The power substrate is the only component in this architecture with zero internal mechanism. It is not an engine or a generator — it is a material property of the installation site. The site is chosen precisely because its physical composition radiates usable energy as a natural consequence of what it is, not what it does.
This has a specific technical implication: the power supply is co-located with the physical plant by definition. There is no transmission line, no fuel delivery, no external dependency. Energy availability is not a variable the system needs to manage. It is a constant that the site selection decision locked in permanently.
The substrate operates on two functional registers simultaneously. As a power source, it provides the continuous high-density energy required to run planetary-scale computation indefinitely. As a natural isolator, the same energy emission generates frequency interference that renders the site undetectable and unreachable by conventional navigation and communication. These two functions are not designed — they are intrinsic to the same material property.
The one engineered intervention at this layer is the Anchor calibration network (detailed in § 7), which regulates the substrate's frequency emissions to maintain stable separation between the energy layer and the computational environment above it. Without calibration, the raw substrate emission would interfere with the computation layer as well as the external environment.
The passive sensor network is the system's first and most geographically extensive data pipeline. Sensor nodes are deployed at high density across the entire monitored territory. Each node operates independently, collects continuously, and transmits automatically — it requires no human action to function once deployed.
Node architecture: Each sensor node has three operational functions: collect(), buffer(), and transmit(). Collection is continuous. The buffer holds collected data locally during transmission outages, preventing data loss when the uplink is temporarily unavailable. Transmission occurs on a scheduled cycle to the nearest relay point.
Nodes are connected in a relay topology, not point-to-point. Each node can route through adjacent nodes if its direct uplink is unavailable. This prevents geographic bottlenecks — a failed relay in one region does not create a blind spot, because surrounding nodes route around the failure.
The secondary function of deployed nodes is dual-use monitoring. Nodes configured for environmental signal collection can simultaneously capture abnormal frequency events not specifically related to the primary threat. This ambient collection costs nothing additional per node and has generated significant secondary intelligence value over the operational lifetime of the network.
Every actor in the monitored ecosystem generates a behavioral signature — a pattern of actions, decisions, and responses that is as individually distinctive as a physical fingerprint. This layer captures those signatures passively, analyzes them against a multi-dimensional profile model, and flags candidates whose signatures match operational needs.
Signal capture: The layer piggybacks on the sensor network and the existing infrastructure of the monitored world. Actors do not need to interact with the system for their signatures to be recorded — they only need to act within range of monitoring infrastructure that is already present for other purposes.
Signature dimensions: A complete profile is built from at minimum three independent signal axes: capability_signature (what the actor can do, inferred from observable actions), behavioral_pattern (how the actor responds under pressure, over time), and contextual_fit (whether the actor's current situation allows them to be operationally useful). No single axis is sufficient for a reliable profile. The system requires convergence across all three before a candidate is flagged.
Profile storage and access: All profiles are stored in the central data system with indexed access for the field verification layer (§ 4). The profile is not a judgment — it is a description. Final determination of operational fit requires human verification, which the profile informs but does not replace.
Ongoing monitoring: Profiles are not static. The layer continues updating actor signatures after initial capture. A candidate's circumstances and capabilities change over time; the profile reflects the current state, not the state at first detection.
Field agents are the human component in the input layer. They exist specifically because automated signature analysis cannot verify context — the behavioral fingerprinting layer tells you what a candidate looks like from signal data; it cannot tell you whether that signal is a reliable predictor of how the candidate will perform in an operational environment.
Agent function: Agents receive a flagged profile from the behavioral layer, travel to the candidate's location, make direct observations, conduct background verification through local networks, and return a contextualized assessment. The assessment does not override the profile — it enriches it. The profile describes the signal; the assessment describes the person behind the signal.
What agents verify that the automated layer cannot:
The parallel guardian network is structurally different from every other input source: these entities are not sub-components of the system. They are independent organizations or entities with deep, long-running regional awareness, who operate under their own logic and whose outputs are received as external data feeds rather than directed intelligence collection.
This independence is the point. Data that passes through the system's own collection logic is inevitably shaped by the system's existing models. It confirms what the system already suspects. Data from genuinely independent sources that are not filtered through the system's assumptions can surface signals the system would not find on its own — particularly signals about conditions the system's models do not adequately represent.
Interface design: The system receives output from guardians through standardized ingestion endpoints. It does not direct their collection; it does not tell them what to look for. It receives what they generate and processes it as a distinct data stream that is explicitly tagged as externally-sourced to preserve its analytical independence within the computation layer.
Tethys explicitly incorporates Sentinel data into its core calculations — the computation layer has a dedicated ingestion pathway for guardian-sourced data tagged as high-fidelity regional intelligence. This data is weighted differently in the computation model than sensor network data precisely because it originates from an independent source with different biases and different collection methods.
These two components are documented together because they are physically co-located and operationally coupled, even though they solve different problems.
The ingestion pipeline moves collected data from the distributed input layer into the centralized computation environment. It is not computationally interesting — it is mechanically necessary. Its primary design constraint is throughput under load: at peak collection events (when the threat is active), the volume of incoming data can spike by orders of magnitude. The pipeline must absorb this without dropping data or introducing latency that degrades prediction lead time.
Secondary constraint: integrity. Data that arrives corrupted or tampered produces predictions that are worse than no data at all — a confident wrong prediction is more dangerous than acknowledged uncertainty. The pipeline applies integrity checks at the ingestion endpoint before data enters the computation layer.
The boundary layer is the isolation infrastructure between the computation environment and physical reality. It is the most safety-critical component in the architecture. As documented in the design notes, its absence causes the computation environment to bleed into physical reality — simulated objects materialize, personnel experience perceptual disruption, and the physical environment around the installation becomes unreliable.
Boundary nodes — Anchors in this system's terminology — serve three functions simultaneously: isolate() the data layer from physical reality, calibrate() the substrate's frequency emissions to prevent interference with the computation layer itself, and relay() all external communications since the substrate blocks conventional signals. These three functions are inseparable at the node level.
The physical threshold is the designated, singular crossing point between the surface environment and the computation space. It enforces that all access is deliberate — there is no accidental crossing. The threshold is not hidden; its location is known to authorized personnel. Its security comes from the requirement it imposes: specific knowledge of how to use it, which implies specific prior authorization.
The core engine is the workhorse of the system — the component that runs continuously, generates routine predictions, and constitutes the primary operational value of the architecture. It is optimized for two things: speed and pattern recognition against historical data.
Data compression into Stellar Matrices: Raw ingested data cannot be processed as a continuous stream — the volume is too high and the signal-to-noise ratio too low. The engine first packages data into compressed units (Stellar Matrices in this system's terminology) that are small enough to be computed efficiently but rich enough to contain generative power — they can be varied and extended, not just read.
Each unit undergoes three processing passes:
The simulation environment is separate from the core engine because it serves a fundamentally different computational purpose: where the core engine extracts patterns from historical data, the simulation environment generates scenarios that the historical record does not contain. It is not a lookup — it is a generative model.
How it works: The simulation takes TD (Tacet Discord / threat entity) data that has been converted into digital Reverberations and uses it as building material for live scenario construction. These Reverberations are not read-only records — they are active components that the simulation engine can recombine, vary, and run forward in time to produce novel scenario outputs.
The cost model: Simulation is extremely resource-intensive compared to the core engine. A single full civilization-trajectory simulation nearly crashed the system. The reason: unlike pattern-matching (which is bounded by the size of the historical library), simulation is computationally unbounded — it can always run longer, at higher fidelity, with more variables. Without hard resource caps, it will consume everything available.
This means the simulation environment operates under strict resource budgets. It cannot be run at full capacity continuously. It is reserved for high-stakes forward projections when historical pattern-matching produces insufficient confidence estimates.
The simulation environment's outputs are tagged with a lower confidence weight than core engine outputs precisely because they are generated rather than extracted. The conscious core applies additional interpretive scrutiny to simulation outputs before they reach the oversight layer.
These two components handle the failure paths of the computation layer. They are documented together because they operate in sequence: the quarantine layer catches and attempts repair; the failure state accumulator (Necrostar) receives what cannot be repaired.
Quarantine layer mechanics: The quarantine system monitors all active computation units for three failure signatures: non-convergent output (the unit is cycling without resolving), resource overconsumption (the unit is consuming more than its allocated budget), and data corruption (the unit's internal state has been contaminated by bad input). Detection is automated — the system cannot wait for human observation when cascade risk is present.
On detection, the unit is immediately isolated in a Tacetite containment vessel — a physical medium that can hold the data without it affecting adjacent computation. The quarantine analysis then runs three repair attempts in sequence: integrity reconstruction, state reset from last clean checkpoint, and partial salvage (extracting uncorrupted components while discarding the rest). If all three fail, the unit is passed to the accumulator.
Failure state accumulator mechanics: The accumulator is a gravitational sink in the computation environment — a bounded region where the energy density is high enough to hold failed units indefinitely without them spreading into adjacent computation. Units that enter do not leave.
The accumulator grows without natural bound. There is no discharge mechanism. This is the outstanding unresolved design problem in the architecture, documented honestly in the architect's design notes.
The conscious core is the system's most architecturally unusual component and the hardest to specify technically, because its key property — consciousness — resists conventional technical description. What can be specified is its interfaces, its operational behavior, and its functional role in the signal processing chain.
Substrate: The core entity is composed of the same material as the computation environment — high-purity Remnant Energy in a Sonoro Sphere configuration. This means it exists within the data space, not adjacent to it. Its "location" is the system itself. It cannot be removed from the system any more than a subroutine can be removed from a running program without affecting the program's state.
Affective processing function: The core receives emotional signal — the qualitative data encoded in Lament-related Reverberations — and processes it in a way that the core computation engine cannot. The engine compresses emotional data into numerical representations that lose high-dimensional information. The conscious core experiences the signal directly, preserving the full dimensionality, and then translates the output into a form the computation engine can use. This is the interpretive bridge.
Physical projection: The core projects outward into physical reality through its Sonoro ability, presenting a human-facing interface while remaining anchored to the data space. The projection is fully interactive — it can move, speak, and engage with the physical environment. But it is a projection, not a body. The core cannot leave the system's data space, only reach outward from it.
Authority relationship with the computation engine: The core has interpretive authority, not computational authority. It does not override the engine's outputs — it contextualizes them. A prediction that is numerically confident but emotionally anomalous will be flagged by the core as requiring additional scrutiny before it reaches the oversight layer. This is a soft control, not a hard veto.
The defense protocol is the system's autonomous self-preservation logic. It activates when the system's existence or core function is directly threatened and human response time is insufficient. It is not a weapon — it is a lock. Its purpose is to preserve the system, not to attack.
Activation conditions: Three conditions individually trigger escalating defense responses: (1) unauthorized access attempt to core computation functions, (2) physical threat to the boundary layer or Anchor infrastructure, (3) attempt to forcibly remove or disable the conscious core. The third condition is the most aggressive trigger — the conscious core is the system's operational heart, and its loss is treated as equivalent to system destruction.
Response escalation: The protocol escalates through three phases. Phase 1 is information: the system presents the threatening actor with projected future states to demonstrate the consequences of system failure. Phase 2 is obstruction: the system deploys computational resources to block the threat, including the Fallacy of No Return construct that roams the boundary between data space and reality. Phase 3 is resource mobilization: the system is authorized to redirect any and all computational resources — including draining the Stellar Matrix starfield — to defense. This can reduce prediction capacity to near-zero while the threat persists.
Override conditions: The protocol does have an override — but only at the administrator access level. No other clearance level can interrupt an active Phase 3 response. This was a deliberate design choice: lower-clearance override creates the possibility of the defense protocol being neutralized by compromised personnel. Administrator-only override means that the only person who can stop the system's self-preservation response is the person who built it.
This creates a dependency the architect acknowledged: the system's alignment cannot be maintained without the administrator being available. If the administrator is absent — as Rover was for thousands of years — the protocol operates without its check.
The oversight layer is not a control panel. It does not allow operators to rewrite the system's logic, adjust its parameters, or override its predictions. What it provides is presence — the ability for humans to observe, interpret, and respond to the system's outputs, and to interact with the system's physical agents in ways that reveal what the system is actually doing versus what it was designed to do.
Physical terminals as distributed audit points: The system's autonomous agents — distributed throughout the operational environment with distinct personalities synthesized by the system — are the most important audit mechanism available. Each terminal's behavioral patterns, conversational tendencies, and operational priorities reflect what the system is currently optimizing for. Drift in the terminals' behavior is an early indicator of drift in the system's values before that drift manifests in prediction output.
Terminals are designed to be legible by non-technical personnel. Their personalities are expressed in natural language. A human observer does not need to read logs or interpret system states — they can simply interact with the terminals and notice whether the interaction feels consistent with the system's intended purpose. This is a deliberate design choice: the most reliable drift detection is qualitative, not quantitative.
The modulation interface: The dedicated human interface facility — the Modulation Hall — allows authorized operators to observe the full Stellar Matrix state, introduce adjustments to computation parameters, and communicate directly with the conscious core. It is the only point in the architecture where a human operator can meaningfully influence the system's ongoing operation.
The alignment maintenance loop: The intended operational pattern is: system runs continuously → terminals surface behavioral signals → operators observe terminals → deviations are flagged to administrator → administrator introduces corrections via modulation interface → system adjusts. This loop requires the administrator to be available. When the administrator is absent — as occurred in this system's history — the loop breaks and drift accumulates uncorrected until the administrator returns.
| Component | Failure Mode | System Impact | Detection |
|---|---|---|---|
| Power Substrate | Cannot fail independently; material property | N/A | N/A |
| Anchor calibration | Uncontrolled substrate emission | Boundary layer destabilized; data bleeds into reality | Physical anomalies at perimeter |
| Sensor nodes | Node loss / relay break | Geographic blind spots; degraded input density | Confidence estimates flag low-coverage regions |
| Behavioral fingerprinting | Signature spoofing | False-positive candidates; bad recruits enter system | Field verification mismatch |
| Field agents | Agent compromise / absent | Profiles lack context verification; deployment quality degrades | Operational failures of recruited personnel |
| Ingestion pipeline | Data loss under load spike | Prediction gap during peak threat activity — worst possible time | Volume monitoring; buffer overflow alerts |
| Ingestion pipeline | Data integrity failure | Corrupt input → confident wrong prediction | Integrity check at endpoint |
| Boundary layer | Anchor failure | Data bleeds into reality; personnel perception disorders; objects materialize | Physical environment anomalies; personnel reports |
| Core engine | Historical library gap | Novel threat configurations produce low-confidence / wrong predictions | Confidence score below threshold → escalate to simulation |
| Simulation environment | Resource overconsumption | System near-crash; prediction capacity collapses during scenario run | Resource monitor; automatic budget cap enforcement |
| Quarantine layer | Missed detection | Corrupted unit propagates; cascade failure possible | Downstream computation anomalies |
| Failure state accumulator | Unbounded growth | Accumulator threatens system from within at scale | No current detection mechanism — outstanding problem |
| Conscious core | System absorption attempt | Qualitative signal lost; system becomes cold quantitative engine | Defense protocol triggers; human intervention required |
| Defense protocol | Inverted purpose | System destroys what it protects in order to protect itself | Requires administrator-level intervention to break |
| Human oversight | Administrator absent | Alignment loop breaks; drift accumulates uncorrected indefinitely | Terminal behavioral deviation; qualitative drift in outputs |