Conduir Spatial — 24-Month Evolution Vision (ambitious track)

Conduir Spatial — 24-Month Evolution Vision (ambitious track)

Authored: 2026-06-08 · Method: user-archetype ideation swarm (claude/gemini/codex,
health OK) → synthesis → adversarial stress-test.

## 📍 Implementation status — read before treating any leap as "done" (2026-06-08)

This is a PLAN. The leap descriptions below describe TARGET capability, not current state.

An earlier external review correctly flagged that the prose overstated what exists. The honest

mapping of plan → reality:

| Layer | What actually exists today | vs the leap's target prose |

|---|---|---|

| main | Mutation-safety slices 0–4 + ADR-0003 Phase-1 (chokepoint/grants/audit); collaboration room; physics-review/quorum personas. | The production server-authoritative trust-boundary flip (ADR-0003 Ph 2–4) is NOT done. |

| Leap 1 — feature branch, merge-ready, NOT merged (PR #61) | A metadata-backed product graph (Part/Parameter/Constraint) + a pure constraint validator (no eval). | The leap prose ("Neo4j Assembly/Feature graph with a constraint solver, kernel-backed") is the target; there is no Feature model, no Neo4j product-graph schema, no geometry kernel yet. |

| Leap 2 — branch, merge-ready (PR #62) | Decision objects (model/store/API/SSE/panel). | matches the prose. |

| Leap 4 — branch, in progress (PR #64) | A synchronous, advisory direct-stress stub behind dispatch(), explicitly "NOT FEA". | The leap prose ("real async external solver dispatch / job queue") is the target; current is a stub proxy. |

| Leap 5 — branch, capture-only (PR pending) | Outcome-corpus capture (tenant-scoped SQLite). | The brain's use (retrieval into prompting) is unbuilt — capture only, by design. |

So: "merge-ready on a branch" ≠ "on main." Three things are merge-ready but unmerged;

the Forge/solver depth is still target prose, not shipped. Trust this table + the build trackers

over any "done" phrasing in the leap bodies.

The maturity roadmap (PROJECT-MATURITY-ROADMAP.md) is NOT fully superseded. This vision

supersedes only the Product-Forge sequencing (it un-gates the Forge from "don't begin"). The

roadmap remains authoritative for production hardening + GA gates — auth, tenancy,

observability, backup, secrets, SLOs, load (the Phase-4 work this plan depends on at §"Capacity

reconciliation"). Read both.

Relationship to PROJECT-MATURITY-ROADMAP.md. That document is the *conservative,

de-risked* plan: it ships a "collaboration room" (Phases 0–4) and gates the Product

Forge as a "don't begin" north star. This document is the ambitious counterpart. It does

not discard the maturity roadmap — it consumes Phases 0–4 as the enabling foundation

and then refuses to leave the north star on the shelf. Where the maturity roadmap asks

"what is the smallest fundable thing," this asks "**what does conduir-spatial have to

become** for a product engineer to make it their primary workspace — and is that reachable

from what we already have?" The answer below is: yes, in seven leaps.

1. Think like the user — the pain we evolve toward

Today a hardware/product team lives in a fragmented stack: CAD (SolidWorks/Onshape) +
CAE (Ansys/COMSOL) + PLM (Windchill/Arena) + docs + Slack + Jira +
review calls. The 3D model is the source of truth for geometry only; every decision,
validation, and task lives in a different tool, disconnected from the thing it's about.
Design reviews are screen-share-then-Jira. "Will it survive thermal load / can it be built"
is answered weeks later by a different team in a different tool.

Four users, one wish:

• Hardware/product team — "stop making me reconcile 6 tools; let the decision, the

validation, and the geometry live in one place."

• Design studio — "give me AI co-designers and instant 'is this real/buildable' feedback."
• Startup founder — "I want an AI engineering team in a box."
• Distributed team — "give me a real room to build in, not another video call."

The destination (24 months): conduir-spatial becomes the *AI-native product-development
environment — a live 3D scene that is the source of truth for geometry and decisions
and validation, where humans and AI engineers co-design, the system simulates and
validates in place, bridges the tools teams already trust, and gets smarter with
every product built. The flashy one-liner — an AI engineering team in a box that works
while you sleep* — is leap #7; it is only credible because leaps #1–#6 build the substrate
under it.

2. The seven leaps (a dependency arc, not a menu)

Each leap consumes the prior leap's substrate. Pull #1 and #4–#7 collapse — which is why the
"foundation" leap, not the flashy capstone, is sequenced first.

Leap 1 — Parametric Product Graph + spec→geometry forge (foundation)

What: promote the gated "3D Product Forge" from a geometry scene into a live
Assembly/Part/Feature/Constraint/Parameter graph in Neo4j with a constraint solver,
and rewire the existing LLM-interpret endpoint to emit parametric ops instead of chat
text. "2 mm-wall PETG snap-fit enclosure for this PCB" → editable, constrained geometry.
Leap from substrate: we already have a Neo4j scene graph, an LLM-interpret path, and a
HITL mutation chokepoint. The new mass is the product semantics layer + a constraint solver
(integrate, don't build — OpenCascade/solvespace-class).
Riskiest assumption: that LLM-generated edits can be constrained so they don't silently
produce invalid/over-constrained geometry. De-risk: the constraint solver is the gate;
an edit that doesn't satisfy constraints is rejected at the same chokepoint mutation-safety
already enforces.

Leap 2 — Spatial Design Review Room (adoption wedge, most reachable)

What: the room becomes the default place engineering decisions get made — voice, gaze,
pointing, annotations, and persistent, anchored decision objects ("approved", "blocked
on X", "rev to 2 mm") attached to the actual geometry, surviving the session.
Leap from substrate: WebXR shell + LiveKit voice/avatars/presence + Yjs awareness already
exist; the new mass is anchored decision objects + their lifecycle. This is the wedge:
it's valuable on day one, before the forge is deep, and it's how teams get in the habit of
meeting in the scene.
Riskiest assumption: reviewers will enter a 3D room instead of defaulting to a flat call.
De-risk: make it joinable from a flat 2D browser tab too (the 3D is progressive, not a
gate); the decision-objects value holds even in 2D.

Leap 3 — Decision layer that bridges CAD/PLM/Jira (load-bearing)

What: become the authoritative decision/review layer on top of SolidWorks/Onshape/
Windchill/Arena/Jira/Ansys — threaded decisions, tasks, approvals as spatial objects that
sync both ways with the tools teams already trust.
Why bridge, not replace: hardware teams will not abandon Windchill in two years. "Absorb
the toolchain" is the 5-year vision; "bridge + become the decision layer" is the reachable
one. (This was the one genuine strategy disagreement in ideation — resolved to bridge.)
Leap from substrate: MCP/connector adapters over the Neo4j graph + NATS event bus;
round-trip geometry refs and ticket state. Riskiest assumption: bidirectional sync with
proprietary PLM/CAD APIs stays maintainable as vendors change. De-risk: start with two
connectors (one CAD: Onshape REST; one tracker: Jira), MCP-contracted so the surface is
uniform.

Leap 4 — Simulate→Validate→DFM-advisory loop (transformational, the real differentiator)

What: make each existing ValidationGate dispatch to a real external solver
(FEA/CFD/tolerance/DFM), async, re-projecting results onto the geometry; a scene that
passes all gates auto-emits a DFM-advisory + manufacturing-prep package (geometry +
tolerance notes + a flagged buildability report) that a human engineer reviews and signs.
It does NOT mean "press a button → fabricate." "Manufacture-ready, trustworthy enough to
spend money fabricating" is the 5-year claim; the 24-month deliverable is advisory, with
a human of record (see §"Liability boundary"). Pushing past advisory stacks solver fidelity +
meshing + tolerance stack-up + DFM + an implicit liability transfer we are not taking on in 24
months — this was the single least-grounded claim in the stress-test and is deliberately
narrowed here.
Leap from substrate: ValidationGate is already a named node type; the new mass is a
solver-dispatch service (job queue → containerized solver → results back onto the graph).
The maturity roadmap's Phase-6c "one solver vertical slice" is exactly this leap's MVP —
we pull it forward and make it the headline, not a gated afterthought. Test-suite/gate
generation (an AI proposing the gates a design should pass) folds in here.
Riskiest assumption (the doc's bet #2): solver fidelity/cost/latency earn enough trust
that "passed structural gate at stated fidelity" changes how the engineer spends their next
hour. De-risk: ship structural-only first with explicit confidence bounds; "validated"
always names which solver at what fidelity; a thin bet-validation spike runs in Q2
(see sequencing), not Q3, so the make-or-break trust question is answered in H1.

Leap 5 — Compounding Engineering Brain (the moat / category-definer)

What: every validated design, failed gate, and accepted persona mutation becomes a
structured, retrievable outcome that informs future work — the AI engineering capability
gets smarter with every design. This is conduir-spatial's instance of the parent
compound-learning thesis: the base LLM stays frozen; the spatial layer self-feeds.
Leap from substrate: the ~200-step mutation history + ValidationGate outcomes + Neo4j
graph already exist as raw signal; the new mass is turning them into a *queryable outcome
corpus that feeds persona/forge prompting (retrieval first; fine-tuning later).
Decouple capture from use (so the moat accrues during the exposed Y1). The corpus use
(retrieval into prompts) is Q5, but structured corpus capture starts Q1, day one — it is
cheap (it is just disciplined logging of the mutations + gate outcomes already flowing) and it
means the proprietary data moat is accumulating from the first design, even while the brain
that exploits it is a Year-2 deliverable. Defensibility therefore does not wait on the
Y2 commit decision; only the exploitation* does.

Data/IP governance is a Q1 PREREQUISITE of capture, not a Q5 afterthought (external-review fix).

The moment you capture customer design outcomes you incur data obligations. Q1, alongside the

capture: tenant-only by default (no cross-tenant read — the corpus is keyed by session/tenant

from the first row; implemented this way in the Leap-5 outcome_store), **global/cross-tenant

learning is opt-in only (per a signed DPA), and a retention / deletion / export** policy

(a customer can purge or export their corpus) plus a cross-tenant leakage test in CI. Without

this, day-one capture is a liability, not a moat.

Riskiest assumption: cross-project learning generalizes without leaking one customer's IP
or overfitting one domain. De-risk: per-tenant brains by default; a global brain only on
explicitly shareable, anonymized patterns.

Leap 6 — Agent & Validation marketplace (ecosystem — strongest ideation consensus)

What: publish the persona + ValidationGate interface as an MCP-server contract so
third parties ship domain experts (thermal, EMC, regulatory, DFM, medical, robotics,
materials/supplier-specific) and gates. Platform → ecosystem.
Leap from substrate: we already speak MCP; the new mass is a stable public contract +
trust/certification model for third-party gates. Riskiest assumption: third-party gate
authors exist and their validators can be trusted enough for engineering sign-off.
De-risk: certification tiers (community / verified / certified-for-signoff).

Leap 7 — Autonomous persona squads + overnight design loops (capstone)

What: the "AI engineering team in a box" — given a spec and a gate suite, mechanical /
cost / compliance / manufacturing personas iterate candidate designs unattended overnight;
a quorum panel adjudicates trade-offs and surfaces ranked options by morning.
Leap from substrate: compose the agents + ValidationGates + forge + brain into a closed
iterate → gate → adjudicate loop with explicit authority bounds. We already have the
quorum panel and HITL authority model; the new mass is the bounded autonomous loop.
Riskiest assumption: bounded autonomy stays bounded — unattended agents converge on safe,
sane designs rather than confidently optimizing toward a gate-passing-but-wrong solution.
De-risk: the loop only proposes; a human gate (the same chokepoint) approves any design
before it leaves the sandbox. Autonomy expands as the brain's track record earns it.

3. The strategic spine (beachhead · moat · pricing · liability)

The stress-test was blunt: an ambitious arc is not yet a plan without these four. They are
the load-bearing strategy under the seven leaps.

3.1 Beachhead vertical + the killer wedge — injection-molded / 3D-printed consumer mechanical

"Hardware/product team" silently spans injection-molded goods, PCBs, robotics, and medical —
each a different solver, regulator, and buyer. We pick one: *enclosure / bracket /
snap-fit parts for injection-molded or 3D-printed consumer-mechanical products* (the doc's
own PETG-enclosure + structural-FEA bias points here, and it's the lowest-regulation,
fastest-iteration corner of hardware).
The killer wedge — the one workflow that is 10× better here than anywhere else:

*"Describe an enclosure for this PCB; co-design it in the room with an AI mechanical

persona; get a structural read in minutes; export a print/mold-prep package — all in

one session, no CAD-seat, no CAE team, no week-long loop."*

Y1 wedge = structural-in-minutes only. Wall-thickness/draft and the richer DFM gates are

the Q5 deepening (Year-2), not part of the Q4 Y1 GA — the wedge must not advertise Y2

capability as the Y1 promise.

Today that workflow crosses Fusion/SolidWorks + a CAE consultant + email. Collapsing it into
one room for this part class is the wedge; we expand part classes and verticals (PCB/EMC,
then robotics, then regulated) only after it lands. *Marketplace gates (L6) are how we expand
verticals without building every solver ourselves.*

3.2 Moat — why this survives Anthropic/OpenAI shipping "spatial CAD reasoning"

The thesis is "base LLM frozen, spatial layer self-feeds" — so the moat cannot be model
quality (a foundation vendor wins that). The moat is the *data + trust graph the model can't
have:
1. Proprietary outcome corpus (L5) — your designs, your failed gates, your accepted
edits. A foundation model has the world's text; it does not have your factory's DFM
outcomes. This compounds per tenant and is not portable to a competitor.
2. Bidirectional tool-state (L3) — live, two-way connection to the team's actual
Onshape/Jira/Windchill state. Switching away means re-wiring their whole stack.
3. Certified-gate trust graph (L6) — a network of validators trusted enough for sign-off.
Trust is earned over time and is itself a moat a model dump can't replicate.
Threat model: if a foundation vendor ships spatial+CAD reasoning, conduir's defensibility
is not "we reason better" — it's "we are wired into your tools, we hold your outcome history,
and our gates carry sign-off trust." If we have none of L3/L5/L6, we are a thin UI over a
commodity model.
Closing the "exposed Y1" valley (stress-test catch): the compounding moat (L5 use, L6
trust, L3 two-way) is Y2, so a naive reading leaves Y1 thinly defended on the very year we are
most exposed. We close that valley two ways: (1) L5 corpus capture starts Q1 (see Leap 5)
so the proprietary data moat accrues from day one even before the brain uses it; (2) Y1's
defensibility is the switching cost of the accumulated validated-design + decision history
a team builds in-room, not model quality. (The deep tool lock-in — the two-way bridge — is
deliberately Y2, so the honest Y1 moat is the corpus seed + decision/validation history, not
bridge wiring; we don't overclaim a Y1 lock-in we haven't built.) The moat seed (L1+L4 +
day-one capture) is therefore a Y1 asset; only its full exploitation* (L5→L7) sits on the
deferred Y2 fork.

3.3 Pricing / packaging — solver compute makes a flat seat price dangerous

Four leaps imply four cost shapes; a single seat price would subsidize heavy users into
bankruptcy (solver dispatch is real COGS). Proposed structure:

• Room/seat (L2/L3) — flat per-seat for collaboration + bridges (low, predictable COGS).
• Validation credits (L4) — usage-metered solver compute, passed through with margin;

the unit-economics gate from the maturity roadmap is measured here.

• Marketplace rev-share (L6) — take rate on third-party gates/personas.
• Outcome/automation tier (L7) — premium for overnight squads (compute-heavy, high-value).

The maturity roadmap's "positive contribution margin at target price" gate applies *per
shape*, and validation credits are the one that must never be flat-rate.

3.4 Liability / regulatory boundary — we are not the engineer of record

The instant the system says "passed gates → manufacture," conduir is implicitly in the
sign-off chain. Explicit posture for the whole 24 months: *conduir is an advisory + decision
environment; a named human engineer is the engineer of record for any fabricated design.
Every validation result carries a confidence bound and a "not a certification" disclaimer;
L6's "certified-for-sign-off" tier requires a credentialed human reviewer in the loop; we do
not enter regulated verticals (medical/aerospace) inside this horizon. This is also why
L4 is DFM-advisory, not fabricate*.

4. 24-month sequencing (quarter by quarter)

Quarters are indicative for a focused team and are not commitments. The maturity
roadmap's hardening work (auth/tenancy/observability/load — its Phases 0–4) runs underneath
Y1 as the production substrate these leaps require; it is assumed, not re-listed.

Structural fix from the stress-test (most important): the original draft over-coupled Y1
(L1 + L3 + L4 all platform-scale) and didn't validate bet #2 until Q3. Fix: *defer
L3-bidirectional sync out of Y1 (Y1 ships only a read-only/one-way reference bridge — the
maintenance-heavy two-way sync moves to Y2), and pull a thin L4-structural bet-validation
spike into Q2, parallel to L1. Both make-or-break bets (§5) are then answered in H1*,
before the platform is committed.

Year-1 = the validated-design room (L1–L4 structural). *Year-2 = the compounding,
ecosystem-backed, semi-autonomous engineering brain* (L4 DFM-advisory, L5–L7).

Capacity reconciliation (the two roadmaps share ONE Y1). This vision's Y1 leaps
(L1 + L2 + the L4 spike + L3 read-only) and the maturity roadmap's Phases 0–4
(auth/tenancy/observability/load) are the same team's Y1, not two parallel staffs — the
hardening is the production substrate the leaps ship on, and they must be *capacity-planned
together, not assumed free. Indicative shape (exact sizing → the maturity roadmap's hiring
track): a focused team split roughly FE (room/forge UX) · BE (graph/solver-dispatch/sync) ·
Sec/Infra (the Phase-0–4 hardening) · 1–2 AI/agent eng (interpret→parametric, personas),
with the constraint solver + first structural solver integrated, not built. If that team
cannot carry both, L3 read-only and L2 polish yield first — the two technical* bets (L1, L4-spike)
and the hardening are the non-negotiable Y1 core.

Indicative Y1 capacity (FTE × quarter) and the non-negotiable GA minimum. Placeholders for a
small focused team — calibrate to real capacity; the point is that Y1 does not close on heroics.

Non-negotiable Y1 GA minimum (everything else can slip): (a) mutation-safety

production trust-boundary (ADR-0003 Ph2–4) + tenancy/authz as entry gates, not Phase-4 — a

multi-user persona-mutation product can't GA without them; (b) L1 constraint validator on a

real path; (c) the L4 structural advisory verdict (stub-honest); (d) ≥3 design-partner

pilots with a retention reading. If capacity forces a cut, cut L3 two-way, L2 polish, and the

richer DFM gates — never (a).

Where the boldness actually is (say it plainly). L2 (review room) and L3 (bridge) are
entry tactics, not the product — the 2D-joinable decision-room overlaps Figma/Miro/Jira and
a competitor could match it. *The moat is L1+L4 (parametric forge + validated DFM loop) feeding
L5 (the outcome corpus). The wedge gets users in; the forge+validation+brain is why they
can't leave and a foundation-model vendor can't replicate them. The plan is bold there*, and
pragmatic (bridge, advisory) everywhere a 24-month team would otherwise over-reach.

5. The three bets that decide everything

1. Constraint solver robustness and usefulness (L1). Two parts: (a) safety — invalid/
over-constrained edits are rejected at the chokepoint (the solver is the gate); (b)
usefulness — the LLM can generate useful parametric constraints, not just avoid bad ones.
Q1 pass criterion (initial targets, tune with data): on a fixed corpus of ~20
enclosure/bracket prompts, ≥ 70% produce a valid, on-intent parametric part a human
accepts with ≤ 3 edits. If only (a) holds, conduir-spatial is a safe whiteboard, not a
forge.
2. Validation trust (L4). "Passed the structural gate at stated fidelity" must change how
an engineer spends their next hour — trustworthy enough to act on, not (yet) to fabricate
unreviewed. Q2 pass criterion (initial targets, tune with data): on a reference corpus of
parts with known results, the dispatched structural solver agrees *within ±15% peak-stress
of a trusted FEA baseline, returns in < 5 min, at < $2/run — that error band is
the "stated fidelity." Validate with a thin spike in Q2 (H1), structural-only — pulled
earlier than the original Q3 so both technical bets resolve before the platform is committed (the adoption bet #3 resolves Q3-Q4 with design partners).
> Q1 prerequisite (this bet isn't measurable without it): the ±15% claim presupposes a
> reference corpus that must be built in Q1 — a fixed set of parts with trusted FEA
> baselines, explicit load cases, material assumptions, and meshing rules. Schedule this
> as Q1 BE/AI work; without it, "±15% vs FEA on n≥30" is unfalsifiable. (n≥30 for adequate
> statistical power on the go/no-go.)
(Both technical spikes use n ≥ 30 reference parts so a go/no-go isn't decided on an
under-powered read.)
3. Adoption / demand (L2 wedge) — the bet the original draft left unmeasured. L1 and L4
verify the product works; nothing verified anyone shows up. The wedge's riskiest
assumption ("engineers enter a 3D room instead of a flat call") needs a go/no-go too.
Q3-Q4 pass criterion (initial, tune): in design-partner teams, ≥ 50% of qualifying
design reviews are actually held in-room (vs. flat call), and ≥ 1 partner returns and
re-uses the room in two distinct weeks* (ties to the maturity roadmap's Phase-3
pilot/retention gate). If L1/L4 pass their numeric gates but this misses, the wedge — not the
technology — is wrong, and the entry tactic is re-cut before scaling.

Incumbent migration (how a team actually leaves SolidWorks+Windchill): they don't, at
first — which is exactly why L3 is a bridge. The migration path is gradual: the team starts
holding reviews in the room (L2) while CAD/PLM stay authoritative; the room accrues the
decision + validation history (L5) the old tools never had; over time the source of truth for
"why is it this way / has it been validated" shifts to conduir even while the CAD seat stays.
We win the decision/validation layer first, not the geometry-authoring seat.

Everything commercial (the maturity roadmap's GTM/unit-economics/hiring tracks, plus §3.3
pricing) still applies and is the gating reality check — but the product ambition is the arc
above, not the narrowed bet alone.

6. Open questions for the operator

• Ambition vs. focus (the one decision that resolves the rest): Y1 is the same either

way — L1 + L2 + L4-structural + hardening. The open question is only the Y2 commitment:
commit now to the full L5→L7 arc, or gate Y2 on Y1 traction. (To be precise about the Q4
line: the Y1 GA supersedes the maturity roadmap's collaboration-GA definition — Y1 now ends
on a validated-design room, not just a collaboration room — but the Y2 scope stays the open
question. No contradiction: shared Y1, decided-later Y2.)

• Hardest connectors (L3): the H1 de-risk uses Onshape REST + Jira (cloud, easy); the

named-hard incumbents (SolidWorks desktop, Windchill PLM) are a known Y2 target, not
proven in H1 — sequence them after the cloud connectors prove the bridge pattern.

• Brain scope (L5): per-tenant only, or a shareable global brain on anonymized patterns?

This is the moat and the biggest trust/IP risk.

• Build vs. integrate the solver/kernel (L1/L4): the integrate-don't-build posture says

integrate; which kernel + which first solver is a Q1 decision (ADR-0002 reopens here).

_Provenance: ideation swarm mat24-ambition1 (3/4 families, health OK) + adversarial stress-test

• a 2026-06-08 external review (folded into the Implementation-status table and the §§3.5/5/6

additions). Companion to docs/PROJECT-MATURITY-ROADMAP.md (authoritative for production-hardening
GA gates). Build status lives in delivery/LEAP{1,2,4,5}-BUILD-TRACKER.md._