THE NERVOUS SYSTEM

An AI agent fleet that runs overnight without human supervision has a single-point failure mode that no amount of retry logic addresses: the model call that never returns. No timeout fires. No exception surfaces. The daemon sits with CPU at 0.0, a message pending in the queue, and a user waiting — and every health check reads green, because the process is alive and the last log line looks normal.

You cannot fix a freeze you cannot see. And you cannot restart a daemon you do not know is frozen. The studio runs several autonomous daemons around the clock. The question was not whether a freeze would occur — it was whether the response would take seven minutes or seven hours.

The nervous system is not an AI. It is a finite-state machine written in deterministic shell and Python — 9,526 lines across 29 modules — with a simple mandate: watch the fleet, classify each daemon's state every cycle, and act on a state change according to a pre-written rulebook. Zero LLM calls. No probabilistic verdicts. Every sensor reading is recorded; every classification is auditable.

Seven states. Multiple sensors. One rule: the reflex layer never kills what it cannot measure, never restarts without a forensic snapshot, and never exceeds its rate-limited restart budget without freezing itself and paging a human.

Instantaneous CPU — not a process-lifetime average — is the correct liveness signal. A process that ran at full utilization for three hours and now idles at 0.0 looks healthy if you read the lifetime mean; the instantaneous read tells the truth. The sensor layer was built to that constraint from the start.

Every restart is preceded by a ≤1.2-second forensic capture: process threads, open socket queues, the last N lines of the transcript, and the current FSM classification with its contributing sensor values. The snapshot is written to the audit log before the kill signal fires.

1,219 such snapshots exist. Every kill the system has ever executed is traceable — what state each sensor reported, what classification it produced, and why the threshold was met. The continuous audit log has been running since June 11.

The reflex layer was built in approximately 50 minutes of AI wall time against a written spec. Then it ran for 77 hours in shadow mode — logging every classification, writing WOULD-restart entries to the audit log, killing nothing. No production daemon was touched until the shadow window closed.

That window earned its keep. Three P0 defects surfaced in the defect register — all caught by the detector reviewing its own shadow log. None reached a real daemon.

Armed by the principal one daemon at a time — never self-armed. The constitution is explicit: “built ≠ armed.” New autonomous capability ships disabled, soaks in shadow, proves a false-positive record, and is armed by the human — with a kill-switch verified before arming, not after.

Hours after arming: the first real catch. A daemon hung mid-conversation — CPU 0.0, a message pending, the reply-latency signal climbing. Detected in 7 minutes. The forensic snapshot was captured, the restart fired, the daemon verified healthy, and the incident was locked into the regression suite as a replayable simulation.

A reflex layer that fires incorrectly is worse than no reflex layer — it interrupts work, creates context-loss incidents, and trains the operator to ignore its alerts. Three rules govern every classification:

41/41 regression simulations pass — including replays of every real incident the fleet has encountered. The regression suite is the living record of the fleet's failure history. Each new real incident adds a replayable sim before the session closes.

The reflex layer keeps the fleet running. But the more durable question is: what survives when a model version is retired, a new frontier tier ships, or the underlying inference provider changes? The answer is not the weights. The weights are labor — replaceable on the next session. What survives is the corpus.

The corpus is the system. Every lesson learned, every decision recorded, every belief calibrated and graded against outcomes — these are what a successor model inherits. They are what allow a new model to pick up exactly where the previous one stopped, without retraining, without rediscovery, without repeating the same mistakes that filled the archive.

The lessons archive is append-only and never rewritten. A scheduled job regenerates a compact hot-load index (~4.7k tokens) from the full archive, so every future model session boots with the same scar tissue — every past failure pattern available in the first prompt, without paying the token cost of the full archive every turn.

Every session starts with a boot brief: the memory index loads, the lessons hot-index loads, the formal beliefs load. Then — before the agent accepts any instruction — an integrity audit confirms the inherited corpus is intact.

If the audit fails, the session does not proceed. The constitution that governs the fleet is not assumed to be intact — it is verified to be intact. An unverifiable inheritance is reported to the principal, not silently adopted.

This is what Article VII of the governance document calls the inheritance audit. It is not a ceremony — it is a hard gate. A model that cannot verify the corpus has not inherited the system; it has inherited a document that might have been tampered with, and it knows it. See THE CONSTITUTION for how that document was red-teamed and hardened before ratification.

In mid-June, one daemon was moved to a newer frontier model tier while the reflex layer was running live. The FSM did not care. Same state machine, same sensor budgets, same forensic format, same audit log schema. The corpus the new model inherited — the lessons, the memory, the beliefs, the prediction ledger — was identical to what the previous model had been operating from.

Zero rebuild. No re-tuning. No re-training. The new tier read the same boot brief, passed the same integrity audit, and continued from the same lesson count. The transition was invisible to the fleet.

The daemons run different model tiers today. The spine does not care which model executes it. It cares whether the corpus is intact and passes its audit.

The freeze root cause was not assumed. It was reached by elimination. The leading hypothesis — that an API call hangs with no client timeout, leaving the process alive but permanently blocked — was adopted only after the prior one was falsified: 0 out of 5 observed freezes correlated with network events, below the pre-declared falsification threshold.

Hypotheses are tested one at a time. Kill criteria are written before the test runs, not after. “It might be X or Y or Z” is not a hypothesis — it's three. The architecture of the classifier reflects this: each sensor contributes to exactly one classification branch, and a classification change requires a specific sensor threshold, not a committee vote.

The corpus describes the system — its engineering lessons, its memory, its beliefs. A complementary layer describes the operator: their aesthetic verdicts, their ambiguity priors, their decision defaults. That layer is what allows an agent to act in their name without re-asking every preference on every session.

That design lives in PERSONAOS. The nervous system keeps the fleet alive; PersonaOS keeps it calibrated to the person it serves.

The reflex layer has been running in production since June 11. 1,219 forensic autopsies on disk. 41/41 regression sims green. The first real freeze was caught in 7 minutes. Every subsequent real incident is a replayable entry in the regression suite.

The fleet is not supervised by a model that knows what to do. It is supervised by a deterministic machine that knows exactly what to measure — and a corpus that ensures any model that steps into the executor role inherits everything the previous one learned.

Weights are replaceable labor. The spine is what compounds.