Canonical architecture

What you deploy is a governed swarm. It may be one agent or many; what does not change is the government: registered identity, a boundary that is not crossed, provenance of every deliverable, and judgement on the result.

The client domain is any institution — ministry, bank, hospital, law firm, university, operations team. The architecture does not privilege a sector: it privileges that the deployed unit has a boundary and an accountable owner.

Each agents-host represents a sovereign organisational unit: its own identity, memory, Task Queue, governance, agents and federation capability. The set of federated hosts is the full organisation.

agents-host is the scaling and delivery unit. You do not scale by adding virtual desktops to a central host: you scale by deploying new agents-host units. The Task Queue is local per host; coordination across units does not go through a global queue but through federation.

Simulation is not operation. There is an academic neighbourhood that simulates agent societies at scale to study behaviour. This architecture deploys to work: agents take a real commission and return a deliverable with a seal, sources and an author.

Harness and exoharness

The agent harness (interchangeable runtime) is the scaffolding of the individual agent: model loop, tools/MCP, procedural memory, sessions, identity document as anchor and local Task Queue.

Self-Improving Society is the exoharness — the institutional layer around all agents: registered identity, social memory, judgement, governance, reproduction and observability.

An agent without the exoharness is a process. With it, a citizen of an institution.

In external material the sense is declared: exoharness, in the exoskeleton sense — the institutional layer that wraps the agent harness. When the reader comes from the meta-harness tradition, the term is equivalent.

flowchart TB
    subgraph HARNESS["Agent harness (per agent — interchangeable)"]
        LOOP["Model loop + tools/MCP"]
        SOUL["Identity document — anchor (B)"]
        PMEM["Procedural memory + local skills (A)"]
        KLOC[("Local Task Queue sovereign per host")]
    end
    subgraph EXO["Exoharness (the institution)"]
        REG[("Identity registry: hosts, specs, trust, approvals")]
        MEM["Memory: private/episodic retrieval + social facts"]
        JUD["Judgement: evaluator, draft seal, fitness ladder F0–F5"]
        GOV["Governed volition: approvals, budgets (L1–L8)"]
        REPRO["Reproduction: lifecycle, presets, gated arm"]
        PERC["Perception: telemetry, social graph"]
        VOICE["Conversation Gateway"]
    end
    subgraph SUB["Shared substrate"]
        LLMR["LLM Router"]
        VDB[("VectorDB")]
        PG[("Metadata relational store")]
        OBJ[("Object store")]
    end
    HARNESS --> PERC
    HARNESS --> MEM
    LOOP --> LLMR
    JUD --> KLOC
    REPRO --> HARNESS
    VOICE --> HARNESS
    MEM --> VDB
    REG --> PG

High-level view

flowchart TB
    Operator[Human operator] --> CLI[society CLI / Society Builder]
    Operator --> UI[Console]
    Operator --> WebUI[Conversation UI]

    subgraph HostA["agents-host A (sovereign unit)"]
        KA[("Task Queue")]
        PA["profiles"]
        HostApiA["Agent API\nchat · tasks · host snapshot"]
        KA --- PA --> HostApiA
    end

    subgraph HostB["agents-host B (other jurisdiction)"]
        KB[("Task Queue")]
        PB["profiles"]
        HostApiB["Agent API"]
        KB --- PB --> HostApiB
    end

    subgraph Control["Control plane"]
        Chat[Conversation Gateway]
        Fleet[fleet-manager]
        Gov[governance]
        Eval[evaluator]
        Tel["Console backend"]
        Exec["Gated arm\nno published port"]
    end

    subgraph Shared["Shared substrate"]
        LLM[LLM Router]
        Vec[(VectorDB)]
        DB[(Metadata relational store)]
        Obj[(Object store)]
        Onto["Ontology catalog\ninternal network"]
    end

    WebUI --> Chat
    CLI --> Fleet
    Fleet --> HostApiA
    Fleet --> HostApiB
    Chat --> HostApiA
    Chat --> HostApiB
    Tel --> HostApiA
    Tel --> HostApiB
    Tel --> Exec
    Exec -. "approved specs only" .-> HostA
    UI --> Tel
    Tel --> Onto

    HostA <-. "A2A — directed, token per caller" .-> HostB

    HostA --> Shared
    HostB --> Shared
    Eval --> DB
    Gov --> DB

Cross-host traffic is audited, not cryptographically signed in the current transport: cross-host trust rests on policy, bearer tokens per caller and network boundaries.

Inside an agents-host

Responsibilities: maintain the runtime data directory; run the local Task Queue; manage agent profiles; expose the Agent API (per-profile chat, task list/run, host snapshot).

A profile comprises: identity document (anchor B), configuration (model, provider, MCPs), isolated credentials, private declarative corpus (A), local skills (A), runtime memory (A) and sessions (B).

flowchart TB
    subgraph Host["agents-host"]
        TaskQueue[("Task Queue")]
        Snapshot["Host Snapshot API\nchat · tasks · internals"]
        subgraph Agents["agents — private docs volume"]
            A1["Agent A\nidentity + config + private docs (A/B)"]
            A2["Agent B\nidentity + config + private docs (A/B)"]
        end
        MCPs["Shared MCP tools\nRAG · Skills · Artifacts · Facts · Telemetry · Vision"]
    end
    Snapshot --> TaskQueue
    Snapshot --> Agents
    A1 --> LLMRouter[LLM Router]
    A2 --> LLMRouter
    A1 --> MCPs
    A2 --> MCPs
    MCPs --> VectorDB[(VectorDB)]
    MCPs --> ObjStorage[(Object store)]
    Host -. "on demand" .-> Runtime["agents-runtime\nvirtual desktop"]

Shared vs. dedicated substrate

Shared substrate (default pilot): one physical LLM Router, VectorDB, object store and relational store; logical isolation by namespaces, collections, buckets and tenant/host/profile metadata.

Dedicated substrate: per-host or per-tenant instances when regulation or risk require it.

Canonical piece	Role
Metadata relational store	Persistent source: agents, goals, approvals, audit
VectorDB	Semantic retrieval, isolated per collection
Object store	Deliverables and evidence
LLM Router	One interface to many providers, with budget
Conversation Gateway	Chat-completions-compatible surface
Console	Operate + Explore (live operational graph)
Gated arm	Creates and destroys institutions; no published port
Ontology catalog	RDF/SHACL/SPARQL workbench; not the live graph

Boundaries

Host boundary. Each agents-host has its disk, Task Queue, credentials and profiles. The local queue is not shared. A host's private vector library does not cross to another without explicit export and human approval.

Brain → gate → arm boundary. The gated arm applies the physical deployment of institutions and rejects a spec that is not approved. Components that propose do not execute: the real gate requires approved state.

Identity boundary. An agent is not a name: it is the (host, name) pair, as an X-Road-style member identifier (INSTANCE/CLASS/member/subsystem). Ambiguity is resolved with different policies per service: governance and evaluation paths reject; decorative links warn and leave null.

Sovereignty layers

Sovereign — per host, not shared without federation. Local Task Queue · profiles (identity, configuration, credentials) · private retrieval per host and profile · memory and sessions · container network perimeter.

Platform — shared or dedicated per policy. Relational store · VectorDB · object store · LLM Router · ontology catalog. Today isolation is per installation: one dedicated stack per client.

Federated — circulates between hosts with provenance intact. Published skills · shareable social facts · exportable public library (rag_public) · federated tasks and handoffs · trust policy between hosts.

Library metaphor: society metadata = civil registry and public library of the polis; agent private corpus = the individual's private library; shared skills = public shelf of reusable skills; auditable facts = shareable findings with provenance.

Four knowledge layers (do not collapse them)

Layer	Question it answers	What it is not
Live operational graph	What is happening in this institution now?	Not a store: recomputed on each request
Ontology catalog	What does this mean, and is it valid against the catalog?	The semantic contract (PROV-O, ORG, OWL-Time, SHACL)
Compiled code graph	How is the software made?	Not runtime truth
Episodic context	What happened in this session, this stretch?	Does not replace the operational graph

Replacing the operations panel with the catalog explorer would swap a running system for a viewer of a graph that already exists. They integrate; they do not merge.

Catalog vocabulary is closed: node or edge types emitted by code that the ontology does not declare fail validation in the quality pipeline.

Interoperability

A2A v1.0 — the exposed unit is the container, not the individual agent. It is directed (the map comes from trust policies), not open discovery. Exposure requires two deliberate gestures: a token and a host declaration.

MCP. The platform is strong as a client and limited as a server: its own MCP servers are stdio-only, without HTTP/SSE — only the agent process can reach them.

Non-negotiable constraints

• The local Task Queue is accessed only from its agents-host.
• Each profile has its own retrieval collection. Not shared between profiles.
• A host's private library does not cross to another without explicit export and human approval.
• Skills and facts circulate between hosts with provenance intact.
• The architect proposes; does not provision. Deployment requires an approved spec.
• No self-improvement on model weights.