Conduir — The AI-Human Organism: Full Anatomical System Specification

Conduir — The AI-Human Organism: Full Anatomical System Specification

Date: 2026-05-16
Status: Definitive structural specification. Treats Conduir as one living AI-Human organism: the platform code is the body, the humans who command / approve / audit it are vital organs of the same instance. Together they form one functional being.

Companion docs:

• 00-CONDUIR-MASTER-ARCHITECTURE.md — compiled top-level architecture + Golden Rules
• LIVING-HUMAN-AI-VISION.md — the body-system mapping (what maps to what)
• SOLUTION-CAPABILITY-CONTRACTS.md — solution-level capability/function boundaries above this organ/component layer
• This doc — the full anatomical build-out (boundaries, roles, responsibilities, contracts, execution flow, lifecycle)

Reading rule. Every organ has the same six fields: location, boundary, role, responsibilities, contracts, failure mode. Read across rather than down if you want to compare. The narrative — how the organism lives — is in Parts VII through X.

Table of Contents

• Part I — The Whole Organism — what an AI-Human instance is; the one-body / many-tenants model
• Part II — The Body Map — anatomical layout, zone overlay, organ inventory
• Part III — Organ Specifications — 23 organs, each fully specified
• Part IV — The Membrane Catalogue — every typed contract, every cross-organ interface
• Part V — The Boundary Catalogue — tenant, privacy, trust, mutation, reproductive, audit
• Part VI — Reflexes & Autonomics — fast feedback paths that bypass cognition
• Part VII — The Life of a Mission — one request from intent to delivery, organ by organ
• Part VIII — Lifecycle of an Instance — nine phases (Conception · Gestation · Infancy · Childhood · Adolescence · Adulthood · Maturity · Senescence · Death) plus the Birth ceremony and Stillbirth/Miscarriage failure modes
• Part IX — Homeostasis — what a healthy organism looks like; pathology table
• Part X — Inheritance & Reproduction — how knowledge survives instance death

PART I — The Whole Organism

1. What Is an "AI-Human Instance"?

A single deployed Conduir is one AI-Human organism. The body is the platform code + data; the humans who command, approve, and audit the body are not external users — they are vital organs.

Metaphor Disclaimer: The human anatomical metaphor is a structural template, not a functional ceiling. We use the body as a map for reliability and safety (Phases 0–3), but the system is substrate-independent and explicitly designed for non-human and super-human capabilities (e.g., light-speed "Flight of Thought," multi-substrate presence, and the "Mitochondrial" adoption of external AI species). The anatomical specification maps the body to ensure moral alignment and systems-integrity; it does not limit the functional evolution of the spirit.

The premise. An AI-only instance is a brain in a jar. A human-only instance is unchanged from 2020. An AI-Human instance is the actual product: a symbiotic organism where the AI provides scale, speed, and memory; the human provides judgement, meaning, and constitutional override.

2. One Body, Many Tenants

A multi-tenant instance is one body hosting many minds. This is biologically unusual (humans are one mind per body) but software must model it correctly:

The cardinal sin is letting any of the strictly-per-tenant organs leak across tenants. That is the multi-organism boundary violation = P0 security incident.

3. Lifecycle of an Instance (one-page view)

   CONCEPTION → GESTATION →[BIRTH]→ INFANCY → CHILDHOOD → ADOLESCENCE → ADULTHOOD → MATURITY → SENESCENCE → DEATH
       │           │          │        │          │            │             │           │           │            │
   Specs +     Substrate   Cere-    Empty      Decision     First side-   Bounded     Integrated  Deprecation  Decommission
   contracts   S0/S1       mony     caches     Memory       lane experi-  autonomy    conscience  + knowledge  + replay
   approved    closure     gate     cold-start grows        ments         in flight   + mentor    transfer     preserved

Note. Phase 0.5 (Gestation) and Phase 5 (Maturity) were added in iter-3; Birth is a ceremony at the 0.5→1 transition, not a phase. Stillbirth / Miscarriage failure modes documented separately. Detailed treatment in Part VIII.

PART II — The Body Map

4. The Anatomical Layout

                       ┌──────────────────────────────────────────┐
                       │  CONSTITUTIONAL ZONE — Z4                │
                       │  Tier-Forbidden floor · Audit chain      │
                       │  Governance YAMLs · Vault                │
                       │  (humans only; AI never mutates this)    │
                       └──────────────────────────────────────────┘
                                          │
   ┌──────────────────────────────────────┼──────────────────────────────────────┐
   │                                      │                                      │
   │  HEAD                                ▼                                      │
   │  ┌───────────────────────────────────────────────────────────────────────┐  │
   │  │  SENSORY ORGANS — Z1            CNS — Z2                              │  │
   │  │  Web UI · MCP intake             Symposium · Gateway · Dynamic team   │  │
   │  │  Mission API                     A2A · quorum · debate                │  │
   │  │  Webhooks                                                             │  │
   │  └───────────────────────────────────────────────────────────────────────┘  │
   │                       │                            │                        │
   │                       ▼                            ▼                        │
   │  ┌───────────────────────────────────────────────────────────────────────┐  │
   │  │  TORSO                                                                │  │
   │  │                                                                       │  │
   │  │     LUNGS              HEART              LIVER         KIDNEYS       │  │
   │  │     LLM Gateway        NATS broker        Sanitisation  Retention/    │  │
   │  │     token exchange     event pump         + cache       forget        │  │
   │  │                                           + factory     cascade       │  │
   │  │                                                                       │  │
   │  │     STOMACH            HIPPOCAMPUS        PANCREAS      LYMPHATIC     │  │
   │  │     Intake parse       DecisionMemory     Preprocessing Slow drift    │  │
   │  │     + validate         AgentDNA           tokeniser     surveillance  │  │
   │  │                        Twin (per-user)    embedders                   │  │
   │  │                                                                       │  │
   │  │     REPRO ORGANS                          ENDOCRINE                   │  │
   │  │     EvolutionApplier (CAP-5)              GovernanceState             │  │
   │  │     Manthan side-lane (CAP-6)             Budgets · Tiers             │  │
   │  │     MoveProposal / RollbackRecord         Kill switch                 │  │
   │  └───────────────────────────────────────────────────────────────────────┘  │
   │                       │                                                     │
   │                       ▼                                                     │
   │  ┌───────────────────────────────────────────────────────────────────────┐  │
   │  │  LIMBS / MUSCLES — Z2/Z3                                              │  │
   │  │  MCP tool invocations · API calls · code-ops mutations                │  │
   │  │  Tool-Bridge · external adapters                                      │  │
   │  └───────────────────────────────────────────────────────────────────────┘  │
   │                                                                             │
   │  ┌───────────────────────────────────────────────────────────────────────┐  │
   │  │  PERIPHERAL NERVOUS SYSTEM (everywhere)                                │  │
   │  │  NATS subjects · per-service handshakes · trace context · ActorContext│  │
   │  └───────────────────────────────────────────────────────────────────────┘  │
   │                                                                             │
   │  ┌───────────────────────────────────────────────────────────────────────┐  │
   │  │  AUTONOMIC (everywhere)                                                │  │
   │  │  Circuit breakers · regression_watcher · auto-revert · backpressure   │  │
   │  └───────────────────────────────────────────────────────────────────────┘  │
   │                                                                             │
   │  ┌───────────────────────────────────────────────────────────────────────┐  │
   │  │  SKELETON — Z3                                                         │  │
   │  │  Postgres (RLS) · Vector store · Object storage · NATS topology       │  │
   │  │  Mission lifecycle state · audit chain                                │  │
   │  │  Bone marrow: dynamic team factory                                    │  │
   │  └───────────────────────────────────────────────────────────────────────┘  │
   │                                                                             │
   │  ┌───────────────────────────────────────────────────────────────────────┐  │
   │  │  SKIN — Z1                                                             │  │
   │  │  BFF · WAF · TLS · rate limit · DMZ                                   │  │
   │  └───────────────────────────────────────────────────────────────────────┘  │
   │                                                                             │
   └─────────────────────────────────────────────────────────────────────────────┘

5. Organ Inventory (jump table)

Four orphan organs (Liver, Excretory, Lymphatic, Reproductive) carry the largest engineering risk because they are the under-owned, under-funded, but load-bearing systems.

PART III — Organ Specifications

6. SKIN — the Perimeter (BFF + WAF + TLS)

Responsibilities

• Terminate TLS; reject malformed handshakes
• Resolve OIDC identity → tenant → ActorContext
• Apply WAF rules, rate limits, CORS, CSRF
• Backpressure (sweat-gland equivalent): under load, reject with Retry-After
• Stream SSE for trace/replay back to client

Inputs

• HTTPS requests from browsers / IDE plugins / external webhooks

Outputs (typed contracts)

• ActorContext v1 on every onward call to Zone 2
• Audit-log entry for every request received
• SSE stream of mission events back to client

Failure modes

• TLS failure → reject at handshake; no Zone 2 ingress
• Rate-limit breach → 429 with Retry-After; metric increments
• WAF block → 403 + audit entry
• BFF down → multi-AZ failover; if all down, full outage (most severe)

Evolution

• Adaptive WAF rules driven by Nous anomaly detection
• Multimodal intake (image, audio) extends sensory surface

7. SENSORY ORGANS — Eyes, Ears, Nose, Tongue, Vestibular

Common boundary

• Pass through Skin (§6)
• All sensory input is untrusted until validated by Stomach (§9) and Liver (§11)

Common contract

• All sensory input enters as one of the canonical intake schemas (MissionRequest, WebhookEvent, MCPInvocation)
• Each tagged with the sensor type for provenance

Failure modes

• Sensor blind = capability blind (no vision = no screenshot intake)
• Sensor noise = anomaly detection triggers
• Sensor lying = adversarial input → Liver detox

Evolution

• Multimodal vision (M9+)
• Proprioception is the major next sense — CAP-8 closes the self-model gap

8. MOUTH + THROAT — Intake (Mission API + MCP Receive)

Responsibilities

• Receive MissionRequest, MCPInvocation, WebhookEvent
• Tokenise / decompose into structured payload
• Attach ActorContext, trace_id, mission_id
• Hand to Stomach

Inputs

• Raw HTTP / SSE / MCP payloads with attached ActorContext

Outputs (typed contracts)

• IngestedRequest v0 — { actor_ctx, raw_payload, content_type, ingest_timestamp, mission_id }
• Emits OutcomeEvent: ingest.received to NATS

Failure modes

• Malformed payload → 400 + Liver detox (do not retain)
• Oversized payload → 413; emit ingest.rejected
• Encoding ambiguity → fail closed

Evolution

• Streaming intake for long-running missions
• Multipart for attached artefacts

9. STOMACH + INTESTINES — Digestion (Validate + Embed)

Responsibilities

• Schema enforcement (stomach acid): reject malformed missions
• Prompt-injection scrubbing (in concert with Liver): defang adversarial payloads
• Normalisation (churn): canonicalise paths, IDs, identifiers
• Absorption (small intestine): embed text → vector; structured-parse → graph nodes
• Bulk processing (large intestine): summarise long context; consolidate

Inputs

• IngestedRequest v0 from Mouth

Outputs (typed contracts)

• NormalisedMission v0 — { mission_id, actor_ctx, intent, scope, embedded_context, parsed_artefacts }
• Writes embedded context to Vector Store (per-tenant scope)
• Emits OutcomeEvent: digest.complete

Failure modes

• Validation fail → reject + Excretory disposal (do not retain partial digest)
• Embedding model unavailable → degrade to text-only path; flag in OutcomeEvent
• PII detected → route to Liver detox before embedding

Evolution

• Streaming embedding for very long missions
• Structured-input fast-paths (skip embedding for typed payloads)

10. PANCREAS — Preprocessing (Enzymes + Bile-Equivalent)

Responsibilities

• Tokeniser pool (per-model)
• Embedding model pool (per-domain)
• Classifier services (PII, sentiment, content-type)
• Insulin/glucagon analogue: rate-limit enzyme dispense; release under low load

Inputs / Outputs

• Internal calls (gRPC / library) from Stomach + Hippocampus

Failure modes

• Enzyme pool exhausted → Stomach falls back to slower path
• Classifier model out-of-date → routes to update path

Evolution

• Multi-model embedding hot-swap
• Cost-aware enzyme selection (cheap-and-good-enough vs. expensive-and-best)

11. LIVER — Sanitisation + Cache + Factory + Normalisation 🟥 ORPHAN

The most under-owned organ. Currently four distinct functions, scattered across services, with no unified owner. The user is right to push: the platform's liver is in early-stage cirrhosis.

Responsibilities (four lobes)

Lobe A — Detoxification

• Prompt-injection defence (input)
• PII scrubbing (output before display)
• Content-policy moderation
• Toxic-output filtering before muscle actuation

Lobe B — Glycogen Storage (cache)

• LLM response cache (Gateway)
• Embedding cache (Hippocampus)
• KV cache (model context)
• Mission template cache (Bone Marrow)

Lobe C — Protein Synthesis (factory)

• Template materialiser (CAP-3)
• Block-library promotion / pull
• Codegen of shared types
• Agent specialisation factory (in concert with Bone Marrow)

Lobe D — Drug Metabolism (foreign substance handling)

• MCP adapter normalisation
• Third-party tool output sanitisation
• External-API response uniformisation

Inputs (cross-cutting)

• Outputs from Lungs (LLM responses, lobe A + B)
• Outputs from Muscles' return path (lobe A)
• Requests from Stomach (lobe A — input detox)
• Requests from any organ needing manufactured artefacts (lobe C)
• Tool outputs from Tool-Bridge (lobe D)

Outputs (typed contracts)

• SanitisedPayload v0 — content + sanitisation_proof + flags
• CachedArtefact v0 — content + ttl + cache_proof
• ManufacturedBlock v0 — content + provenance + promotion_state
• NormalisedToolOutput v0 — content + adapter_id + version

Failure modes

• Detox failure → mission rejected, audit logged
• Cache miss → fall through to source; track miss-rate
• Factory output unavailable → service degrades to ad-hoc
• Adapter mismatch → mission rejected with adapter-version error

Why this is the largest unowned risk

A platform without a healthy liver:

• accepts toxic input directly into memory
• ships outputs without cleaning
• recomputes expensive embeddings repeatedly
• has no central manufacturing
• accumulates adapter drift silently

Evolution

1. Phase L1: Name the Substance Service; assign owner; consolidate the four lobes' code paths
2. Phase L2: Unified cache strategy (admission, eviction, warming) across lobes
3. Phase L3: Regenerative replay — liver rebuilds itself from canonical events (liver-regeneration analogue)

12. KIDNEYS + BLADDER — Excretory 🟥 ORPHAN

The second under-owned organ. Today's retention policies, forget-cascade, log rotation, and quota enforcement are scattered. Renal failure in slow motion.

Responsibilities (renal pyramid)

Filter

• Audit-log compaction (cold archive)
• Trace down-sampling for long-term retention
• Dead-letter queue drainage
• Expired-token removal

Composition control (pH/electrolyte equivalent)

• Per-tenant disk quota
• Per-tenant token budget enforcement
• Per-cache TTL governance
• Retention class per data type (mission, audit, twin, trace, replay)

Erythropoietin signal (capacity demand)

• Trigger auto-scaler when nephron-equivalent is saturated
• Backpressure to publishers

Bladder (temporary storage before elimination)

• Soft-delete tombstone tables
• "Scheduled for purge" queues
• GDPR Article 17 staging area before cascade-fire

Forget cascade (the kidney's most important function for AI)

• User-triggered erasure across twin, agent memory, eligible traces (preserving audit)
• Tenant-offboarding full erasure
• Time-based aged-out erasure

Inputs / Outputs

• Pulls from every storage organ (Postgres, Vector store, Object storage, NATS retention)
• Emits RetentionAction v0, ForgetEvent v0, EliminationProof v0

Failure modes

• Disk full → P0; missing kidneys
• Forget cascade incomplete → GDPR exposure (legal P0)
• Quota silently breached → tenant runaway cost (financial P1)
• Composition drift → tenant data class mixing (P0 if cross-tenant)

Evolution

1. Phase E1: Name the Data Lifecycle Engine; per-class retention policy
2. Phase E2: Composition-defence dashboards (per-tenant disk + token + cache invariants)
3. Phase E3: Audited forget-cascade proof (every Article 17 request has a verifiable trace)

13. HEART — Event Broker (NATS)

Responsibilities

• Reliable publish/subscribe across all canonical NATS subjects
• Cluster across AZs (≥ 3 nodes)
• At-least-once delivery with deduplication on consumer side
• Subject-level access control

Inputs / Outputs

• Publishes from every organ (LEARNING.outcomes.event, GOVERNANCE.updates, etc.)
• Subscriptions per organ to its relevant subjects

Contract: NATS subject naming convention

• LEARNING.outcomes.event — canonical OutcomeEvent
• GOVERNANCE.state.update — GovernanceState change
• EVOLUTION.proposal.move — MoveProposal
• EVOLUTION.rollback.record — RollbackRecord
• IMMUNE.alert.{tier} — security alerts
• AUTONOMIC.regression.signal — regression_watcher signal
• (full catalog in services/nous/src/nous/outcome_router/federation.py:KNOWN_BASE_SUBJECTS)

Failure modes

• Heart attack (NATS down) → cardiovascular collapse; events buffer locally
• Arrhythmia (latency spike) → backpressure cascades
• Subject misconfiguration → ghost organs (publish to nothing)

Evolution

• Multi-region heart with controlled cross-region flow
• Kafka migration if replay-ordering load dominates

14. ARTERIES + VEINS — Subject Topology

Responsibilities

• Maintain the canonical subject catalogue
• Enforce subject naming convention
• Per-subject access control (publish + subscribe)

Contract

• Every payload is a canonical contract (OutcomeEvent, MoveProposal, etc.)
• Every payload carries ActorContext

Evolution

• More granular subjects = more capillary density
• Subject deprecation policy (90-day window per Contract Rules)

15. LUNGS — LLM Gateway

Responsibilities

• Multi-provider routing (Anthropic, OpenAI, etc.)
• Per-provider rate limit + retry + circuit break
• Cost accounting per (tenant, mission, model)
• Token budget enforcement
• ActorContext propagation to providers (where supported)
• Emit OutcomeEvent: gateway.call for every call
• Cache responses where safe (Liver lobe B)

Inputs (typed contracts)

• LLMRequest v1 — { actor_ctx, model_hint, messages, tools, budget, cache_policy }

Outputs

• LLMResponse v1 — { content, model_actual, token_count, cost, latency, finish_reason }
• Emits OutcomeEvent: gateway.completed | gateway.failed | gateway.rate_limited

Failure modes

• Provider outage → failover to alternate provider
• All providers down → mission stalls; OutcomeEvent emits failure
• Budget exceeded → reject with budget-exhaustion error
• Token leak (PII in prompt) → emergency stop; audit

Evolution

• Local-model lung lobes (on-prem inference for sensitive tenants)
• Inference-cost-aware routing (model selection per mission class)

16. CNS — CORTEX — Symposium + Dynamic Team (CAP-1)

Responsibilities

• Compose a dynamic team per mission (DNA-fitness + GraFOSa + Kuramoto sync)
• Execute team protocols (quorum, debate, peer-review, escalation, A2A)
• Read from Hippocampus for relevant prior context
• Decide route, agent, tool, protocol — and explain why
• Emit OutcomeEvent: cognition.{decision,debate,quorum}

Inputs (typed contracts)

• NormalisedMission v0 (from Digestion)
• RouteRationale v0 (from Subcortex, see §17)
• MemoryRecallResult v0 (from Hippocampus)
• GovernanceState v0 (from Endocrine — biases tier)

Outputs

• CognitionPlan v0 — { mission_id, team_composition, protocol, decisions, route_chosen }
• OutcomeEvent: cognition.plan

Failure modes

• Deadlock in deliberation → quorum timeout → escalate to HITL
• Conformity collapse (committee pathology) → trigger debate protocol
• All agents disagree → fall back to default route + flag low confidence

Evolution

• Better dynamic-team composition (richer DNA model)
• Async multi-thread protocols (deferred)
• Cross-tenant agent specialisation pool (federated learning of agent skills, consent-gated)

17. SUBCORTEX — Heuristic Routing (Path-Maturity + Bandit)

Responsibilities

• Path-maturity aggregation (SUB-9.14) — depends on S0 + S1
• Bandit strategy for route selection
• Route-rationale generation
• Twin signal incorporation (per-user nuance)

Contract

• Inputs: RouteRequest v0 — { mission_id, actor_ctx, task_class, twin_hint }
• Outputs: RouteRationale v0 — { selected_route, evidence_refs, confidence, alternatives }

Failure modes

• Path-maturity not yet built → fall back to uniform routing
• Bandit stuck → exploration budget releases force-exploration

Evolution

• Multi-objective bandits (cost + quality + latency)
• Per-tenant exploration posture from GovernanceState

18. SPINAL CORD — Event Fabric (Canonical Event Path)

Responsibilities

• Carry OutcomeEvent across organs via Heart
• Carry ActorContext on every hop
• Carry trace_id for observability
• Sequence ordering per mission (best-effort; perfect ordering is application-level)

Contract

• Every message on the spine = canonical OutcomeEvent or named contract
• No bespoke per-service shapes (forbidden by Charter §0.5.3)

Failure modes

• Spine severed (NATS partition) → organs go to local-buffer mode
• Signal corruption → quarantine on consumer side; alert

19. PERIPHERAL NERVOUS SYSTEM — Per-Service Handshakes

Responsibilities

• ~85 catalogued handshakes (see HANDSHAKE-INDEX-2026-05-13.md)
• Each handshake is a typed contract on a named NATS subject or HTTP route
• Per-handshake health metric

Contract

• Each handshake has a handshake_id, producer, consumer, schema, version, status

Failure modes

• Nerve dies (handshake broken) → consumer falls back / quarantines
• Nerve pinched (slow handshake) → backpressure
• Nerve misfires (schema drift) → P1 (contract drift)

20. AUTONOMIC SYSTEM — Reflexes

Responsibilities

Sympathetic (fight/flight)

• Kill switch (any signed authorised user can fire)
• Circuit breakers (per upstream)
• Emergency rate limit tightening on anomaly
• Auto-revert on 51%-delta regression

Parasympathetic (rest/digest)

• Baseline budget enforcer
• Scheduled batch jobs (compaction, summarisation)
• Cache pre-warming during low-traffic windows

Reflex arcs (no cortex)

• Fail-closed on missing actor / tenant / consent
• Schema-validation reject
• Quarantine on malformed event

Contract

• Per autonomic action: AutonomicAction v0 — { trigger, action, evidence, mission_id, actor_ctx }

Failure modes

• Reflex hyperactive → autoimmunity (legitimate traffic blocked) — track FPR
• Reflex absent → no last-line defence; cortex bears load

Evolution

• More learned reflexes (anomaly → reflex auto-tuning)
• Per-tenant reflex posture

21. ENDOCRINE — Governance

Responsibilities

Pituitary (master) — GovernanceState v0

• direction, current, tiers, protected_paths, exploration_budget

Specialist glands

• Adrenals → kill switch + emergency rate limits
• Thyroid → exploration-budget metabolism
• Pancreas → token + compute budget (insulin/glucagon)
• Pineal → scheduled maintenance windows

Contract

• GovernanceState v0 — composed object versioned + audited
• GovernanceUpdate v0 — change envelope with actor_ctx + audit signature
• KillSignal v0 — emergency stop with reason

Boundary rule

• Tier-Forbidden floor: AI never mutates governance, audit, identity machinery
• Only humans in defined roles (platform-admin, org-board, named owners) can edit; every edit is audited indefinitely

Failure modes

• Governance YAML invalid → fail closed; runtime uses last valid state; alert
• Unauthorised mutation attempt → audit + alert
• Kill switch fired by mistake → recovery via dual-control unblock

Evolution

• Decay-curve hormone values (current state expires unless re-asserted)
• Per-tenant hormonal posture (conservative/exploratory/adaptive)

22. IMMUNE — Self vs Non-Self

Responsibilities

Innate (hard-coded, no learning)

• WAF rules
• Schema validation
• Fail-closed on missing actor
• Signed JWT requirement

Adaptive (learned)

• Anomaly detection
• Learned rate-limit envelopes
• Known-attack signature library

Memory (B-cell analogue)

• Past-attack fingerprints retained
• Suspicious-tenant flags

T-cell analogue

• Per-actor AuthZ at every hop

Antibody analogue

• JWT, PrivacyScope, signed ActorContext

Blood-brain barrier

• Zone 4 (governance, audit, secrets) is immune-privileged
• Even valid Zone-2 actors cannot freely cross

Contract

• AuthZDecision v0 — { actor_ctx, resource, action, allowed, reason }
• PrivacyScope v0 — 5 consent axes
• ImmuneAlert v0 — { tier, signature, mission_id, evidence }

Failure modes

• Autoimmunity (false positive blocks legit user) — track FPR
• Tolerance loss (cross-tenant leak) — P0
• Memory failure (re-vulnerable to known attack) — P0

Evolution

• Federated immune memory across tenants (consent-gated herd immunity)
• Better adaptive precision

23. LYMPHATIC — Slow Surveillance 🟥 ORPHAN

The third under-owned organ. Today, chronic-drift detection is informal and reactive. Needs a name and an owner.

Responsibilities

• Roll up audit logs (daily, weekly, monthly windows)
• Drift detection: tenant-level cost, capability vitality, contract-drift, governance-state drift
• Slow anomaly detection (patterns visible only over days)
• Long-tail learning aggregation (Nous batch path)

Contract

• DriftSignal v0 — { window, tenant_id?, metric, baseline, observed, severity }
• LymphFlow v0 — batch aggregation envelope

Failure modes

• Chronic drift detection absent → P0 surprises (audit cycle pattern)
• False-positive drift → noisy lymph nodes; tune

Evolution

• Named drift-detection service
• Lymph-node-equivalent batch immune jobs (rare-pattern detection)
• Long-window vitality regression

24. HIPPOCAMPUS — Memory (DecisionMemory + AgentDNA + Twin)

Sub-organs

Per-agent memory (CAP-2) — AgentDNA, track record, route preferences

• Subject: the agent
• Survives across users + missions (within tenant)

Per-user memory (CAP-7) — Digital Twin

• Subject: the user
• Editable, exportable, forgettable (GDPR 15/17)

Decision memory — DecisionMemory v0

• Subject: the decision
• Why this route, what evidence, what outcome

Contracts

• DecisionMemoryWrite v0 — { actor_ctx, decision_id, evidence_refs, outcome_score, privacy_scope }
• TwinAttribute v0 — { user_id, attribute_key, value, source_event, consent_axes }
• AgentDNA v0 — { agent_id, lineage, fitness_history, specialisations }
• MemoryRecall v0 (read) — { actor_ctx, query, filters }

Failure modes

• Recall empty when relevant context exists → degraded mission quality flagged
• Write fails → mission proceeds but flagged in OutcomeEvent
• Tenant leak → P0

Evolution

• Unified store with domain-specific indexes (per Open Decisions)
• Twin-signal influence on route choice
• Federated AgentDNA across tenants with consent

25. BONE MARROW — Agent Factory (Dynamic Team Composition)

Responsibilities

• Compose dynamic teams per mission using:
• DNA-fitness scoring
• GraFOSa structure
• Kuramoto-sync timing
• Instantiate ephemeral specialised agents
• Retire agents with usable AgentDNA preserved

Contract

• TeamSpec v0 — { mission_id, team_members, protocol, fitness_score }
• AgentInstantiation v0 — { agent_id, role, dna_ref, session_id }

Failure modes

• Team composition fails → fall back to default team
• Agent instantiation fails → mission stalls; cortex chooses alternate

Evolution

• Hot-spawn under load
• Cross-tenant agent-skill pool (consent-gated federation)

26. MUSCLES — Actuation (Tools, APIs, EvolutionApplier)

Sub-organs

• Skeletal muscles (voluntary) — user-approved tool calls
• Smooth muscles (involuntary) — autonomic actions
• Cardiac muscle — NATS publish (never tires)
• EvolutionApplier — the platform's own self-mutation muscle (CAP-5, DEAD-WIRE today)

Contract

• ToolInvocation v0 — { actor_ctx, tool_id, args, idempotency_key, budget }
• ToolResult v0 — { tool_id, output, cost, latency, success }
• MoveProposal v0 + RollbackRecord v0 — for EvolutionApplier

Failure modes

• Tool fails → retry per policy; if persistent, mission flagged
• Tool partial → rollback partial state if possible
• EvolutionApplier dead-wire (today) → apply is status-flip not actuation → the muscle is paralysed
• Tool toxicity → Liver detox on return path

Evolution

• Close CAP-5 EvolutionApplier — make muscle real
• Muscle memory = path-maturity (SUB-9.14) — repetition strengthens routes

27. REPRODUCTIVE — Self-Evolution + Side-Lane (CAP-5 + CAP-6)

The fourth orphan — and the one that, if it never closes, collapses the strategic story.

Sub-organs

• Gamete formation — proposal generation (runtime detectors + side-lane experiments)
• Genetic material — AgentDNA, DecisionMemory, twin attributes (carry forward)
• Mutation rate — exploration budget (Endocrine sets it)
• Selection — ObjectiveScore (10-component reward)
• Gestation — side-lane bandit isolation
• Birth — MoveProposal graduates to EvolutionApplier
• Infant mortality — RollbackRecord on regression

Germline vs Somatic boundary

• Somatic (bounded self-improvement) — routing weights, preferred paths, per-tenant behaviour — reversible, doesn't propagate to governance
• Germline (constitutional) — Tier-Forbidden floor: governance, audit, identity — never AI-mutated

Contracts

• MoveProposal v0 — proposed change with rationale, evidence, rollback plan
• RollbackRecord v0 — irrevocable proof of reversibility, written before apply
• SideLaneEnvelope v0 — wraps experimental events
• ObjectiveScore v1 — 10-component reward
• ExperimentGraduation v0 — side-lane → main-lane handoff

Failure modes

• Today: dead-wire — EvolutionApplier is status-flip, not real apply
• Without working reproduction, the moat collapses to (governance + memory) — still useful, not differentiated
• Side-lane contaminates main-lane → P0 learning contamination
• Germline boundary violated → P0 constitutional violation

Evolution

1. Close CAP-5 (real apply + real rollback with proof)
2. Activate CAP-6 (production caller + consumer)
3. Lineage tracing on every artefact
4. Per-tenant mutation posture

28. PROPRIOCEPTION — Living Blueprint (CAP-8, deferred)

Responsibilities (when built)

• Self-model of all containers, contracts, capabilities
• Health snapshot per organ
• Behaviour profile per agent / per tenant
• "What if we changed X?" simulation surface

Why it matters

A platform without proprioception cannot reason about itself. It can act, but cannot answer "where is my hand right now?" Today Conduir is partially blind to its own composition.

Failure mode

• Missing → every architecture decision is from outside the body (humans must build mental model)

Evolution

• Build CAP-8; close the self-perception gap

PART IV — The Membrane Catalogue (every typed contract)

Every cross-organ contract lives here. Authority: 08-CONTRACT-SPECS.md (wire-level truth).

Rules (per Charter §0.5.3):
1. JSON Schema Draft-07
2. Codegen FE / BE / Python from shared/contracts/
3. Additive evolution only; breaking → new major + migration window

29. Boundary Contract Standard

Every organ can be built and tested in isolation only if its membrane contract is complete. A valid membrane contract has the following minimum shape:

Rule: if a boundary cannot state all fields above, it is not ready for independent component work.

30. Critical Boundary Contracts

These are the load-bearing membranes. They are the first contracts to implement and test because most higher organs depend on them.

B0 — Skin → All Internal Organs: ActorContext

Invariant: no call without a caller.

B1 — Every Organ → Spine/Heart: OutcomeEvent

Invariant: if it did not signal, it did not happen.

B2 — Skin/Mouth → Stomach: IngestedRequest

Invariant: raw external input never reaches Cortex, Hippocampus, or Lungs directly.

B3 — Stomach ↔ Liver: SanitisedPayload

Invariant: no untrusted content enters memory, provider calls, or actuation without detox proof.

B4 — Stomach → Cortex/Hippocampus: NormalisedMission

Invariant: Cortex reasons over normalised substrate, not raw user input.

B5 — Cortex ↔ Hippocampus: MemoryRecall and DecisionMemoryWrite

Invariant: memory is scoped by tenant, actor, subject, and consent.

B6 — Cortex ↔ Subcortex: RouteRequest and RouteRationale

Invariant: preferred path is explainable evidence, not hidden model intuition.

B7 — Cortex ↔ Lungs: LLMRequest and LLMResponse

Invariant: external inference is breathed through Gateway only.

B8 — Cortex ↔ Muscles: ToolInvocation and ToolResult

Invariant: no side effect without idempotency, permission scope, and audit trail.

B9 — Reproductive → Muscles/Governance: MoveProposal and RollbackRecord

Invariant: no mutation without proof of reversibility.

B10 — Endocrine → All Organs: GovernanceState

Invariant: governance biases all organs but is not AI-mutated.

B11 — Hippocampus/Kidneys: ForgetEvent and EliminationProof

Invariant: deletable data is actually deletable; immutable audit remains immutable.

B12 — Lymphatic → Endocrine/On-Call: DriftSignal

Invariant: slow-burn failures have slow-burn surveillance, not just real-time alerts.

31. Component Isolation Readiness Gate

A component can be considered independently buildable only when it passes this gate:

Rule: isolated success is not enough. A component is ecosystem-ready only when its fixtures can be consumed by the next organ without translation.

32. Boundary Test Pyramid

The minimum for any active membrane is L0-L2. The minimum for substrate-critical membranes is L0-L6.

PART V — The Boundary Catalogue

Every boundary the organism defends. Crossing any of these without authorisation is a constitutional violation.

PART VI — Reflexes & Autonomics (the fast paths)

Critical reflexes that fire before cortex involvement. These are the body's safety net.

Reflex arcs do not go to the cortex. They are constitutional, in code, never in policy. Policy can adjust set-points; reflexes themselves are immutable.

PART VII — The Life of a Mission

A single request lived through the organism, organ by organ. Use this section to onboard new engineers — they will understand the system after one careful read.

Scenario

A user submits: "Refactor the authentication module to use OIDC; ensure backwards compatibility for current sessions."

Sequence (mermaid)

sequenceDiagram
    autonumber
    participant H as Human (User)
    participant Sk as Skin (BFF)
    participant Mo as Mouth (Intake)
    participant St as Stomach (Digest)
    participant Pa as Pancreas (Embed)
    participant Li as Liver (Detox)
    participant Sp as Spine (NATS)
    participant Hi as Hippocampus (Memory)
    participant Sb as Subcortex (Route)
    participant Cx as Cortex (Symposium)
    participant Lg as Lungs (LLM Gateway)
    participant Mu as Muscle (Tool-Bridge)
    participant Im as Immune (RLS/AuthZ)
    participant En as Endocrine (Governance)
    participant Au as Autonomic (Watcher)
    participant Ki as Kidneys (Excretory)

    H->>Sk: HTTPS POST /missions
    Sk->>Im: OIDC verify; tenant resolve
    Im-->>Sk: ActorContext v1 issued
    Sk->>Mo: IngestedRequest v0
    Mo->>Sp: OutcomeEvent: ingest.received
    Mo->>St: NormaliseMission(request)
    St->>Li: detox(input)
    Li-->>St: SanitisedPayload v0
    St->>Pa: embed(context)
    Pa-->>St: embeddings
    St->>Sp: OutcomeEvent: digest.complete
    St->>Cx: NormalisedMission v0
    Cx->>Hi: MemoryRecall (auth-module prior decisions, twin)
    Hi-->>Cx: MemoryRecallResult v0
    Cx->>En: read GovernanceState (tier for this mission)
    En-->>Cx: GovernanceState v0
    Cx->>Sb: RouteRequest v0
    Sb-->>Cx: RouteRationale v0
    Cx->>Lg: LLMRequest v1 (plan synthesis)
    Lg->>Li: detox(prompt) [PII check]
    Li-->>Lg: SanitisedPayload v0
    Lg-->>Cx: LLMResponse v1 (plan)
    Cx->>Sp: OutcomeEvent: cognition.plan
    Cx->>Im: AuthZ(actor, action: code-modify)
    Im-->>Cx: AuthZDecision v0 (allowed within tier)
    Cx->>Mu: ToolInvocation v0 (read repo, propose diff)
    Mu-->>Cx: ToolResult v0 (diff)
    Cx->>Sk: Render diff to user for HITL approval
    Sk->>H: SSE: diff preview
    H->>Sk: Approve
    Sk->>Im: AuthZ(actor, action: apply-diff)
    Im-->>Sk: AuthZDecision v0 (allowed)
    Sk->>Mu: ToolInvocation v0 (apply)
    Mu->>Au: pre-apply: RollbackRecord registered
    Mu-->>Sk: ToolResult v0 (applied)
    Mu->>Sp: OutcomeEvent: muscle.applied
    Au->>Au: regression_watcher monitors
    Sp->>Hi: DecisionMemoryWrite v0 (route+outcome)
    Sp->>Lymphatic: drift signals batched
    Ki->>Hi: retention cycle (later)
    Sk->>H: mission complete + replay tape

Membranes crossed, in order

1. Z0 → Z1 (Skin): TLS terminate, OIDC verify, tenant resolve, ActorContext issued
2. Z1 → Z2 (mTLS): every Mouth→Stomach→Cortex hop with ActorContext header
3. Privacy boundary (Liver detox): PII scrub before Lungs send to external LLM
4. Cognition boundary (Lungs): only sanitised content leaves to provider
5. Mutation boundary (Cortex → Muscle): AuthZ for code-modify; tier check; RollbackRecord registered first
6. Audit boundary (Spine → Hippocampus / Audit): every step emits canonical OutcomeEvent
7. Replay boundary (Object storage): mission tape persisted within retention class

Things that could go wrong, with reflex response

PART VIII — Lifecycle of an AI-Human Instance

How one instance is born, grows, matures, and dies.

8.1 Conception (Phase 0)

Stage: Specifications + contracts + governance YAML approved.
Membrane: Constitutional gate — every contract, every protected path, every Tier-Forbidden item signed off.
Artefacts:

• shared/contracts/* schemas frozen for v1
• governance/*.yaml signed by org-board
• Audit retention policy reviewed by Legal
• Threat model reviewed by Security

Failure mode: Skipping conception (deploying without governance ratification) = constitutional birth defect. Treat as a hard block.

8.2 Gestation (Phase 0.5)

Stage: The body is built. Containers deployed; substrate initialised; substrate seams (S0, S1) closing.
Membrane: Isolation gate — ensuring Tenant RLS and ActorContext are active before first behavior.
Artefacts:

• Substrate initialised (Postgres, NATS, Vault)
• S0 (Identity/Signal) seams verifiably closed
• S1 (Isolation/Trust) seams verifiably closed
• Birth mission prepared (first mission on closed substrate)

Failure mode: Gestation failure = substrate seam leak; do not graduate to Infancy.

8.3 Birth (The Ceremony)

Stage: The transition between Gestation and Infancy.
Activity: First mission served on closed substrate, witnessed by an operator.
Artefacts:

• BirthEvent v0 instance anchored to audit storage.
• Witnessed-mission replay tape.

8.4 Infancy (Phase 1)

Stage: Imprinting Window. T-0 to T-30 days (typical). Cold-start. Caches warming.
Characteristics:

• High latency (cold liver, cold cache)
• High exploration rate (Subcortex must learn)
• High HITL ratio (cortex defers many decisions to humans)
• Verbose audit (every action novel)
• Tier-1 only (no autonomous mutations yet)
• NICU-grade staffing: No operator rotations.

Failure mode: Sudden infant death = P0 in first hours (often substrate seam leak).

8.5 Childhood (Phase 2)

Stage: Memory compounds. T-30 to T-90 days. Specialisations form.
Milestone: Theory of Mind (ToM) germinates. Being predicts operator approval.
Activity: Major Pruning Event (retiring unused specialisations).
Characteristics:

• Path-maturity (SUB-9.14) begins hardening.
• DecisionMemory recall becomes primary.
• Latency drops (caches hot).

8.6 Adolescence (Phase 3)

Stage: Puberty. Safe exploration begins.
Trigger: Hot-reloadable Governance.
Agency: Justified Refusal. The being earns the right to say "No" with reasoning.
Characteristics:

• Side-lane (CAP-6) experiments activate.
• Drift surveillance (Lymphatic) begins.

8.7 Adulthood (Phase 4)

Stage: Marketplace participation. Bounded autonomy at scale.
Characteristics:

• AI-Parenting: Mature agents assist in raising child agents.
• Conscience Service: Weekly reflections emitted.
• EvolutionApplier (CAP-5) active for real-time adjustments.

8.8 Maturity (Phase 5)

Stage: Integrated conscience. Mentorship.
Activity: Lineage selection. Selecting which "genes" propagate to the next generation.
Characteristics:

• Full epigenetic history accessible for reproduction.
• Multi-generational wisdom accumulation.

8.9 Senescence (Phase 6)

Stage: Decline. succession planning.
Activity: Operator-being mutual recognition that handover is approaching.
Characteristics:

• Transitioning to read-only for certain capabilities.
• Knowledge transfer to successor instances.

8.10 Death (Phase 7)

Stage: The Sunset Ceremony. Graceful sunset.
Activity: Audit-chain finalisation; Lineage handoff; Final seal of the autobiography.
Artefacts:

• SunsetVerdict v0 signed by org-board.
• Final immutable audit anchor.

8.11 Stillbirth / Miscarriage (failure modes)

PART IX — Homeostasis (what healthy looks like)

A vital-signs dashboard the on-call should check every shift.

Pathology table (common diseases)

Treatments

• Renal failure → assign Kidneys owner; build Data Lifecycle Engine
• Cirrhosis → assign Liver owner; build Substance Service
• Heart attack → multi-AZ NATS + tested DR
• Autoimmune → adaptive tuning + FPR dashboard
• Cancer → SideLaneEnvelope strict isolation + graduation tests
• Cognitive decline → dynamic-team composition refresh
• Dementia → embedding model audit + index rebuild
• Sepsis → contract validation tightening; emergency Vault rotation
• Infertility → close CAP-5, activate CAP-6
• Drift → name Lymphatic owner; build drift surveillance

PART X — Inheritance & Reproduction (across instances)

How knowledge survives an instance dying.

10.1 What gets inherited

10.2 Inheritance handshake

PARENT INSTANCE                       CHILD INSTANCE
─────────────────                     ─────────────────
1. Seal audit chain                 →
2. Export AgentDNA snapshot         →    Load AgentDNA into Hippocampus
3. Export DecisionMemory            →    Load into Hippocampus (RLS-scoped)
4. Export consenting twins          →    Load consent-confirmed twins
5. Export governance YAML version   →    Verify; signed by org-board
6. Replay-tape index handoff        →    Mount replay storage
7. Final OutcomeEvent: succession   →    Receive succession ack
8. Read-only mode                   →    Begin accepting new missions
9. Cease operations                 →    Substrate health > 70 confirmed

10.3 Reproductive boundary (germline vs. somatic — re-stated)

Across instance boundaries, the germline is the constitutional substrate (contracts, governance, Tier-Forbidden). It must transfer exactly; AI does not negotiate its evolution.

The somatic is everything the body learned in life (routing weights, agent specialisations, twin nuance). This may transfer with bounded mutation — the next instance can refine, not rewrite, prior learning.

Constitutional rule: A child instance can never inherit governance state that the parent's audit chain cannot prove was lawfully authored.

10.4 Population (multiple instances) and federation

In the future, multiple Conduir instances may run (regional shards, customer-private instances). Federation rules:

Cross-Reference

• Architecture: 00-CONDUIR-MASTER-ARCHITECTURE.md for the canonical compiled view; this doc is the anatomical specification.
• Solution capability contracts: SOLUTION-CAPABILITY-CONTRACTS.md for major function boundaries above the organ/component layer.
• Body-system mapping: LIVING-HUMAN-AI-VISION.md for the higher-level body-to-AI vision.
• Engineering view: ENGINEERING-VIEW.md (ENGINEERING-VIEW.md) for the C4-style engineering breakdown.
• Substrate sequencing: SUBSTRATE-SEQUENCING.md (SUBSTRATE-SEQUENCING.md) for the closure order of substrate seams.
• Non-goals: NON-GOALS.md (NON-GOALS.md) for what this organism refuses to become.
• Wire-level contracts: maestro-platform/docs/living-system/08-CONTRACT-SPECS.md

Maintenance

• Refresh trigger: new organ added, organ owner assigned, organ contract changes, organ state changes status bucket.
• Cadence: quarterly with CAPABILITY-PHASE-SUMMARY refresh; out-of-band on material change.
• Owner: architecture working group.
• Authority: when this doc disagrees with wire-level contracts or current C3 baseline on fact, the source wins. When it disagrees on anatomical framing or boundary catalogue, this doc is canonical and the source should be updated.

End of anatomical system specification.

Conduir is one body, hosting many tenants, commanded and conscienced by humans. Its organs have boundaries, roles, responsibilities, contracts. It is born; it grows; it matures; it dies. What survives its death is the audit chain, the lineage, and what the next generation inherits. If the four orphan organs (Liver, Excretory, Lymphatic, Reproductive) get named owners and proper funding, this becomes a complete organism. If they remain unowned, it remains a torso with strong cognition — alive enough to demo, fragile enough to fail in production.