A fleet of edge devices is not a nervous system
The usual edge is a set of clients that poll a cloud for instructions and go dark when the link does. Nothing downstream knows how loaded a device is, a device knows nothing about its neighbours, and a disconnection is an outage rather than a mode of operation.
Model it as a nervous system instead: the core sets intent like a brain, each Edge Agent is a tentacle that feels its own state and acts on local reflexes, and the two are wired both ways. The brain never micromanages a muscle, and a limb that loses contact with the brain keeps working on its own.
Sense, act locally, be governed as one
The whole loop runs under the platform’s one identity, policy and audit model. What is shipped is drawn solid; the live orchestration it is built toward is drawn dashed, because a design claim and a deployment are different things.
| Function | What happens, and where the ceiling is |
|---|---|
| Sense | Each edge agent reports presence, signed roster membership and a capacity signal, the estate has a live picture of its own load, not a guess. |
| Reflex | An agent classifies its own capacity zone and self-regulates (pacing, admission, backpressure) with no round trip, the way a reflex arc acts without waiting for the brain. |
| Place | The core ranks the healthy, in-scope agents freest-first and places a workload as a command drained on the next poll, re-checked against the admission gate. |
| Coordinate | Agents forward reasoning partials to a peer conductor over a live link when they have one and a store-and-forward spool when they do not, one store, two transports. |
| Govern | Revocation, certificate refresh, configuration and destruction reach the agent under the same identity, policy and audit model as the rest of the platform. |
| Reconcile | A device that does not know its own ceiling reports no capacity rather than inventing one; absent signals stay absent, and state converges when the link returns. |
Sense
Each edge agent reports presence, signed roster membership, and (after every successful heartbeat) a capacity signal carrying its utilisation zone and how much work it can still take. The estate has a live picture of its own load, not a guess.
Reflex
An agent classifies its own capacity zone and self-regulates on it (pacing, admission, backpressure) with no round trip. A work-admission gate and honoured lifecycle holds mean a disconnected agent keeps making correct local decisions, the way a reflex arc acts without waiting for the brain.
Place
The core ranks the healthy, in-scope agents freest-first from the capacity signal and places a workload as a command the agent drains on its next poll, re-checked against the admission gate before it runs, and idempotent on retry. A queued command, chosen because the core cannot dial an intermittent edge, not a live push.
Coordinate
Agents forward reasoning partials to a peer conductor directly over a live link when they have one, and over a store-and-forward spool when they do not, one store, two transports. An autonomous daemon keeps a cloud-dark but locally-connected group coordinating among themselves.
Govern
Revocation, certificate refresh, configuration and a destruction command reach the agent over the control path, applied under the same identity, policy and audit model as the rest of the platform. The brain sets intent; the periphery executes.
Reconcile
A device that does not know its own concurrency ceiling reports no capacity at all rather than inventing a reading. Absent signals stay absent, edges act locally, and state converges when the link returns, the same discipline as the estate roll-up.
Proprioception, the sense of where the estate is loaded
On every successful heartbeat, an edge agent that knows its own concurrency ceiling emits a capacity.zone.v1 signal: its utilisation zone on an eight-band scale, and its remaining step headroom. It is the same verdict the agent already uses to pace itself, now surfaced so the core can see live edge load. The wire vocabulary and the order of the zones are pinned across the two runtimes by a parity fixture, so the core and the edge read the same signal the same way.
The sensing signal, the local self-regulation on it, and poll-queue placement of a workload onto the freest agent are built. A live server-initiated work-push stream and a standing node-side conductor that fans a workload across a node's agents are the design direction, not shipped. A device that does not know its own ceiling reports no capacity rather than inventing one.
Strongest where the link is weakest
A nervous system that only works while every limb is connected to the brain is not one. Cut off, an Edge Agent keeps classifying its own load, keeps admitting or refusing work under its local gate, and honours a lifecycle hold it already holds. A group of agents on the same local network keeps coordinating among themselves and folds the result back with its history intact when the link returns.
This is the sovereign and air-gapped deployment the product is sold on, so the autonomy is not a fallback the stack tolerates, it is the design point. The capability is strongest exactly where it matters most.
The direction, drawn as direction
We are not claiming a living superintelligence. We are building the conditions under which a distributed one could operate safely, every actor identified, every action observable, every consequential decision gated, and wiring the estate to sense itself and act on what it senses.
Placement today is a queued command drained on the next poll. A live, server-initiated work-push stream, and a standing node-side conductor that fans a workload across a node’s agents, are the model the platform is built toward. That is a statement about the design, and we keep it distinct from a measured deployment, because an architecture claim you cannot check is worth nothing to the person who has to defend it internally.
Replication and coordination already span 9 scopes, from a single node to across an organization boundary, the same addressing spine this loop rides.