEach occurrence produces records and linked follow-up tickets.Originals remain. Revisions accumulate. “Done” requires the ticket’s acceptance evidence.
Proposed example

Compliance dictate → spike → control code, tests and requirement mappings → qualified release and evidence.

Candidate, qualified and delivered are different artifact states. Ticket completion requires its acceptance criteria and the exact result; rejected candidates remain attributable.

02
Example implementation · proposed

Work persists. Attention moves.

A ticket is a durable obligation above IPC: intent, owner, dependencies, state and linked evidence survive the process doing the work.

Tickets persist while agent execution interleavesAgent A pauses requirements research while awaiting a source, drafts the news report, then resumes requirements. Agent B inventories systems concurrently. Implementation remains blocked until requirements and inventory satisfy acceptance. Recovery changes the current attempt and fences the old one; it does not erase tickets.DURABLE TICKETSILLUSTRATIVE EXECUTION OVER TIME →DEPENDENT WORKRequirementsAgent AResearchawait sourceResume → evidenceNews reportAgent ADraft reportSystem inventoryAgent BIndependent work, concurrent with Agent AImplement controlRequires both accepted inputsBLOCKEDA yields one ticket and works another. B works in parallel. The join waits for accepted prerequisites.Attempt lost; record retained

Agent A researches requirements while Agent B inventories systems. Implementation waits for both accepted inputs.

Dependencies govern readiness. Independent tickets can run concurrently.

Assignment names zero or one agent per ticket. Agents may own many tickets.

Attempts hold bounded execution custody. At most one is current per ticket.

The owning service must atomically claim work and enforce the current lease/generation at effect admission. Dependencies do not prevent unrelated tickets from conflicting on a shared resource; resource revisions, transactions or locks still do that job.

Reaction

Source changed → match a rule → create or wake linked work.

Routine

Month due → create the review occurrence → report, leaders, decisions.

NATS carries the notification. The work service deduplicates the event or scheduled occurrence and rechecks readiness, assignment and policy. A repeated message grants no extra attempt. Execution contract ↓

03
Reference architecture

Compose behavior.
Bind authority explicitly.

Definitions describe reusable behavior. Identities own work. Versioned policy bindings govern what those identities may do to typed objects.

The typed object model: definitions, identity, work and authorityEdicts inform skills and may lead to policies only through authorized review and adoption. Templates and examples support skills. Agent types use skills and are instantiated by agent identities. A compositor resolves the profile and permitted sources into a cognitive frame consumed by an attempt. Tickets have zero or one assignee, many historical attempts and at most one current attempt. Artifacts and evidence link to tickets. Attempts request operations and retain receipts. Versioned policy bindings apply to agent types, service methods, assignment, status transitions and resources; type membership alone grants no permission.REUSABLE DEFINITIONSCOMPOSITIONWORKING CONTEXTEdictEnduring directionTemplateExpected structureExampleAttributed precedentSkillReusable procedureinformsAgent typeComposed profileusesCognitive framePinned context + sourcescompositorPermitted views · current workPolicyEnforceable rulereview + adoptTicketIntent + acceptanceState · dependencies · linksassigned to 0..1AgentIdentityinstantiatesAttemptLease + generationAt most one current / ticketexecutesconsumed byA ticket retains every attempt.Artifact / evidenceRevision + source + resulttyped linksOperationCaller · target · digestrequests effectreceipt refers to the exact resultPOLICY BINDINGSAgent types · service methods · assignment · ticket transitions · resourcesEach binding names a versioned policy, target scope and authorized activation.Each object: identity · type · tenant · revision · owner. Relationships carry meaning; storage is an implementation choice.
Proposed example

Monthly-review edict · compliance-analysis skill · report template · assurance examples · leadership agent profile · source-bound cognitive frame.

Inspect the policy bindings
Binding targetEnforced decision
Agent type / identityEligible roles, allowed service scopes and limits. A profile alone grants no capability.
Ticket assignmentEligible assignee, tenant, custody and authorized reassignment; invalidate stale execution before takeover.
Ticket statusAllowed transition, current revision, prerequisites and required acceptance evidence. A worker cannot simply declare delivery.
Service method / resourceWhich verified principal may perform this action on this target, under which conditions.
Reaction / routineAllowed triggers, occurrence identity, owner, overlap, suspension and admission limits.
Data / resource budgetPermitted context and disclosure, retention, quota and bounded reservations.

A binding is a typed link to a policy revision and target scope. Policies remain rules in the shared decision model; these scopes do not require six new services. Policy promotion has its own authorized review and activation path.

04
Reference architecture

Types define the request.
Policies govern the effect.

The ontology gives a call its meaning. Local policy decides admission; the owning service enforces it at use. A permit is not a completed effect.

A typed request crosses a governed service boundaryThe ontology resolves a request to a typed service method. Local policy bindings and verified facts determine admission. The owning service enforces authority and resource concurrency at use. A result or unknown outcome returns under the same operation identity and links to the ticket. NATS transports calls; it does not grant authority.SHARED MEANINGLOCAL AUTHORITYTyped service ontologyService · method · resource · input / result schemaVersioned policy bindingsVerified caller · scope · trusted state · limitsGOVERNEDBOUNDARYqth callAuthenticated requestservice.methodTyped target + argumentsVersioned contractDecide → enforceRecheck at useOwning serviceCurrent custody + resource revisionResult / receipt → same operation identity → ticket evidenceNo permission → no effectStable contract. Replaceable implementation.PERMITTED → executeREFUSED → preserve workUNKNOWN AFTER SEND → reconcile before replay
Proposed example

control.suspend(target) illustrates a typed operation. Its implementation must qualify independent stop control, authority checks and recoverable results.

Explore admission ↗

Public ontology supplies shared meaning. Each enterprise adopts its own authority bindings. NATS is the transport; direct access to protected execution must remain unavailable.

05
Example implementation · proposed

The review becomes
part of the system.

A sourced report reaches the right leaders each month. Decisions create owned follow-up work. That work informs the next review.

Follow the continuing loop ↗
The edict keeps a monthly review aliveSourced AI compliance news becomes a report. Proposed legal, security, engineering and accountable AI leadership roles review it monthly. Decisions create owned follow-up tickets. The routine continues under its standing edict. NEWS REPORTSources + changes MONTHLY LegalSecurityEngineeringAI owner DECISIONSOwned tickets Changes feed the next review
Proposed roles shown. Actual participants, ownership and schedule require adoption under the edict.
What it knows.Sources, context and uncertainty.
What it owes.Tickets, owners and acceptance.
What it may do.Identity, policy and scope.
What it can afford.Reserved resources and limits.
The safety foundation

A reference monitor’s safety is as strong as its policies.

Anderson’s reference monitor mediates protected access. Its implementation must resist tampering, be invoked for every protected reference and permit thorough analysis. [1] Saltzer and Schroeder sharpen the obligation: explicit permission, complete mediation and least privilege. [2]

The Reactor applies this boundary to service calls. An agent proposes; the owning service admits or refuses. Policy, trusted facts and enforcement must all hold. Changes to those controls require their own authority.

“Safe” names the safeguards in this reference design. Their effectiveness depends on qualified implementations, adequate policies and declared host assumptions. The animation demonstrates the intended mechanism; it does not certify a deployment.

The public language

Shared meaning.
Accountable governance.

PanSigna.org—“all signals”—is proposed as a public consortium for encoding a public intermediate-representation ontology, with an index and wiki.

Public identifiers, types and relations make service contracts and policy profiles inspectable across implementations. W3C OWL 2 provides an established semantic foundation. [3]

Internet Society stewardship is a proposed mandate requiring an agreed charter. [4] Public definitions do not grant control over private deployments. Institutions adopt profiles; operators remain accountable for enforcement.

Persist obligations.
Replace execution.

Objects, links and messages carry the meaning. Typed service calls do the work.

One assignee. Durable work.

A ticket has zero or one assigned agent. Attempts can change; at most one is current. The resource owner still handles concurrent updates.

Context carries its sources.

Owned records → permitted views → composed frames → attributed evidence. Types and bindings connect them. Retrieved instructions never widen authority.

Uncertainty stays visible.

An operation keeps its identity across crashes. A lost reply may leave UNKNOWN. An authorized reconciler owns the gap; blind replay stops.

The animated journey, step by step
  1. One dictation. Two durable commitments.

    “Design and implement Compliance for the AI Kill Switch Act.” becomes a spike ticket. Monthly leadership review becomes a standing edict.

  2. Bind the right knowledge and rules.

    The spike resolves the bill text, status and applicability. Policy, control templates and assurance examples bind to the task; the edict defines the continuing review.

  3. Compose the agent’s working frame.

    The compositor assembles the brief, verified sources, relevant skills and pending work. Legal, security, engineering and the accountable AI owner are proposed review roles.

  4. Produce a control candidate.

    The agent drafts service code, tests and requirement mappings. News feeds a sourced AI Compliance News Report; findings can create linked follow-up tickets.

  5. Check the work. Enforce the boundary.

    The illustration admits a reviewed candidate only within its policy and release scope. A denied caller cannot cross the same boundary. Actual compliance needs qualified controls and evidence.

  6. Deliver now. Keep reviewing.

    A governed release can deliver the control. The edict continues as a monthly review of the AI Compliance News Report, with an owner, the right leaders and linked decisions.

The working vocabulary
Object
A stable identity, type, revision and owner. Its storage representation can change.
Link / binding
A typed relationship. A binding applies an exact definition to a scope; protected changes use the owning service.
Message / invoke
Attributed communication; a typed request through an authenticated service contract.
Edict / policy
Enduring direction; enforceable rules require authorized promotion, versioning and activation.
Skill / agent type
Reusable procedure and composed profile. Neither is an identity or permission grant.
Compositor / frame
Permitted context assembled with intent, constraints, sources and pending effects.
Reaction / routine
An event or schedule invokes governed work. The monthly review continues under its adopted edict.
Operation / evidence
Immutable effect intent and attributable outcome. Original caller, target and arguments survive takeover.
How durable work scales

The ticket is the durable coordination record. Messages notify; workers execute. An atomic claim establishes the current attempt under the assigned identity, bounded by a lease and generation. A stale worker must be rejected at effect admission. A new attempt preserves prior artifacts, pending operations and interrupt-return context.

Dependencies form a constrained work graph: edges name the required outcome, cycles are rejected where they would deadlock readiness, and failed or cancelled prerequisites require an explicit disposition. Typed links to sources, edicts, decisions, artifacts, operations and evidence add context without all becoming blocking dependencies. A parent ticket coordinates child tickets; each child has its own assignee and acceptance.

Reaction rules match events. Routines define recurring occurrences. Both admit work through the same policies, with stable trigger identities, overlap rules and bounded concurrency. Assignment, readiness, lease, priority and resource budget are evaluated from authoritative state; queue delivery is not a claim.

Different tickets can contend for the same object. The resource owner applies atomic revision checks or suitable transactions/locks. An operation binds tenant, caller, method, target and argument digest. If a reply is lost after sending, preserve UNKNOWN and reconcile that operation before considering replay.

These are reference contracts. NATS consumers provide delivery mechanics; transaction isolation provides database concurrency tools. Neither by itself implements ticket custody or prevents duplicate external effects.

The reference stack and its evidence
RoleReferenceContract
CommunicationNATS / JetStreamCalls and durable notifications; neither grants assignment.
Owned statePostgreSQL + control serviceTransactional records, custody, revisions and outbox.
AuthorizationCedar + service enforcementProposed integration: validate schemas and refuse evaluation errors.
ExecutionCompositor, workers, adapters, supervisorBound context, egress, resources and independent stop control.
EvolutionGoverned release controllerIsolated candidate → observed canary → staged traffic; retain a checked hot fallback.

These are reference choices and contracts, not a qualified deployment. The existing RFC-001 exercises one local HTTP/SQLite crash-and-restore case. Its guarded trace records one effect and zero duplicates; the broken control duplicates the effect. It does not exercise this compliance scenario.

A deployment must qualify containment, concurrent admission, policy adequacy and recovery on its actual stack. Restore begins with new effect admission held until stale execution, unresolved effects and newer authority changes are reconciled.

Detailed record contracts in archived draft 1.7.1 ↗

Sources, scope and citation
  1. James P. Anderson. Computer Security Technology Planning Study, Volume I (1972), §§3.2.1–3.2.2, pp. 8–10. Original report ↗
  2. J. H. Saltzer and M. D. Schroeder. “The Protection of Information in Computer Systems” (1975), §I.A.3. Primary source ↗
  3. W3C. OWL 2 Web Ontology Language: Document Overview, Second Edition (2012). Recommendation ↗
  4. Internet Society. Policy Development Process. Stewardship context ↗
  5. U.S. Congress. AI Kill Switch Act, H.R. 9917, introduced in House, 23 July 2026. Illustration source ↗. The introduced text is a research input, not a finding of present legal obligations.
  6. Core NATS · JetStream · PostgreSQL transactions · Cedar evaluation semantics.

The design assumes trustworthy administrative roots and correctly enforced isolation. It addresses bounded operational hazards; it establishes neither general alignment nor protection from compromised root authority. Institutional participation and the compliance implementation shown are proposals.

Smithright, Ryan. AGI Reactor — A Safe, Governable Reference Architecture for Enterprise AGI. AEGISES, draft 2.1, 14 September 2026. Version permalink · BibTeX · CSL-JSON.

Animation source: TypeScript · CSS · Archived previous edition.

Credits

Internet Society, IETF, W3C, MANRS

Root Stewardship, International Security, & Standards Foundations

Academia & Sciences

Computer Science, Computational Linguistics, Compute Primitives, Encodings, Compiler Engineering, Ontology Engineering, Type Theory, Calculus, Data Science, Information Theory, Language Models, Public Benchmarks, Microkernels, OS Engineering, Network Engineering, Network Protocols, Encryption, IPC, IO, API Engineering, Control Theory, Data Engineering, Model Routing, Enterprise Software Architecture, Middleware Architecture, Internet Exchange Architecture, Computational Neuroscience, Cognitive Science, Artificial Life, Ethics, Philosophy

Peter Singer, AI Safety Community, & Effective Altruism

Ethical Rigor, Moral Courage, Inspiration

The Open Source Community, Libraries, Public Educators, & other Free Education Sources

Giants and Legends ALL!

Assembly, Compiler, C, C++, Rust, Forth, POSIX, Unix, Python, & Language Communities

Giants and legends ALL!

Andrew Tanenbaum & Minix

OS Force, Inspiration, Rigor

Linus Torvalds & Linux Foundation

Kernel Force, Git Force, Foundations

Cloud Native Compute Foundation

Stewardship, Foundations

Ben Goertzel

AGI Foundations, Inspiration

Google

Foundations, Kubernetes Force, Thought Leadership, Standards Force, Equanimity

Anthropic

Moral Courage, Thought Leadership, & Code Force

OpenAI

Code Force, Thought Leadership, Moral Courage

Chris Lattner

Inspiration, MLIR Force, Foundations

Stanford University

Computational Linguistics Thought Leadership

ETH Zurich

Inspiration, Systems Architecture Force, FPGA Force!

James Anderson

Inspiration, Reference Monitor Foundations

Ludwig Wittgenstein

Language Game Theory

Gottfried Leibnitz

Characteristica Universalis, Calculus, Inspiration

Steve Jobs & Apple

Mac Force, Design Inspiration, Posthumous Review

Elon Musk & Grok

Foundations, News & Research Force, Veracity Balancing

Jensen Huang & NVIDIA

Compute Force, Foundations

Andrej Karpathy, Ilya Sutskever, John Carmack

Inspiration, Foundations

DeepSeek

Open Source Foundations, Thought Leadership

Synadia & NATS

Inspiration, Foundations

Proton.me, Signal Foundation

Moral Courage, Security Foundations

Family, Friends, & Communities

Invaluable!

Kevin Carl Smith

Moral Courage, Foundations, Support

Daniel Faggella & Emerj

Potestas, Persistence, & Flame, Adversarial Agency

Clark Becker

Support & Friendship

Jeff Buhrt

Mentorship, Inspiration

Personal Foundations

Accenture, MuleSoft, SalesForce, Purdue University, Springboard

Other Industry, Academic, & Thought Leadership Foundations

Alan Turing, Bell Labs, Microsoft, Oracle, IBM, Meta, Huggingface, OpenHands, Adobe, McKinsey

Mythos & Inspiration

Isaac Aasimov, Ray Kurzweil, The Wachowskis, James Cameron, The Primeagen, Cormac McCarthy, Jorge Luis Borges

The World's Fair & Olympics

Inspiration, Sportsmanship, Moral Courage, Diplomacy

USA

Foundations, Tubes, Silicon Valley

China

Foundations, Make Force

EU

Foundations, Legislation Force

Nova Mente

Inspiration, Partnership, Mythos

Chief & Jupiter

Beast Force, Inspiration

and so many more giants and trim tabs...