Orbis · architecture
You install the parts you need. Each one publishes what it may not do.
Orbis is not a monolith you take whole. It is a set of services with a package manager in front of them: one command brings in a vertical and the engines it depends on, another takes them back out, and the same packages run under Docker or Kubernetes. Underneath all of them is Motus, the runtime whose trace of a run is the audit evidence rather than a log written beside it.
Every part publishes what it is not allowed to do. Each service ships a mandate and a boundary, and the boundary always names another service. Orbis is what the framework is for. This is what it is made of.
Install
A package manager, not a tarball. Verticals and services are packages with versions and dependencies: install one and it brings what it needs, remove it and it goes, with a rollback if it does not.Runs on
Docker or Kubernetes, from the same packages. On your own hardware, in your cloud, or split by sensitivity across both.Runtime
Motus, the trace-first execution runtime. Routing happens on a recorded decision, so the branch a run took is a fact in the record rather than a function that returned a string.Bus
Services publish events and read them. The transport carries what it is given and never inspects it — a bus that understands the traffic is a central intelligence in a plumbing costume.Memory
A relational archive for the record and a vector store for similarity, with a service whose only job is to measure the drift between the two and plan the repair.The core
The reasoning is a library with no I/O in it. The service reads and writes; the core decides. The judge never touches the archive — the clerk does it for him.
The whole plan is one cell and the rule that places it.
Leonardo da Vinci, studies for a building on a centralized plan, c. 1487–90 · plate
How the world gets in
Nothing arrives already understood.
An API, a PDF, a BIM model, a photograph of a site, a spreadsheet of assessments. They enter by one door and take one path, and at the end of it they are part of a memory that can be questioned.
/01
Oculus Prime
It receives. It may not interpret.
The single gateway for everything entering the system, human or machine: documents, images, audio, video, geographic data, CAD. It takes the source apart and writes an immutable evidence pack. It is forbidden to run entity recognition, embeddings or ontology mapping, forbidden to decide what is relevant, and forbidden even to read the tables further down. Meaning starts after it, on purpose./02
Codex Hunters
It acquires and canonicalises.
Raw knowledge from sources becomes canonical records — one entity for the thing described, one for each finding inside it. Every record is written with a lineage row beside it: which evidence, which sheet of which file, which version of the extractor. Provenance here is a table, not an assurance./03
Babel Gardens · Pattern Weavers
They give it meaning.
One extracts signals that stay grounded in the text they came from; the other resolves that text against the domain's taxonomy — concepts, entities, sectors, regions. Neither is allowed to score, rank or conclude. They hand structure to the layer whose job that is./04
Memory Orders
They keep the two memories honest.
The relational memory and the vector memory drift apart, because two stores always do. Drift is measured, health is aggregated, and the repair is planned rather than performed: the office that notices the divergence is not the one that writes to the store.
The intake is deliberately the least intelligent part of the system. A gateway that decides what matters while it is receiving has already thrown away the evidence nobody asked for yet, and the question that needed it arrives six months later.
Meaning
No regular expressions where understanding is required.
Intent, entities, language, ontology mapping: every one of them delegates to the model as the primary engine. Keyword lists, patterns and linguistic templates are permitted in exactly one situation — as degraded operation when no model can be reached — and never as the path a healthy system takes.
The reason is not fashion
Hardcoded templates crystallise a finite set of patterns over a language that is infinite. They hold until the rare tongue, the dialect, the sarcasm, or the phrasing nobody anticipated — and those are precisely the cases where a wrong reading is expensive.The fallback is declared
It exists, and it is written down as what it is: the model first, and a heuristic path behind it that is worth roughly two thirds as much. A degradation that is announced can be reasoned about. One that is quiet is just a wrong answer with good posture.Ontology is half declared
The taxonomy of a domain is a configuration file, not a release: concepts, sectors, regions, the vocabulary your people already use. What is not declared is the mapping onto it, and that is the model’s work, because no list of synonyms has ever covered the way a person actually writes.
The layer that recognises does not interpret. Ontology resolution returns matches, concepts and similarity, and stops there. Risk, scoring and ranking happen downstream, where they can be traced to the evidence and to the criteria applied — which is the only place a number is worth having.
The orders
Six services, and six refusals.
Responsibility is split into separate services rather than layers of one program, and each ships a charter with two halves: what it is for, and what it must not do. Read the second halves in order and you have the constitution — every refusal hands the power it gives up to somebody else.
Codex Hunters
Acquire raw knowledge from sources and normalise it into canonical records.
Acquisition and canonicalisation, domain-agnostic — the meaning of what it acquires is not its to decide.
Babel Gardens
Turn unstructured text into structured, explainable semantic signals.
Not a decision engine, and not a taxonomy engine: ontology belongs to Pattern Weavers.
Pattern Weavers
Resolve text into taxonomy matches — concepts, sectors, regions, entities.
Extract structure, never interpret it. No risk, no scoring, no ranking at this layer.
Memory Orders
Hold coherence between the relational archive and the vector memory: measure drift, plan the sync.
Does not fix data directly. It plans the operation for the layer permitted to execute it.
Vault Keepers
Integrity, backup and recovery, and audit trails that cannot be rewritten.
Not a tribunal. Verdicts belong to Orthodoxy Wardens.
Orthodoxy Wardens
Validate outputs and render epistemic verdicts: blessed, heretical, or non liquet.
The judge never executes a correction. It can require one; it cannot perform one.
They talk over a blind bus. The transport carries events and never inspects them: it does not correlate, does not route on meaning, does not summarise. A message bus that understands the traffic is a central intelligence wearing a plumbing costume.
Three verdicts, not two. An output can be found sound, found wanting, or declared undecidable on the evidence available. The third is a first-class result with a name of its own, and it is the one most systems cannot say.
The door outward
Agents may call in. They arrive through the same charters.
Orbis exposes its capabilities as tools over the Model Context Protocol: a stateless gateway, a catalogue that is domain-agnostic by default, and a vertical that needs different names supplies aliases rather than a second gateway.
Governance is applied per execution, not at the perimeter. A tool called by an external agent passes the same offices as a question asked inside the system: the same validation, the same audit trail, the same right to answer that the case cannot be decided. An integration surface that skips the rules is not an integration surface, it is a way around the product.
Governance
Separated powers, inside the machine.
A system that reasons, rules on its own reasoning, and keeps the only copy of the record is not governed. It is merely sincere.
Judgment · Orthodoxy Wardens
It rules. It cannot repair.
The office that weighs an output renders a verdict and can require a correction, but has no power to perform one. Admitting that a case cannot be decided is part of its mandate, not a failure of it.Custody · Vault Keepers
It keeps. It cannot rule.
Integrity, recovery and audit trails that cannot be rewritten. Its own charter states that it is not a tribunal: whoever is able to touch the archive does not get to pass judgment on it.Account · lineage
It answers to whoever was not there.
The rules that applied, the evidence used and the decision taken stay retrievable together, joined by the lineage written when the evidence first arrived — after the project, after the team, after the people who were in the room.
The judge cannot repair, and the custodian cannot rule. Neither restriction is a policy that could be relaxed under pressure; each is the shape of the system. A judge able to mend the evidence it is weighing has stopped being one, and no amount of good intent recovers that.