Every deployment runs the same engine, the same measurement, the same gates and the same safety floor. What changes between them is the standards layer and the vocabulary.
Sage
A guide, constrained by construction.
Sage is the agentic layer. It holds context across sessions, tracks what a person is working on, and adapts what happens next to where that person actually is.
It is not a chatbot with guardrails added afterward. The constraints are the architecture:
Fixed gate sequence. Every session moves through gates in order, enforced in code rather than requested of the model. It cannot skip one, reorder them, or decide a particular session warrants an exception.
No private state. Agents hold nothing between invocations. If it is not in the session record, it does not exist to the system.
No direct writes. Every change to the record passes through a single controlled gateway that logs it. No agent writes anywhere else.
Declared context only. Sage infers nothing about a person's cultural or spiritual frame. The participant declares it; only what was declared is used.
The result is that behaviour is bounded and auditable rather than emergent — the property an institutional operator needs and the one most systems of this kind cannot offer.
Governance architecture as deployed in incident command. The same shape holds in clinical and education deployments, with the qualified human differing by domain — chief, clinician, teacher.
Measurement
Direction of travel, not position.
Conventional systems score where someone is. That number says more about where a person started than about whether anything is working.
Our measurement is second-order: it tracks the slope of a person's change against their own baseline, weighted for recency and for how consistently they engage. Two people at an identical score, one climbing and one slipping, need opposite responses. Only the slope distinguishes them.
The same mathematics runs in every domain. In education it identifies a student whose difficulty lies two topics upstream of where the failure appears. In clinical use it identifies the measure that is not moving. The standards layer differs; the engine does not.
The user never sees a number.
Measurement drives what the system does next. It is not shown to the person as a score, because a score invites comparison and comparison is not the point.
Metacognition
Finding where the difficulty actually lives.
When measurement shows something is wrong, the system does not simply correct the answer. It works backward to locate where the misunderstanding began — which is rarely where it surfaces.
Traversal is depth-capped. If the source is not identified within a fixed number of questions, the system stops and escalates to the qualified human rather than continuing to probe. That limit is deliberate, and it is enforced in code.
Scale
Participation without a central bottleneck.
Conventional conferencing routes every participant through a central server, which becomes both the single point of failure and the dominant bandwidth cost. Our peer node architecture distributes that load.
Measured capability, stated with its limits.
Mode
Concurrent participants
Interaction
Full interaction
100,000
Complete participation including verified polling and voting
Limited interaction
250,000
Broadcast participation. Verified polling and voting not available at this tier.
We state the ceiling with its constraint rather than rounding upward.
250,000 is achievable, and what it costs is verified polling. A number without its limit is an estimate; a number with its limit is a measurement.
Security posture
Compartmentalized by default.
Self-hosted models. No third-party inference API is called from the compartmentalized core.
One-way ingest. External data — federal baselines, standards feeds — enters in one direction. Nothing is written back.
Isolated mission data. Operational data is held separately from the model layer, with a single audited path between them.
Full source visibility. No opaque third-party components in the core path.
Deployable standalone. The incident command configuration runs field-portable, independent of external connectivity.
Specific cryptographic implementations, key management and deployment configuration are provided under a briefing rather than published here.
