Docs
Three-Layer Architecture
The congregate has three layers. Each item identifies the Chio crate that implements it.
Implementation status
The three layers
Two things to notice
- Participant kernel. This is a separate runtime. Different domains can use different implementations.
- Coordination discipline. This is a set of rules a participant kernel follows. It is not a separate deployable service.
Roles, cross-domain
Eight archetypes that recur across domains. A finance-domain participant might call its Sensor an “Oracle”; a cybersec participant uses domain-specific names. Capability scopes and governance authority are domain-independent. The last column points to the closest Chio implementation today, where one exists.
| Archetype | Function | Authority | Example crate / module |
|---|---|---|---|
| Sensor | Ingests signals, deposits pheromones | Read + deposit, no execution | chio-pheromone (shipped crate; PheromoneSubstrate trait and bilateral gossip using the chio-federation::revocation_gossip pattern) |
| Investigator | Follows leads, reconstructs lineage | Read + query, can flag | chio-lineage (provenance DAG traversal) |
| Correlator | Joins signals into incidents | Read + publish, advisory | chio-workflow (multi-step plan as one workflow record) |
| Responder | Executes approved actions | Write under capability lease | chio-federation::bilateral (joint commit at action time) |
| Governance | Issues receipts, manages quorum | Governance, no direct execution | chio-governance (dispute / freeze / sanction / appeal) |
| Evolver | Drift-driven mutation + canary | Proposal authority | chio-wasm-guards (hot_reload engine; canary corpus + post-swap rollback watchdog) |
| Memory | Durable knowledge graph | Append-only knowledge | chio-revocation-oracle (sparse-Merkle epoch roots; passport bridge for revocation lineage) |
| Adversarial | Adversary deployment + fitness | Sandboxed only | chio-arena (coevolve, leaderboard; replayable fitness exported as reputation factor) |
How decisions get made
Routine cross-org coordination (Observation mode). A local Sensor signs a pheromone deposit. Federation gossip sends it under treaty scope, and the peer concentration calculation weights it by peer reputation.
Joint destructive action (Receipt-backed mode). Both kernels independently evaluate the request and sign the same canonical body via bilateral co-signing. A workflow receipt captures the full joint multi-step plan.
Cross-org task allocation (Market mode). A participant publishes a BidRequest. Each responding peer mints a scoped capability token and returns it in its AskResponse. The requester signs an AcceptedBid against a signature-verified funds-reservation receipt, which binds the previously minted token.
Compromised peer expulsion (Sanction case + revocation gossip). A governance Sanction case is filed with named evidence. On enforcement, the passport revocation bridge flips the peer’s state and revocation gossip propagates pairwise.