How the loop works
MATRIX OS is a control plane and a workspace. The control plane holds memory, authority and the ledger. The workspace is where a governed fleet does the work. Between them sits the one artifact leaders touch every day: a ranked queue of decisions.
01 · Ingest
What comes in: inbound communications across every channel, pipeline and CRM movement, financial transactions, delivery and support events, market and competitive signals, your own operating documents.
What happens: each signal is captured with its source, time and provenance into a tiered memory — hot for what is live, warm and cold for reference, archive for the long tail — so the system never re-reads what it already knows and never forgets what it once learned.
Capabilities: IRIS (communications), CIPHER (intelligence), PRISM (audience and brand signals).
02 · Synthesize
What happens: on a daily contract the fleet hydrates from memory, scans what changed, amplifies the signals that matter, writes its findings back, and escalates anything that needs a human. A synthesis agent collapses duplicates across agents into one clean, ranked view.
Standing rule: a quiet source is never reported as quiet until the system has confirmed the source is still flowing. Silence and a stopped feed look identical downstream; the loop checks freshness first.
Capabilities: ATHENA (strategy and synthesis), ABACUS (financial truth).
03 · Decide human gate
What you see: one queue. Each item names the venture or function, the leverage, the dollar impact where known, what it is blocked on, the recommended unblock action, and the minutes it takes. Superseded items collapse; nothing is shown twice.
What only you can do: approve consequential actions, resolve trade-offs between functions, lift or hold. Everything else has already been done or is waiting on a granted authority — not on you.
Capability: AEGIS decision rights, exercised through JARVIS or the operating deck.
04 · Act
What happens: approved or pre-authorized work is dispatched to executors with a bounded context envelope and an idempotency key. Communications go out under the right identity. Work orders build. Infrastructure changes are made by a broker, never by an agent holding a key.
What cannot happen: an agent acting outside its ladder, reaching another tenant, or repeating an action the ledger says already completed.
Capabilities: FORGE (build), IRIS (execution), QUIVER (revenue motion), ANVIL (infrastructure), VESTA / SPHERE / GUILD (relationship, community and partner motion).
05 · Account
What happens: outcomes, costs and returns land in an append-only journal that the next synthesis reads first. Change-failure rates, cycle times and realized value are computed from the ledger — not reported by the agents that did the work.
Why it matters: the loop grades itself against what actually happened, which is how it earns wider authority over time.
Capabilities: ABACUS (accounting), AEGIS (audit and governance).
Control plane, workspace, and the seam between them.
The parts are deliberately few. Each one has an owner, a boundary and a ledger entry.
Tiered operating memory
A single brain per tenant with hot, warm, cold and archive tiers. Frequently needed references promote themselves; hydration reads only what is live, so context never overflows and nothing is silently dropped.
Persistent agents, one contract
Each capability has an agent that runs the same five-phase contract daily. Agents are versioned, their primers are documents you can read, and their escalations land in the same queue.
Governed execution
Work moves on a command bus with routes, states, approvals and dead-letter handling. Executors report completion only against real artifacts — a merged change, a sent message, a written record.
Decision-rights ladder
Per agent, per capability, per tenant. Denial is structural: a tool an agent may not use is not in its tool list. Approvals are recorded with who, when and what.
Two vaults, one hard boundary
Tenant-owned third-party credentials live in the tenant's own password-manager vault, rotatable by your people. Platform machine secrets live separately. Neither is readable by an agent.
Recovery is a control plane too
Backups, restore runbooks, exportable state and a documented recovery runtime are part of the platform, governed by the same approval gates as everything else.
The best explanation is the live instance.
In a briefing we walk the loop on the production system that runs b/digital — the queue, the ledger, and the fleet's morning.