The System — One Page

The whole architecture as clear concepts. The single source of truth everything else must agree with.

The principle

No artifact knows the whole system. Each owns one concern and does that best.

Security, correctness, and evolution all fall out of this one fact. There is no place that knows everything, so there is nothing to compromise into the whole. A concern small enough to fully own is one a fallible part can actually get right. And nothing depends on any artifact holding the whole, so each can be improved or replaced on its own. Trust is not placed in any piece — it is a property of the arrangement. Everything below is a corollary.

The one rule

The system only adapts during calibration. In production it is a rock.

Nothing rewires itself while serving. Every change to behaviour is produced by a calibration phase and then frozen. Production only flags — it never adapts.

Four artifacts, three of them static

  OUTSIDE WORLD
       │   (REST, natural language, agent protocol — any front protocol)
       ▼
  ┌─────────────────────────────────────────────────────────────┐
  │  GUARDIAN        static multi-protocol front surface         │
  │                  maps any protocol → one canonical intent     │
  │                  serves the surface, monitors, flags          │
  └─────────────────────────────────────────────────────────────┘
       │   canonical intent + feature vector
       ▼
  ┌─────────────────────────────────────────────────────────────┐
  │  MEMBRANE        frozen neural network — the middleware       │
  │                  feature vector → pass or no path             │
  │                  cannot be argued with, processes no meaning   │
  └─────────────────────────────────────────────────────────────┘
       │   authorised intent only
       ▼
  ┌─────────────────────────────────────────────────────────────┐
  │  SYSTEM PRESENCE dispatches intent → model call, monitors     │
  └─────────────────────────────────────────────────────────────┘
       │
       ▼
  ┌─────────────────────────────────────────────────────────────┐
  │  MODEL           the developer's code — stays exactly as is   │
  │                  pure functions + data, no auth, no routing    │
  └─────────────────────────────────────────────────────────────┘

What each calibration produces, and what it is at runtime:

  Guardian   →   a static, multi-protocol front surface           (frozen)
  Membrane   →   a frozen neural network, the middleware/gate      (frozen)
  Presence   →   per-story specs compiled to a static intent dispatch   (frozen)
  Model      →   untouched — the developer's pure functions        (unchanged)

The membrane is a neural network. That is the substrate — non-linguistic, signal-only, the thing that cannot be socially engineered because it processes no meaning. Freezing it is the constraint; being a net is the point. (At the toy scale of the example it is a small MLP; at real scale it is a large net routing many features into many paths. Same artifact, different size.)

Three phases

  START         the two AIs read the model and set it up.
                initial calibration → the static artifacts.

  PRODUCTION    frozen. The AIs only flag — threats, drift,
                divergence. No adaptation while serving, ever.

  RECALIBRATION the artifacts are rebuilt, then frozen again.
                triggered two ways (below).

Two recalibration loops

The trigger decides who is in the loop.

  THREAT / DRIFT        →   AI in the loop
                            production flags drive it.
                            the world moved; the AIs recalibrate.

  NEW FEATURE           →   human in the loop
                            new capability cannot come from the AIs —
                            they do not invent business function.
                            a human extends the model or edits a story;
                            Presence checks it, pushes back, compiles.

Both end the same way: new static artifacts, validated, hot-swapped. The membrane only ever gets rebuilt — it never rewires itself.

The boundaries (the law, restated)

Each artifact knows exactly one thing and produces exactly one thing.

  Model       knows   business data + capabilities
              writes  nothing else — no auth, no routing, no intent names, no composition (no "and then")

  Guardian    knows   the outside world (protocols, language, attacks)
              writes  the front surface + the feature vector
              never   knows the inner system

  Membrane    knows   feature vectors
              writes  pass / no-path
              never   knows what the features mean

  Presence    knows   the inner system
              writes  the composition — intent → model dispatch, atomic, effects after commit
              never   knows the outside world

  Calibration knows   everything, once, at build time
              writes  the static config + the frozen weights
              then    forgets

If a value in a runtime file is not read from the config or the weights, it is in the wrong place.

Why this shape

Frozen is what makes it trustworthy. A live model can be argued into a new behaviour. A frozen artifact answers the same way every time, under any framing.
The neural membrane is what makes it unargueable. It processes signals, not meaning. You cannot socially engineer something with no model of meaning.
Default-deny is what makes it tractable. Nothing crosses unless a door was cut at calibration. Falling behind costs usability (a door not yet opened), never security (a silent breach). See the manifesto, Wall first, doors later.
Calibration is the only moving part. Everything hard — coverage, balance, what is allowed — happens once, by machines, and is frozen. Production is boring on purpose.

Pim Bongers, Studio Bonkers, June 2026 With Claude