Skip to main content

The Seven Threads

These seven properties are not a security feature list. They are the conditions a distributed intelligence needs in order to stay one intelligence, and that is why they are absolute rather than configurable.

An actor with no identity cannot compose its work with anyone else's. A decision with no record cannot be learned from. A boundary that holds in one service and not another is not a boundary at all. At the scale System9 is built for, where agents are the primary users and no human can check the work by hand, a property that holds almost everywhere is the same as a property that does not hold.

So each of these holds at every layer, in every service, on every path, all the way to a device in the field. Any platform can ship a feature; making a property hold everywhere is a different kind of problem, and it is the one that decides whether scale produces coherence or noise. Every page on this site belongs to at least one of them.

Figure A6: the seven threads and the spine they run through. Each thread is a property that does not live in one component; it holds across every layer, every service, and every path, down to a disconnected device. A feature is a point on this figure; a thread is a line through all of it.

Table equivalent

#ThreadThe systemic guarantee ("so what")
1One identity, person → field deviceEvery action traces through an unbroken cryptographic chain to a human or org that authorized it
2One classification ladderA label applied once is honored everywhere, including on a device with no network
3Everything chainedNot "we log everything": sixteen different things provable, with the mathematics for each
4What refusesThe platform refuses at the boundary and records the refusal, rather than permit-and-log
5Works offlineDesigned to keep working when the link does not; nothing phones home to start
6Signed at originProvenance attached where an artifact is made and checked where it is used
7Metered and verifiableEvery bill line has a hash-chained record behind it; topology is free, only work is billed

Thread 1: One identity, from a person to a field device​

One directory, one authorization path, and one crypto identity carry from a person through an agent and a sub-agent to a cell, a node, and a field device. There is no point in the chain where the answer becomes "a service account somebody made in 2019." See the entity model and the cryptographic system.

Thread 2: One classification ladder, enforced on every path​

One five-rung ladder plus orthogonal compartments is the platform's entire information-flow vocabulary, object storage, streams, query engines, messaging, agents, models, and the edge all compare against the same enum. See the classification ladder and enforcement and clearance.

Thread 3: Everything is chained, and each chain proves a different thing​

The platform does not have "an audit log"; it has roughly sixteen independent tamper-evident chains, each answering a specific auditor question, each counting its own gaps. See audit and tamper-evidence.

Thread 4: What refuses, and what proves it refused​

Most systems permit and log. This one refuses at the boundary and records the refusal, a net-negative action, a plaintext write when encryption is armed, raw rows leaving a clean room, an unsigned policy, an off-profile algorithm. See Governance (Deny-Closed).

Thread 5: What still works when the network does not​

Nothing phones home to start (test-verified across all eleven startup entrypoints), and the platform is designed to keep working disconnected: offline licensing, last-known-good signed policy, a subordinate CA that still issues, and local inference. See Core and Edge.

Thread 6: Signed at origin, and the signature travels​

Provenance is attached at the moment of origin, a frame at capture, a policy before it replicates, a workflow step over its input and output hashes, and verified at the moment of use against a pinned key. See signing and provenance.

Thread 7: Everything is metered, attributed, and verifiable​

Every metered record lands in a hash-chained meter audit chain with gap detection, and offline estates emit signed metering bundles. Infrastructure count (cells, nodes, service groups) is free; only the work is billed. See metering and attribution.