Back to overview
Reference Architecture

A deterministic path from sentence to system.

Four layers sit above your legacy structures and turn raw information into predictable execution. Between every stage is a validation gate — no output moves forward until it's proven against the fabric.

onexo — runtime stack — top to bottomGATED AT EACH SEAM
INPUTBusiness Intentplain-English mandate
↓ GATE
LAYER 02

Requirements Lifecycle Loop

Translates plain-English intent into technical constraints, validation models, and tests; auto-refactors dependents when policy shifts.

INTENT → SPEC
LAYER 03

Agent Runtime Orchestration

Decomposes objectives into bounded micro-tasks run by specialized workers inside rigid, deterministic state machines.

SPEC → TASKS
LAYER 04

Intelligent Execution Engine

Scores cost, risk, and latency, then routes each task down the cheapest safe pathway — metadata update or coding mission.

TASKS → CHANGE
LAYER 01

Unified Data Fabric

The governed context graph every layer grounds against — permission-aware, continuously synced, resident on your infra.

SOURCE OF TRUTH
↓ GATE
OUTPUTYour Systems of Recorduntouched until proven safe
The core guarantee

Every handoff passes through a state-machine gate.

Agents don't call each other directly. Each worker's output is validated against the fabric before the next worker can consume it — so a hallucination can't be inherited downstream as truth. When a check fails, the transaction rolls back and retries; it never propagates.

onexo — state machine — mission trace
1
Intent parsed
2
Grounded in fabric
3
Staged in sandbox
Check failed → rollback
4
Re-validated 214/214
Human checkpoint
passed gatefailed → rollback + retryhuman checkpoint
Execution routing

The engine picks the cheapest safe pathway.

Not every change needs code. The execution engine scores each directive on cost, risk, and latency, then routes it — most resolve as a governed metadata update; only new services or hard performance needs trigger a bounded coding mission. See the economics →

DIRECTIVE

Scored on entry

Cost, risk, latency, and blast radius are computed against the fabric before a single token is spent.

PATHWAY A — ~90%

Governed metadata update

No code generated. Zero new technical debt. The change lands in the fabric and propagates.

PATHWAY B — WHEN REQUIRED

Bounded coding mission

A multi-agent session compiles source only for new microservices or real performance needs, then validates and ships.

Deployment topologies

Same architecture. Your choice of perimeter.

The stack deploys unchanged across four topologies — the only variable is where the control plane and compute live.

01

SaaS

Fully managed control plane and compute. Zero ops overhead, fastest to value.

managedmulti-tenant isolation
02

Hybrid

Secure cloud control plane paired with your private compute for sensitive workloads.

cloud planeyour compute
03

On-Prem

The entire stack deployed inside your own data center, under your operations.

your datacenter
04

Air-Gapped

Complete network isolation. No external dependencies beyond an in-perimeter LLM.

zero egresssovereign
MODEL REQUIREMENT

In a fully air-gapped topology, the only external dependency is an LLM inside your perimeter — an open-weights model on your hardware, or a private endpoint. No traffic ever leaves your network. Governance & controls →

Bring your architects to the briefing.

We'll walk the gates, the state machine, and your target topology against a real workflow — not slideware.