Architecture

Why six layers

Each layer owns one decision and hands a typed result to the next. That is what makes a failure locatable: when something goes wrong, the boundary it crossed tells you where to look. A single monolithic agent loop has no such property.

1 — Strategy

Takes plain language and returns structured requirements. Its output is the first thing a person reviews and the cheapest moment to disagree, because nothing has been planned, written or costed yet.

2 — Blueprint

Holds the versioned description of each product: capabilities, contracts, entities, rules. It is the system of record for what the portfolio is, and it is deliberately ignorant of how anything is currently implemented.

3 — Capability composition

Resolves requirements against the capability graph. Reuse first, extend second, create last. Every choice is stated with the requirement it covers so the trade can be argued with.

4 — Policy and validation

Evaluates whether a proposed change is permitted, and records the rule behind every refusal. It sits between deciding and doing, which is the only place a control of this kind works.

5 — Build and AI engineering

Runs the engineering work: plans, implements, tests, opens pull requests and reviews them independently. It cannot apply anything itself — it proposes typed change sets that the action service authorises and applies.

• Agents emit typed operations, never shell commands
• Work lands on branches, never on a default branch
• Independent review is a separate agent with a separate prompt and separate context

6 — Verification and release

Certifies a change against eight gates, captures provenance and keeps rollback available. It is the last boundary, and the one that makes a shipped change answerable.

The boundary that matters most

The planner cannot act. It emits proposals; a separate action service enforces authorisation and policy before anything is applied. Every serious control in this system is a consequence of that one separation.

Where this marketing site sits

Nowhere near any of it. The site you are reading is static content with no credentials, no control plane access and no connection to any repository. It keeps serving when every other host is down, which is exactly what a marketing host should do.