The digital nervous system

The estate behaves like one organism. A cell (the full System9 stack) is the brain: it reasons, decides, and holds the data plane. An Edge Agent is a sensorimotor tentacle: it senses the field, reports what it sees and how loaded it is, carries out placed work, and (when the brain goes dark) runs a local reflex on its own. The two are joined by signals that flow in both directions, forming one sense → decide → act loop rather than a client polling a server.

This page names the four signal planes and grounds each in what is built today. It builds on core and edge (the brain/tentacle split) and the estate hierarchy (why a tentacle's default reach is its own node).

What this is, and what it is not

This is a description of mechanisms that ship, the signals, the placement rule, the degradation handoff, not a claim of autonomous intelligence. Where a plane is narrower today than the model (intra-node only; a fan-out path behind a default-off flag; a conductor whose lease transport is still being wired), the page says so plainly. Nothing here is graded, certified, or deployed-at-scale; it is the wiring, described so you can test it.

Four planes, one reflex arc

Borrowing the anatomy on purpose: a nervous system carries afferent signals inward (senses), keeps a proprioceptive sense of the body's own state, carries efferent signals outward (movement), and runs coordination between limbs. System9's four planes map one-to-one.

Figure: the four signal planes. The filled box is the cell (brain); the outlined boxes are Edge Agents (tentacles). Afferent and proprioceptive signals flow inward to the brain; efferent work placement flows outward; coordination runs peer-to-peer among tentacles and takes over locally when the brain is unreachable. Ceiling: the loop is intra-node, a tentacle's default reach is its own node's cells; cross-node placement and fan-out are not built.

Table equivalent

Plane	Anatomy	Direction	What it carries	Landed today
Afferent	Sensory	Edge → cell	Presence, the signed activity roster, inference/sensor/log telemetry, captured data drained on reconnect	Yes
Proprioception	Body sense	Edge → cell	An eight-level capacity zone (live load) and availability, emitted each heartbeat	Yes
Efferent	Motor	Cell → edge	Placing a workflow step on the freest available in-scope Edge Agent	Yes (fan-out flag-gated; cross-node owed)
Coordination	Inter-limb	Edge ↔ edge (and back to brain)	Signed agent-to-agent messaging; a leased edge conductor when the brain is dark	Logic landed; lease transport partly owed

Afferent: the senses flowing inward

A tentacle continuously reports what it sees and did, and each signal rides the device's existing heartbeat/telemetry channel rather than a new wire:

• Presence. Each cell tracks the liveness of the devices that heartbeat to it (no coordinator) reaping a device to offline/stale when it is unseen past a multiple of its heartbeat interval, and distinguishing a graceful shutdown from a timeout so a cleanly-stopped agent is not mislabeled as broken.
• The activity roster. An agent session's live subagent tree and per-child spend is captured on-device, signed with the enrolled device key, and shipped every heartbeat. The cell verifies it fail-closed, a content digest recomputed byte-for-byte plus a device signature checked against the enrolled leaf, never the snapshot's self-reported key.
• Telemetry. Local-inference counters (completions, tokens, latency), sensor, and log telemetry land in the device's observability plane. Local inference is observed, never billed, the ingest path is structurally forbidden from touching the metering plane.
• Captured data. Work and captures taken while dark are held in a durable, hash-chained on-device store-and-forward spool and drained to a cell when a link returns, an absent link is a state, not an error.

Proprioception: the sense of the body's own load

Before the brain can place work well, it needs each tentacle's honest sense of its own load. Every Edge Agent classifies its live utilization into an eight-level capacity zone, from under-loaded, through the working and peaking bands, to a danger band ("debt"), computed on-device from the CPU and memory pressure the runtime already measures, and emitted on each successful heartbeat.

Figure: the capacity-zone spectrum (simplified from the eight internal levels). The green end is idle headroom; the amber warning and red debt bands are the two full zones an agent is never given new work in. Ceiling: the signal is opt-in, an agent reports headroom only when its operator has configured a step ceiling, so headroom is never invented; a silent agent is treated as having none to offer.

Table equivalent

Band	Meaning	Selectable for new work?
Under-loaded → working	Idle to comfortably busy	Yes: freest first
Peaking	Approaching its ceiling	Yes, but ranked below freer peers
Warning / Debt	At or past its safe load	No: a full zone, never selected
Not reporting	No configured ceiling, or silent	No: no headroom is assumed

The same zone verdict is what regulates the agent's own behavior too, its concurrency caps, how fast it drains its store-and-forward spool, and (below) whether it can win a conductor election. One honest measure of load drives every decision that depends on it.

Efferent: placing work on the freest tentacle

When the brain has a workflow step to run at the edge, it does not round-robin or broadcast. It ranks the selectable agents freest-first and places the step on the one with the most headroom.

An Edge Agent is selectable only when all of these hold, the rule is deny-closed, and a failure of any one drops the agent from consideration:

• its status admits work (an active device only. See below);
• it is connected (no recorded disconnect);
• its capacity zone is not full (not warning or debt) and it reports positive headroom; and
• it is in scope, bound to the workload's workspace or clean room.

Placement itself is a thin primitive, not a scheduler: it re-checks admission on a fresh read of the registry the instant before it acts (closing the window between ranking and dispatch), enqueues the step on the device's existing command-poll lane, and places nothing if no agent is selectable or the chosen one has just flipped to a hold, it never falls back to a loaded or held device.

Placement is also scoped. A device not bound to the workload's workspace or clean room is out of scope and cannot be chosen, so efferent work inherits the workspace/clean-room boundary rather than leaking across it.

Node-scoped fan-out, and what is owed

Placing many units across several freest, distinct in-scope agents, an intra-node fan-out, is built, but ships behind a default-off flag and spreads work only within a node (a tentacle's default reach). Name the slice: cross-node fan-out is not built. It is a deliberate future extension, because the device roster converges within a node by construction. The post-fan-out result reduce is a simple gather today (a full hierarchical reduce is owed), and a direct server-push placement path is scaffolded while the poll-lane path is the one that ships. Do not read "fan-out" as an estate-wide scheduler.

The admission gate: only an active device is served work

Underneath placement sits a single deny-closed check: only a device whose status is active may be served new work. Every other status, pending, suspended, draining, quarantined, revoked, decommissioned, or unknown, is refused. The check is consulted at every work surface (the gateway, the query RPCs, the workflow poll lane, and again at placement time), so a device cannot be handed work through one door that another door would have refused.

Operators steer this with four lifecycle holds, pause, resume, drain, and quarantine, carried to the device on its existing configuration-push lane. A hold bites immediately at the cell (the status transition and the auth gate take effect at once) and is honored by the device on its next poll, so an offline device still respects a hold when it reconnects.

Coordination, and the reflex when the brain is dark

Tentacles also talk to each other, and can act without the brain.

• Agent-to-agent (A2A). An Edge Agent can publish a signed agent card (a canonicalized, detached-signature identity document) and exchange tasks with a peer over a standard JSON-RPC method, verifying and pinning the peer's card first. Accepting inbound tasks is opt-in: an agent runs no inbound server, and delegates no work under a tainted or untrusted execution posture, unless an operator enables it.
• The edge conductor (sovereign degradation). When the brain is unreachable on every transport, the most-capable reachable Edge Agent assumes a leased conductor role over the local mesh and coordinates the others with a deterministic, rule-based decomposition (plus a small local model, never a frontier model). "Most-capable" is a score over model tier × reachable transports × headroom, so a stressed agent (warning or debt) cannot win. The role is fail-closed: an agent declines it unless it has positive evidence the brain is dark (no split conductor), the lease auto-fails over to the next-most-capable peer if the conductor dies, and the local reduce returns inconclusive rather than a falsely-confident answer a coerced peer could swing.

Figure: the coordination handoff. In steady state the brain leads. When every transport to the brain is dark, the mesh elects a leased edge conductor and runs a local reflex; when the brain returns (or the conductor is overloaded), the role is shed. Ceiling: the connected intra-node fan-out and the disconnected edge conductor are two mirrors of one coordination model, the brain hands the concept off, it does not run two schedulers. The conductor role is leased through the fabric, so a conductor that crashes or partitions away releases its role rather than stranding the subtree, and reachability is answered from a per-peer attested map rather than a coarse transport health flag.

Table equivalent

State	Who decides	How	Ceiling
Brain-led	The cell	Freest-first placement, optional intra-node fan-out	Intra-node; cross-node owed
Electing	The mesh	Capability-scored lease; needs proof the brain is dark	Fail-closed; no split conductor
Edge conductor	The winning agent	Deterministic + small-local-model decomposition; inconclusive over false confidence	Fabric-leased role; per-peer attested reachability

Across the deployment matrix

Corner	How the nervous system behaves
Single-cell	The cell senses and places work on its node's Edge Agents; no peer cell to coordinate with
Multi-cell (same node)	Presence and capacity converge across the node's cells; placement and fan-out are intra-node
Sovereign / air-gapped	Afferent signals spool and drain by store-and-forward; if the brain is dark, the edge conductor runs the local reflex
Cloud-enabled	The same signals ride managed transport; nothing about the model changes

Related topics

• Placing work across Edge Agents, the how-to for the efferent and coordination planes.
• Core and edge, the brain/tentacle split this plane runs on.
• The estate hierarchy, why a tentacle's default reach is its own node.
• Edge & fleet management, the transport ladder the afferent and efferent signals ride.
• Deployment topology, links as states, and the store-and-forward path behind the afferent spool.