Three-Layer Architecture
The congregate has three layers. Each cites the Chio primitive that already implements it (or, for the gating specs, names the missing piece).
Forward-looking concept
The three layers
Two things to notice
- The middle layer is not part of Chio. It is a separate runtime. Different domains can pick different shapes.
- The top layer is not a deployment. It is a set of disciplines a participant kernel agrees to honour. Joining is implicit in honouring them, not in installing anything.
Roles, cross-domain
Eight archetypes that recur across domains. A finance-domain participant might call its Sensor an “Oracle”; a cybersec participant uses domain-specific names. Capability scopes and governance authority are domain-independent. The last column points to the closest Chio implementation today, where one exists.
| Archetype | Function | Authority | Example crate / module |
|---|---|---|---|
| Sensor | Ingests signals, deposits pheromones | Read + deposit, no execution | chio-pheromone (gating spec; substrate trait + bilateral gossip via chio-federation::revocation_gossip pattern) |
| Investigator | Follows leads, reconstructs lineage | Read + query, can flag | chio-lineage (provenance DAG traversal) |
| Correlator | Joins signals into incidents | Read + publish, advisory | chio-workflow (multi-step plan as a single artefact) |
| Responder | Executes approved actions | Write under capability lease | chio-federation::bilateral (joint commit at action time) |
| Governance | Issues receipts, manages quorum | Governance, no direct execution | chio-governance (dispute / freeze / sanction / appeal) |
| Evolver | Drift-driven mutation + canary | Proposal authority | chio-open-market (BidRequest → AskResponse → AcceptedBid) |
| Memory | Durable knowledge graph | Append-only knowledge | chio-revocation-oracle (sparse-Merkle epoch roots; passport bridge for revocation lineage) |
| Adversarial | Adversary deployment + fitness | Sandboxed only | chio-arena (coevolve, leaderboard; replayable fitness exported as reputation factor) |
How decisions get made
Routine cross-org coordination (Observation mode). Local Sensor signs a pheromone deposit, federation gossip pushes it under treaty scope, peer concentration calculation weights by peer reputation. No co-signing required.
Joint destructive action (Receipt-backed mode). Both kernels independently evaluate the request and sign the same canonical body via bilateral co-signing. A workflow receipt captures the full joint multi-step plan.
Cross-org task allocation (Market mode). A participant publishes a BidRequest. Peers respond with AskResponses. The requester signs an AcceptedBid, which mints a scoped capability for the awarded peer.
Compromised peer expulsion (Sanction case + revocation gossip). A governance Sanction case is filed with named evidence. On enforcement, the passport revocation bridge flips the peer’s state and revocation gossip propagates pairwise.