UNIVERSAL SYSTEMS ARCHITECTURE
Many planes.
One operational truth.
Multi-platform engineering, modular factories, publisher adapters, emulation targets, maintenance and evidence-based AI critique—all separated into explicit capabilities and verifiable states.
01 / ARCHITECTURE
System planes
Independent surfaces, connected by bounded dependencies and policy gates.
01 / PUBLIC-READ-ONLY
Experience
experience
Open existing public module ↗02 / LOCAL-CONTROLLED
Compute & Containers
compute
No public control surface03 / CAPABILITY-GATED
Hypervisors & Emulators
virtualization
No public control surface04 / CAPABILITY-GATED
Cross-Platform Compatibility
compatibility
Open existing public module ↗05 / PRIVATE-OR-LIMITED-PUBLIC
Models & Routing
inference
Open existing public module ↗06 / STAGED
Artifact Factory
factory
Open existing public module ↗07 / APPROVAL-GATED
Publishers & Releases
publishing
Open existing public module ↗08 / SANITIZED-PUBLIC
Evidence & Telemetry
observability
Open existing public module ↗09 / CITATION-GATED
Knowledge & Provenance
knowledge
Open existing public module ↗10 / SYNTHETIC-ONLY-PUBLIC
Identity & IT Labs
identity
Open existing public module ↗11 / DRY-RUN-DEFAULT
Hygiene, Trimming & Backups
maintenance
No public control surface12 / PRIVATE-CONTROL
Policy, Tenancy & Security
governance
No public control surface13 / EVIDENCE-REQUIRED
Critique & Meta-Prompting
metacognition
Open existing public module ↗14 / BOUNDED-WORKFLOWS
Schedules & DAGs
orchestration
No public control surface15 / LEAST-PRIVILEGE
External Providers & Plugins
connectors
No public control surface16 / BUDGET-CAPPED
Resource, Quota & Cost Budgets
economy
No public control surface02 / COMPATIBILITY
Platform & hypervisor matrix
A target is not an installed emulator. Each state reflects installed capabilities or declared intent.
| Platform target | Type | Observed state |
|---|---|---|
| linux-x64 | native | native-observed |
| linux-arm64 | cross-platform | declared-not-verified |
| windows-x64 | foreign-os | declared-not-verified |
| macos-arm64 | foreign-os | declared-not-verified |
| android | mobile | declared-not-verified |
| ios | mobile | declared-not-verified |
| browser | web | declared-not-verified |
| webassembly | portable | not-installed |
| qemu-tcg | emulated-cpu | not-installed |
| qemu-kvm | hypervisor | blocked-no-dev-kvm |
| docker | containers | unavailable |
| lxc | containers | cli-installed-not-proven |
Hardware KVM requires
/dev/kvm. Foreign operating systems require properly licensed and compatible remote runners, simulators or physical devices.03 / DISTRIBUTION
Multi-publisher fabric
Publisher integrations are distinguished from working deployment channels.
WORKING LOCAL ADAPTER
local-stage
Internal distribution target.
DECLARED ADAPTER
existing-public-gateway
External publication requires approval.
DECLARED ADAPTER
gitea
Internal distribution target.
DECLARED ADAPTER
github
Internal distribution target.
DECLARED ADAPTER
vercel
External publication requires approval.
DECLARED ADAPTER
cloudflare-pages
External publication requires approval.
DECLARED ADAPTER
docker-registry
Internal distribution target.
DECLARED ADAPTER
static-cdn
External publication requires approval.
04 / INTELLIGENCE
Factory & metacognition loop
Every improvement is specified, tested, critiqued and recorded before release.
01 Discover
02 Specify
03 Build
04 Critique
05 Repair
06 Test
07 Hygiene
08 Stage
09 Release
10 Observe
These are defined workflow stages, not proof that autonomous AI agents have executed all ten steps.
05 / TRUST MODEL
Operations with boundaries
Status and compatibility metadata only. No root commands, credential stores or privileged APIs.
Scratch-only cleanup defaults to dry run. Eligible stale files move to quarantine, not permanent deletion.
Content-hashed local staging is operational. External publication remains permission- and provider-gated.
Prompt-generated claims never count as independent tests or provider execution receipts.