The executive-functioning engine
Most platforms bolt governance on as a set of tools an agent is supposed to call. System9 runs it as an organ. The executive-functioning engine is one integrated loop (sense, decide, act) that runs automatically and involuntarily on the live tool seam, inside the platform's security and workspace / clean-room isolation boundaries. It is not a toolbox an agent chooses from; it is the reflexive-and-deliberative faculty the whole runtime acts through, and it decides identically on the core and the edge.
This page is the map of that organ: the loop it runs, the cognitive organs that feed it, the two-stage decision at its center, the four loci where intelligence forms, and how those loci roll up through a node.
The digital nervous system describes the signal planes that carry senses, load, work, and coordination between the cell (brain) and its Edge Agents (tentacles), the wiring of the arc. This page describes what happens at the DECIDE point of that arc: the cognition, the reflex and foresight decision, over memory and the world-model, that the brain (and, at full strength, the edge) actually runs. One is the nerves; the other is the faculty they serve.
In one paragraph
One organ senses, decides, and acts on the live seam, a reflex value check and a deliberative foresight stage that can only tighten a permit, reading a tamper-evident memory and a semantic world-model, and it reaches the same disposition in a sovereign air-gapped cell as in a cloud fleet.
The sense → decide → act loop
The engine runs a closed loop. Observations are fused and provenanced on the way in (the afferent path); the DECIDE organ evaluates a proposed action against what the estate knows and where its entities are heading; and only a permitted action reaches the world (the efferent path), where its outcome is recorded and folds back into memory as the next reading. A proprioceptive sense, the Workspace Mind, reads the system's own posture and feeds the trajectory the decision depends on.
Figure E1: the sense→decide→act loop. On the afferent side, observations land in a bitemporal memory and a semantic world-model; the DECIDE organ runs a reflex value gate (refuse-closed) and, above it, a foresight stage (which can only tighten the permit); the efferent side executes only a permitted action and records every decision, including every refusal, on a tamper-evident record that folds back into memory. Claim ceiling: the loop, both decision stages, the trajectory input, and the record are live on both runtimes; the afferent sensor-fusion front activates on a sensor + model binding (planned, sensor / model boundary), and the world-model dissonance brake is live on the core and planned at the edge (model boundary). The engine decides correctly without those inputs, it degrades each to an honest-absent neutral.
Table equivalent
| Phase | What happens | Status |
|---|---|---|
| Sense (afferent) | Observations fused + provenanced; land in bitemporal memory and the world-model | Memory live; fusion front + world-model activation planned |
| Decide (reflex) | Point-in-time value gate refuses net-negative outright | Live, both runtimes |
| Decide (foresight) | Deliberates over trajectory, enclosing scope, dissonance, operating cycle; tightens only | Live both (dissonance brake: core live, edge planned) |
| Act (efferent) | Only a permitted action executes; outcome recorded | Live, both runtimes |
| Proprioception | Workspace Mind reads own load/knowledge/value posture | Live |
The DECIDE organ, in one screen
The decision at the center of the loop is two stages, one organ. The reflex is fast and involuntary; foresight is deliberative and layered above it. Neither is a tool an agent invokes.
- The reflex, the Net Potential Gain (NPG) gate. Before any consequential action, it scores the action's net effect across the entities it would affect and refuses a net-negative outright. It is refuse-closed and it never fabricates a score for an action it cannot judge.
- Foresight, the foresight composer.
Once the reflex permits, foresight asks whether the action bends the long
horizon the wrong way. It reads each entity's measured trajectory
(Improving / Stable / Declining), rolls the action's impact up the enclosing
topology scope, consults the world-model's coherence, and branches on the
entity's operating cycle. It can only tighten a permit,
Proceed → Hold → Refuse, never loosen a refusal.
Both stages reach a byte-for-byte identical decision on the core and the edge for the same input, pinned by cross-language parity fixtures. That is why a sovereign, air-gapped edge cell is not a degraded client: it carries the whole organ and decides at full strength offline.
The cognitive organs that feed it
The DECIDE organ does not sense on its own, it reasons over what the platform's cognitive organs have already gathered, each governed by the same identity and classification model as every other capability:
| Organ | What it holds | Read more |
|---|---|---|
| Memory | A bitemporal canonical store: every fact carries when it was true (valid-time) and when we recorded it (recorded-time), append-only, hash-chained, and signed per cell. The trajectory brake reads its history. | Knowledge & the semantic layer |
| World-model | The semantic manifold: vector, graph, and ontology fused into one geometric object whose coherence (and its dissonance) is measurable. | Federated Semantics |
| Identity & accountability | Every actor is a crypto-bearing entity with its own key; every decision and refusal lands on the tamper-evident activity record, so an action always traces to an accountable entity. | The entity model |
Intelligence forms at four loci
Intelligence in System9 is not a single central brain. It forms at four loci, each a governed decision-maker with its own view, budget, and refusal, and the same discipline holds at every one. All the platform's observability planes feed these loci.
*Figure E2: the four loci of intelligence. The entity is the accountable actor (its own identity, memory, and value standing); the cell is the physical decision-maker that runs the DECIDE organ over its own data; the node is the intra-node roll-up over its cells and edge agents; the organization is the estate aggregator. The level above sees what the level below decided and why, never a laundered average.
Table equivalent
| Locus | What decides there | Relationship |
|---|---|---|
| Entity | The accountable actor, with its own key, memory, and value standing | Acts within a cell |
| Cell | The physical unit that runs the DECIDE organ over its own data and keys | Folds up to the node |
| Node | The intra-node roll-up over its cells and edge agents | Aggregates to the org |
| Organization | Attention + health aggregation across the estate | Same discipline at estate scale |
The intra-node roll-up folds real work
The node locus is not a dashboard average, it folds real work. A workload that fans across a node's cells and edge agents returns signed partial results, and the node reduces them along the true topology:
- Persisted plan and partial envelopes. The plan and each partial are durable, so a reduce survives churn and resumes where it left off.
- Re-verified leaf signatures. Every leaf partial carries an Ed25519 signature the node re-verifies before it folds, a partial is admitted on its own producer signature, never on an unauthenticated header.
- mTLS peer-snapshot identity. A peer is identified by its verified certificate, not by a claimed header.
- Topology-true reduce. The reduction follows the real cell/edge topology, so the node's answer reflects what actually ran where.
Figure E3: the intra-node multi-cell roll-up. Cells and edge agents return signed partials; the node re-verifies every leaf signature and identifies each peer by its verified certificate (not a header), then applies a topology-true reduce over persisted plan and partial envelopes. Claim ceiling: the intra-node fold is live on the live driver; the cross-site / WAN pull of partials not yet carried home is planned (network boundary), until then those partials ride the store-and-forward / courier path. The Edge Agent's default scope is intra-node; cross-node is an explicit, permissioned extension, and the engine is a topology client, not a placement planner.
Table equivalent
| Element | Role | Status |
|---|---|---|
| Cell / edge-agent partial | A signed (Ed25519) leaf result | Live |
| Re-verify + mTLS peer-snapshot | Admit a partial on its verified signature and certificate, not a header | Live |
| Topology-true reduce | Fold partials along the real topology over persisted envelopes | Live (intra-node) |
| Cross-site / WAN pull | Pull partials not yet ridden home | Planned (network boundary) |
Across the deployment matrix
- Single-cell, the whole organ runs on one cell; sense, decide, and act are local, and the entity/cell loci answer for themselves.
- Multi-cell (elastic in and out), the node folds its cells' and edge agents' signed partials into one intra-node answer that persists across their churn.
- Sovereign / air-gapped, no coordinator and no cloud is required: the DECIDE organ is pure on-box logic and reaches the same disposition offline; the roll-up is cell-local composition; sealed envelopes ride courier / sneakernet.
- Cloud-enabled: the same organ, with the live-transport and model-serving inputs lit.
The engine holds across every corner of the matrix, and every claim above is marked for the corner it is proven in. Where a capability genuinely stops at a hardware, model, or network boundary, this page says so rather than narrowing it silently.
Related
- The foresight composer, the deliberative DECIDE stage in full.
- The Net Potential Gain (NPG) gate, the reflex value gate.
- The Mind (the fractal roll-up) the proprioceptive load/knowledge/value read that feeds trajectory.
- Core and edge, the two-runtime discipline and the edge↔cell transport/identity seam.
- Knowledge & the semantic layer, the bitemporal memory the trajectory brake reads.
- The estate hierarchy, the org → node → cell shape the loci roll up along.