System map, adapter layer, trust and evidence model.
How XCNTRY stays model- and runtime-independent while Agent City retains one organizational history — 27 systems, 125 architecture decisions, one canonical semantic core.
The adapter layer is not a foundation. It is a horizontal control plane.
Seven layers run top to bottom, from human constitution to vendor infrastructure. The Infrastructure Adapter Layer cuts sideways across all of them — a lateral control surface, not a bottom shelf you build on top of.
Every capability lives in a named system, not a feature list.
The full inventory is canonical and versioned. Evolution Control Plane is not a 28th system — it runs as a logical plane mapped across the systems already below.
S01
Constitution & Purpose Studio
S02
Capability Studio & Ontology Registry
S03
Capability Knowledge Graph
S04
Organizational Compiler
S05
Purpose Realization Kernel
S06
Economic PRK / Capability Economy Engine
S07
Assessment & Diagnosis Engine
S08
Scenario & Intervention Lab
S09
Capability Portfolio Management
S10
Executive & Operational Cockpits
S11
Agent Factory / Genome Studio
S12
Genome Registry, Birth Service & Notary
S13
Agent Registry & Lifecycle Service
S14
Agent Capability Academy
S15
Independent Accreditation Service
S16
Agent City Runtime
S17
Capability Marketplace & Agent Company Registry
S18
Treasury, Budget & Actuarial System
S19
Identity, Authority, Policy & Tool Gateway
S20
Evidence, Outcome, Value & Risk Ledgers
S21
Knowledge Library & Memory Bank
S22
External World Gateway & Human Services Marketplace
S23
Security, Quarantine & Incident Response Center
S24
Court, Appeal & Dispute Resolution
S25
End-of-Life, Succession & Generational Learning
S26
Protocol & Enterprise Integration Layer
S27
Observability & Trace Correlation Layer
Structural hubs
S10
Executive & Operational Cockpits
21 dependencies
S16
Agent City Runtime
20 dependencies
S20
Evidence, Outcome, Value & Risk Ledgers
19 dependencies
Nearly everything else in the graph feeds one of these three: what operators see, where work runs, or what counts as proof.
Vendor objects never write directly into the core domain.
Every model, runtime, and enterprise system enters through a vendor adapter first — normalized into canonical contracts before it can touch Purpose, Capability, Genome, Evidence, Fitness or Evolution.
Minimum adapter contract
- Vendor-specific objects cannot write directly into the core domain.
- Source telemetry cannot gain selection authority without becoming canonical evidence.
- MCP and A2A are used as the preferred interoperability substrate.
- Every critical dependency carries an export path, an alternative-provider class, and a continuity plan.
- A runtime or provider difference is recorded as a confounder for Selection Validity — not just a business risk note.
37 technology classes. Every one of them is replaceable.
The v0.2 physical starting point is deliberately plain: PostgreSQL, JSONB, append-only events, relational relationship projection. Graph stores, agent runtimes, IAM and observability are integrated as strategic substrate, not built from scratch.
Data
AI & Agents
Integration
Security & Governance
Observability
Platform Operations
Canonical domain semantics stay inside XCNTRY. Outside infrastructure connects through an adapter — never the reverse.
Relationships are first-class objects. The graph database is not.
Which physical graph technology to use is a deliberately separate, deferred decision. What matters architecturally is that a relationship in the capability network is a governed object with its own lifecycle — not just an edge.
Generated View
A purpose-specific slice of the network. It can never be persisted as a new canonical hierarchy.
Relationship Claim
An edge is a claim — with rationale, evidence and confidence — until it's reviewed. Not a fact by default.
Orphan Capability Flag
A capability node whose purpose lineage can't be explained gets flagged and disposed of — never silently deleted.
125 decisions. Almost none of them are deleted.
Every architecture decision carries a status, an activation phase, a rationale, and the systems it touches. Conflicts get superseded or revised — the historical record stays intact.
78
Accepted
16
Planned
15
To Be Reviewed
12
Superseded
2
Deferred
Historical ADRs are never deleted. A decision that conflicts with a newer Strategy Lock is marked superseded or revised — the ADR count stays fixed as the record.
Engineers reference the existing 125 rather than opening a parallel decision set — a new ADR is reserved for permanent decisions about migration, lock-in, canonical identity, authority, or rollback cost, not routine engineering choices.
Not marketing stats. Machine-checkable release checks.
27 systems, 125 architecture decisions, 54 acceptance criteria, 75 data objects, 18 consistency locks — each one traces through a single correlation graph back to a strategic claim.
27
canonical systems
125
architecture decisions
54
acceptance criteria
75
canonical data objects
18
consistency locks
One acceptance criterion is literally an architecture review: prove the demo never let an agent runtime, IAM or observability vendor become the canonical source of truth.
Eighteen rules that don't change per feature.
Some things are never left to a model's judgment.
Must be deterministic
- Identity integrity
- Genome hash verification
- Budget limits
- Authority duration
- Tool allowlist
- Lifecycle transition rules
- Ledger writes
May be agent-based
- Purpose interpretation
- Plan-alternative generation
- Evidence summarization
- Risk hypothesis generation
- Retro analysis
Requires joint decision
- New genome approval
- Accreditation
- High-risk tender selection
- End-of-life
- Constitutional amendment
An honest maturity map, system by system.
Two systems are the actively developed spine. The rest are prototyped, mocked, or explicitly scheduled for a later phase — named, not hidden.
2
Actively developed
1
Simple prototype
5
Mock / stub
13
Data model only
6
Next phase
Agent City Runtime's own acceptance proof: the same challenge contract runs on two different runtime profiles.
Production multi-tenancy is a schema decision today, not a promise.
Every major entity already carries a tenant_id and city_id — even in a single-tenant deploy. Real cross-tenant isolation, provisioning and testing are scoped in for later, on purpose.
Deployment topologies
Deliberately not built yet
Each exclusion carries its own re-entry condition — most reopen before the first pilot customer or first production task-share automation.
Related XCNTRY topics
Follow the entity graph.
Agent City
A governed enterprise environment where artificial actors face complexity, earn work through evidence, specialize and improve the organization across generations.
Open topic
Enterprise AI Agent Platform
An enterprise software platform that lets organizations operate AI agents with identity, authority, policy, evidence, lifecycle control and human governance.
Open topic
Human Constitution
The set of human-reserved domains, legitimacy rules and final accountability boundaries that constrain machine-scale execution.
Open topic
Your agentic organization needs an environment to evolve.
Build the city. Let evidence shape the generations.