L0–L4 · Foundation
What it is actually built on.
The specification declares behavior, contracts, gates and ceilings, not vendors. This page sets the two side by side: what the platform must do, and the reference implementation underneath it.
Planes
9
Components
36
Canon stores
7
The stack
Nine planes, top to bottom
A stack of replaceability. The model layer changes every few months; the Canon changes almost never and is the part the company owns.
Human surfaces
Four surfaces only — Brief, Gate queue, Room, Ledger. No general-purpose chat box as the primary way in.
| Component | What the specification requires | Reference implementation |
|---|---|---|
| Web application | Four named surfaces; mobile carries gates only. | Server-rendered React application with streaming server components; role-scoped routes. |
| Gate console | Every gate presents a recommendation, an alternative, the evidence pack, a named holder and a hard deadline. Expiry escalates one level automatically. | Real-time queue backed by server-sent events; deadline timers computed client-side against a server clock. |
| The Room | A live collaborative surface for crisis and launch. | Shared presence layer over a CRDT document; posture-aware, collapses to the gate queue on mobile. |
| Identity & access | Gate holders are named roles, not groups. Decisions are attributable to an individual. | Enterprise SSO with SCIM provisioning; role assignment mirrored from the HR system of record. |
Build or buy · Build. The surfaces are the product. A generic chat UI has no queue discipline and no audit trail.
Orchestration runtime — the Chief of Staff
Intake, routing, sequencing, autonomy enforcement, gate management, change propagation, posture. Never writes, never publishes, never decides.
| Component | What the specification requires | Reference implementation |
|---|---|---|
| Durable workflow engine | A workflow can pause for four hours at a gate, or eight minutes in crisis, and resume with full state. No agent-to-agent coordination (R1). | Durable execution service with deterministic replay — Temporal-class. Each situation is one long-running workflow; each step is an activity. |
| Policy & ceiling registry | The autonomy ceiling is data, not code (R3). Legal must ratchet a ceiling down at 23:00 on a Friday with no deployment. | Versioned policy store read on every step, with a decision cache invalidated on write. Ceilings resolve as: min(declared, posture modifier, jurisdiction, topic override). |
| Posture controller | One platform-wide variable. NORMAL 4h · ELEVATED 30m · CRISIS 8m, with a ceiling modifier per posture. | Single global record, change-logged, broadcast to running workflows as a signal rather than a restart. |
| Change propagation | When a position changes, every downstream artifact referencing it is identified and re-rated. | Reverse index from Canon position IDs to every emitted artifact; propagation runs as its own workflow with its own gate. |
Build or buy · Build the policy and routing logic. Buy the durable execution engine underneath it — this is the one place where a framework genuinely saves a year.
Agent runtime
7 domain agents holding standing objectives and budgets; 26 task agents with one output contract each.
| Component | What the specification requires | Reference implementation |
|---|---|---|
| Agent definition store | Each task agent declares a single output contract, an autonomy level, a named evaluation set and a cost budget. | Declarative agent manifests held as versioned data, not code — same registry that serves the ceilings, so a manifest change needs no deploy. |
| Tool layer | Agents act on the Canon and on external systems through declared tools, never by free-form side effect. | Typed tool schemas with per-agent allow-lists; every invocation logged with inputs, outputs and cost. |
| Output contract validation | An output that does not satisfy its contract does not leave the agent. | Schema validation plus a rubric check on the structured fields before the artifact is admitted to the run. |
| Budget enforcement | Token budgets attach to situations, not to people. A runaway loop appears as a named situation over budget within hours. | Per-situation ledger decremented at each model call; hard stop and escalation at 100% of budget. |
Build or buy · Build the agent definitions and contracts. They are the differentiated asset and they change monthly. Keep the runtime thin enough to swap.
Model layer
The replaceable part. Frontier models for judgment-adjacent drafting, small models for classification and routing.
| Component | What the specification requires | Reference implementation |
|---|---|---|
| Model router | Cost per query lands near $0.10 across a workload of roughly 34 rising to 55 queries per active user per day. | Task-class routing: small models for sensing, classification and materiality screens; frontier models only where the output is drafted for a named voice or feeds a gate. |
| Two providers, always | Not stated in the specification. | At least two frontier providers under contract with the same prompt contracts, so a model deprecation or price change is a configuration event rather than a rebuild. |
| Evaluation harness | Each task agent has a named evaluation set. Gate the build on it. | Per-agent regression suites run on every manifest change and every model version bump; results recorded against the agent, not the platform. |
| Calibration monitoring | Simulation outputs must be scored for calibration — an uncalibrated simulator manufactures confidence rather than reducing risk. | Brier scoring of every simulated prediction against the observed outcome, reviewed monthly and published to the gate holders. |
Build or buy · Buy, and keep two live. Model portability is a procurement requirement, not a technical nicety.
The Canon — truth substrate
Seven versioned stores. Everything above L0 is replaceable; L0 is the only thing the company actually owns.
| Component | What the specification requires | Reference implementation |
|---|---|---|
| Versioning and expiry | Every position carries an owner, an approval, and an expiry. A position with no expiry rots. | Bitemporal records — valid-time plus transaction-time — so “what did we say on 4 March” is answerable exactly. |
| Write-back enforcement | No output leaves the system without a Canon write-back (R2). | The write is part of the step transaction, not a follow-up job. A failed write fails the step. |
| Retrieval | Every agent reads from the Canon; the Canon is what makes divergence detectable. | Hybrid retrieval — lexical plus dense — over the position and precedent stores, with the graph used for stakeholder traversal. |
| Stewardship | Each store has a named individual steward. Not a committee, not a shared mailbox. | Steward identity is a field on the store, surfaced in the UI wherever that store is read or written. |
Build or buy · Build, and own the schemas outright. If the Canon lives inside a vendor’s product, the company has rented its own memory.
Integration & sensing
What the Signal Lake is fed by, and where finished work is published.
| Component | What the specification requires | Reference implementation |
|---|---|---|
| Licensed media & social feeds | Sensing spans media, social, regulatory, employee, investor, AI-answer-surface and walk-in signal. | Licensed aggregator feeds for broadcast/print/online plus first-party platform APIs; a normalization layer writes a single signal schema. |
| Regulatory & docket monitoring | Policy radar across the jurisdictions the company operates in. | Per-jurisdiction docket and consultation feeds, polled on a cadence that varies by materiality of the jurisdiction. |
| AI answer-surface monitoring | What the assistants say about the company is a sensing channel in its own right. | Scheduled probe set across the major assistants, diffed against the Narrative Canon position for that topic. |
| Publication endpoints | Finished artifacts reach newsroom, internal channels, franchisee systems and filing portals. | Outbound adapters per channel; every publication event written back to the Evidence Ledger with the artifact hash. |
Build or buy · Buy the feeds, build the normalization. Licensed media and social data is not something to scrape; the ingestion contract is what you own.
Control plane
Gates, audit, evidence and ceilings — the part that makes the platform defensible rather than merely fast.
| Component | What the specification requires | Reference implementation |
|---|---|---|
| Gate ledger | Five gates, fifteen firings across fourteen steps. Every decision records the holder, the outcome, whether it overrode the recommendation, and the dwell time. | Append-only decision table; dwell time measured server-side from presentation to submission. |
| Audit ledger | What was said, by whom, on what evidence, when. | Append-only event log with hash chaining, exportable as a single evidentiary package per situation. |
| Evidence ledger | Every claim, the evidence behind it, who cleared it, and when it expires. | Claim records with expiry triggers that open a review task automatically, and a recall path when evidence is withdrawn. |
| Litigation hold | Not stated explicitly in the specification. | A hold flag that suspends retention expiry across the Canon and the ledgers for a named matter, applied by Legal without a deployment. |
Build or buy · Build. This is the layer a regulator, a plaintiff or a board committee will actually examine.
Observability & unit economics
The meta-metric is gate load per executive per week. Everything else is instrumentation.
| Component | What the specification requires | Reference implementation |
|---|---|---|
| Gate-load telemetry | Gate load per executive per week is the single meta-metric. Gate-load inflation is a named failure mode. | Per-holder weekly counts and dwell distributions, alarmed on trend rather than on threshold. |
| Cost attribution | Cost attaches to situations. Scanning cadence is the largest single lever; simulation is the second. | Every model call tagged with situation, workflow, step and agent, so cost rolls up along all four axes. |
| Drift detection | Unclassified-situation rate above 12% in a month is an alarm, not a metric. | Intake classification confidence tracked per workflow; sustained drift opens a Canon review task. |
| Distributed tracing | Not stated in the specification. | OpenTelemetry traces spanning orchestration, agent and model calls, with the situation reference as the trace attribute. |
Build or buy · Build the metrics that are specific to this platform; buy the tracing and logging substrate.
Security, residency & tenancy
A multinational operating in 100+ jurisdictions cannot treat this as a single-region application.
| Component | What the specification requires | Reference implementation |
|---|---|---|
| Data residency | Jurisdictional constraints are held in the Policy & Risk Register as machine-readable rules. | Regional storage for employee-derived signal; the Canon replicated read-only into regions rather than moved. Residency is a policy attribute, not a deployment topology. |
| Employee-listening permission matrix | Employee signal is a sensing channel and is jurisdictionally constrained. | Per-market permission table — works-council markets default to aggregate-only, with the constraint enforced at the retrieval layer, not in agent prompts. |
| Privilege handling | Not stated explicitly in the specification. | Privileged material segregated into a store that agents cannot read by default; WF4 is the only workflow with a path to it, and that path is gated. |
| Secrets & key management | Not stated in the specification. | Centrally managed keys with per-integration rotation; no long-lived credentials in agent manifests. |
Build or buy · Buy the substrate. Own the data-residency map and the permission matrix.
L0 · storage decisions
Seven stores, seven different storage problems
The Canon is seven stores with different access patterns — a graph, a ledger, a time-series lake and four document stores — not one database.
| # | Store | Shape | Reference technology | Why | Write gate |
|---|---|---|---|---|---|
| 01 | Narrative Canon Canon Steward | Versioned document store | Relational store with bitemporal rows; full history, never an in-place update | Positions supersede each other and must be answerable as of a date. An overwrite destroys the only defensible record. | G1 |
| 02 | Voice Corpus Canon Steward | Embedding index over cleared text | Vector index plus the source corpus in object storage, partitioned per named voice | Voice fidelity is a retrieval problem. Keeping the corpus per voice is what allows a single executive to be re-trained or withdrawn. | G4 |
| 03 | Stakeholder Graph Canon Steward | Property graph | Graph database; relationship traversal, not row lookup | The value is in the second and third hop — which journalist covers which regulator, which franchisee body shares a chair with which union. | NONE |
| 04 | Evidence Ledger General Counsel (co-owned with Canon Steward) | Append-only ledger | Immutable event table with hash chaining and a scheduled expiry sweep | This is what makes a claim defensible. Mutability here is the single most damaging design error available. | G2 |
| 05 | Signal Lake Agent Ops Lead | Append-only time-series lake | Columnar object storage partitioned by date and channel, with a warm index over the watchlist | Volume is high and reads are analytical. Retaining raw signal is what lets a past detection be re-examined honestly. | NONE |
| 06 | Policy Risk Register General Counsel + CCO (joint) | Machine-readable rule store | Versioned policy records evaluated at runtime, with a change log and an effective-from timestamp | Rule R3 — the autonomy ceiling is data. If this is a configuration file in a repository, Legal cannot move it on a Friday night. | G3 |
| 07 | Precedent Library Canon Steward | Case store with retrieval | Structured case records plus hybrid retrieval over the narrative of each case | Converts institutional memory from an individual into an asset. Retrieval must find the analogous case, not the keyword match. | NONE |
Non-functional
Posture sets the latency budget for the whole architecture
The gate deadline under each posture is the engineering constraint; the crisis figure determines the design.
4 hours
gate deadline · hourly on the watchlist
Batch-friendly. Most steps can queue; nothing needs sub-second inference.
30 minutes
gate deadline · continuous on the affected topic
The pipeline from detection to a gate-ready recommendation must complete inside a few minutes, which rules out overnight retraining in the loop.
8 minutes
gate deadline · continuous, full watchlist
The binding constraint on the whole architecture. Everything between signal and a decision-ready pack has under eight minutes, including the simulation screen.
Run cost
What the stack costs to operate
Inference dominates and seats are noise. The two controls that move the number are scanning cadence and simulation depth.
Inference
~$0.10 per query
Queries per active user per day, rising from ~34 toward ~55 as fluency builds
Agentic workflows consume multiples of a chat query. Budget on workflow completions, not on prompts.
Seats
~$25 per user per year
Licensed population, not active population
Trivially small relative to inference. Do not optimize here.
Cost per active user / month
~$80 → ~$107
Chat-class usage, modeled 2027 → 2030
Agentic / co-working class runs roughly $139 → $215; code-class far higher and not relevant to this function.
Orchestration platform run cost
~$300K per year
Fixed
Buys reusable orchestration, memory, retrieval, tool integration and evaluation gates for the whole roster.
Token budgets attach to situations, not to people
Every live situation — a value dispute, a policy filing, a crisis — carries a budget assigned at intake and consumed by the agents working it. A runaway scanning loop shows up as a situation over budget, with a name and an owner, within hours.
Per-person ceilings as a backstop, not a primary control
A monthly per-user cap in the region of $200 catches pathological individual usage without throttling the situations that legitimately need depth. Caps set low enough to bind on normal work produce users who route around the platform.
Scanning cadence is the largest single lever
Continuous sub-five-minute monitoring on a 40-entity watchlist costs an order of magnitude more than hourly on the same list. Reserve continuous for the watchlist and for elevated or crisis posture.
Simulation is the second largest
A full hostile-panel simulation across sixteen audience classes is expensive by design. Gate it on materiality — below the floor, run a three-class screen instead.
Sequence
The order the stack gets built in
The ordering: substrate before agents, control plane before breadth.
The Canon, before any agent
Stand up the seven stores, name the seven stewards, and load the current positions with owners and expiries. An agent roster on top of an empty Canon is a drafting tool.
Sensing only — no publication path
Run the A cluster into the Signal Lake with no outbound channel at all. This proves detection quality and produces the baseline the value case is measured against.
One workflow end to end
The change cascade — WF2 — first, because it is the workflow that exercises the Canon most heavily.
Gates, ledgers and the control plane
Before breadth, not after. Retrofitting an audit trail onto a running agent estate is the most common and most expensive mistake in this category.
Breadth across the remaining lines
Add WF1, WF3, WF4 and WF5 against the proven control plane. Each addition is a manifest and a workflow definition, not a new system.
What the stack has to survive
Eight named failure modes, each with an instrumented indicator
None of these are caught by uptime monitoring. Each needs a metric the platform itself produces.
Indicator · No junior has held a shadow gate in 90 days
Control · Shadow gates mandatory; juniors decide before the system reveals its recommendation.
Indicator · Partner-originated complaints about automated communications
Control · Partner-facing channels capped at A2 for the first four quarters.
Indicator · Positions past expiry above 10%
Control · Canon Steward's primary metric; expiry forces review.
Indicator · Output volume up, engagement per output down
Control · Slop Sentinel loop; volume caps per channel per week.
Indicator · gates_per_person_per_week trending up
Control · The meta-metric. Reported to ExCo monthly.
Indicator · Hours recovered with no named destination
Control · ExCo AI Value Owner, comp-tied, with a published reinvestment plan.
Indicator · Unclassified rate above 12% monthly
Control · Mandatory human routing; new class proposal required.
Indicator · Simulated reactions increasingly agree with the recommended position
Control · Adversarial persona requirement; calibration against observed outcomes quarterly.