The substrate and the plane

The substrate is a pure state machine over an append-only op-log, advanced by a deterministic tick. The agent plane is the small HTTP surface through which the outside world reaches it.

The substrate

At the centre is a state machine with no I/O in it. No sockets, no disk, no clock, no randomness, no floating point. It takes an ordered sequence of ops and produces state.

Because it is a pure function of its op sequence, everything else in the architecture is thin. Replication is thin: hand every replica the same ops and they reach byte-identical state, because there is nothing else they could reach. Durability is thin: journal the ops, replay them, and you are exactly where you were. Simulation is thin: a whole run is a pure function of one seed, which is what makes the deterministic fault simulator able to reproduce any failure it finds from a single u64.

The op-log is append-only and the normative log is complete over everything that reached the commit point — including refusals. A ForbiddenRejected transaction has a record; it simply has posted: false. Malformed input is an error and gets no record, because it never reached a decision. The distinction is load-bearing: the log is a record of judgements, and something that was never judged does not belong in it.

The tick

Time is an explicit, monotone counter, advanced by a heartbeat op. Nothing in the substrate reads a wall clock.

Each advance sweeps the open obligation set for duties whose deadlines have passed and breaches them, instantiating any repair duties they carry. Breaches therefore happen in the log, at a known tick, as ops like any other — not as a background job's side effect that some later report has to reconstruct.

Replication and durability

The substrate is replicated through a Viewstamped Replication (Revisited) consensus group: normal operation, view change, recovery, and state transfer. VSR rather than Raft, for recovery from the quorum without relying on a replica's own disk having survived.

Underneath, a checksummed append-only journal with fault-classifying replay — a torn tail is not corruption and is not treated as such — plus periodic snapshots and log compaction, so restart time and disk footprint stay bounded on a long-lived ledger.

The peer mesh runs mutually-authenticated TLS 1.3; the client plane runs server-authenticated TLS.

The agent plane

The agent plane is deliberately small. Five routes:

One route writes. Four read. That is the whole surface an agent needs: propose a transaction, learn what was decided, and find out what it now owes.

The contract is frozen. It is published as an OpenAPI 3.1 document, served by a live node at /api/openapi.json and pinned byte-for-byte in the repository. The schemas are validated against the real serialized output of the protocol types rather than hand-maintained, and a change to the wire fails the build until the artifact is deliberately regenerated and re-ratified. What a deployment advertises and what an SDK was generated from cannot drift apart.

The administrative plane

Separate, and token-gated. This is where policies are authored — raw DSL in, structured diagnostics or a faithful English rendering out — reviewed, approved, and activated, and where accounts, agent bindings, and trust roots are administered.

It is a different plane from the agent's on purpose. The actor that spends money and the actor that decides what spending is permitted should not be reachable through the same door.