The Wartime Architecture

Sovereign. Accessible. Node-driven. Private. Data-safe. Each word earns its place.

A node is not a client. A node is a peer. Every community, every person, every node owns its own intelligence, its own data, its own model chain. Federation is opt-in. Isolation is the default.

This is a wartime architecture in the sense that every decision is made under the pressure of a real constraint: the people this system serves must remain free and safe even if every external service they depend on disappears tomorrow.

Canada has a particular relationship with sovereignty. It is a nation that has watched its neighbor's cultural gravity pull at its own institutions for a century, and has responded not with isolation but with the deliberate construction of structures — the CBC, the Canada Council, the health care system, the Charter — that hold space for a different way of being. The Consilience is built in that tradition. Not against any other nation or any other system. For the preservation of something that would otherwise be absorbed.

The intelligence systems that shape how people think are concentrated in a small number of American corporations, governed by American law, running on American infrastructure, priced in American dollars. This is not a conspiracy. It is the natural outcome of capital concentration and network effects. But it creates a dependency that is structural, and structural dependencies are the hardest kind to break.

The Consilience draws its line here. Not with rhetoric. With architecture.

The Canadian constraint

The wartime framing is not metaphor. Canada faces a real intelligence sovereignty challenge: its researchers, its writers, its public servants, its citizens increasingly depend on systems whose terms of service are written in another country, whose data residency is governed by another legal framework, whose pricing can change without consultation, and whose models can be deprecated, censored, or reoriented by decisions made in boardrooms that have no Canadian representation.

The constraint is not "build everything ourselves." Canada has never been isolationist. The constraint is "build the substrate ourselves." The knowledge — the text, the conversations, the learned patterns, the graph of how things connect — must live on Canadian soil, in Canadian formats, under Canadian keys. The models that read the knowledge may come from anywhere. The embeddings that index it may be computed by any model that passes the bake-off. The cognition layer is interchangeable. But the substrate is ours.

This is the sovereignty triplet applied to national scale: Substrate is owned. Index is disposable. Cognition is interchangeable. A Canadian node running the Consilience owns its substrate completely. It can re-embed with a different model tomorrow. It can swap its cognition layer for a model from China, or France, or a Canadian lab, or a model it trained itself. Nothing breaks, because nothing was coupled.

The node as unit of sovereignty

The community-node registry defines the fundamental unit of the Consilience's social architecture: the node. A node is not a server. A node is a sovereign installation — a person's own machine, running the full stack, owning its own data, making its own decisions about what to share and with whom.

The registry caps each community node at one hundred and forty people. This is not an arbitrary number. It is Dunbar's number — the approximate limit of stable social relationships a human brain can maintain. The cap is architectural: it ensures that every person on a node can, in principle, know every other person. It ensures that trust is social, not algorithmic. It ensures that the node operator — the person who runs the hardware — is a neighbor, not a platform.

A node is not a client of someone else's server. It is a peer. Every community node owns its own intelligence, its own data, its own model chain. Federation — sharing detector outputs and distilled patterns with other nodes — is opt-in. Isolation is the default. A node that loses its network connection keeps working. A node whose operator decides to leave the federation keeps everything it has learned. Nothing is taken. Nothing is revoked.

The model routing on each node follows a layered chain: local inference as primary (the sovereign body, running on the node's own hardware, cost approximately zero), a deep-context delegate as secondary (for long documents and complex reasoning, still local), and cloud fallback as tertiary (only when local bodies are unavailable, and only with the operator's explicit consent). The chain is defined in YAML, read by the broker, and enforced by the routing layer. No turn reaches a cloud model without passing through the operator's declared policy.

The distribution

The system ships as a Docker Compose bundle. Three containers: the application, the database, the embedder. A person runs docker compose up and has a fully local installation. Knowledge, embeddings, search, agents — all on their own hardware, reachable as a Progressive Web App, runnable offline.

The bundle is lean and carries only what the user needs. Marketing stays out. Cloud-only assets stay out. The user who downloads the system gets the instrument. They do not get the company. The two surfaces — the downloadable bundle and the hosted shell — share a codebase but never share deployment artifacts. A user who downloads the bundle gets the bundle itself; the hosted version stays in the browser.

The design principle is plain: users who download the system own the system. They do not rent it. They do not depend on a server that someone else maintains. They can modify it, restyle it, extend it, give it away. The substrate is theirs. The index is theirs to rebuild. The cognition is theirs to swap. This is what sovereignty looks like when it is installed on a machine in someone's home.

The federation

Sovereignty does not mean isolation. The community-node registry defines how nodes connect: shared corpora (which collections are available across the federation), identity routing (how a person's identity carries across nodes), retrieval mode (how search spans multiple nodes), and conversation carry (how a conversation started on one node can continue on another). All of it is opt-in. All of it is consent-governed.

The learning loop's consent model makes federation safe. Three tiers govern what data can leave a node: private (this node only, the default), node-shared (aggregated, redacted statistics shared across the community — no raw text, no identifiers), and consilience-wide (materialized, redacted exemplars that have been reviewed by a human before they join a cross-community training corpus). Promotion is one-directional without explicit re-consent. Demotion is always allowed and propagates — demoting a turn must mark every graph record derived from it for re-tiering or removal.

The export boundary is one code path. There is exactly one function that moves data across a trust boundary, and it pattern-matches on the consent tier first. No ad-hoc exports. No tools that accidentally leak. A record with no resolvable consent state is treated as private. Absence of evidence is not evidence of permission.

This is the architecture of trust in a federated system. Not trust by assumption. Trust by construction. The nodes that share the most do so because their operators chose to, because the sharing was reviewed by a human, and because the shared artifact carries no raw identifiers. The nodes that share nothing lose nothing — their local intelligence is complete without federation.

The accessibility commitment

A model that costs nearly nothing to run can be given to anyone — installed on a machine that draws forty watts and left running forever. It can be sent to someone who has no credit card, no stable internet, no relationship with any platform.

Sovereignty without accessibility is a privilege. The Consilience is committed to both.

The system supports over twenty languages. The embedding model — chosen after a bake-off that measured retrieval quality, latency, language coverage, and license terms — supports over a hundred languages under an Apache 2.0 license. The graph ontology's mention system is language-agnostic: a mention in French and a mention in English that refer to the same entity resolve to the same canonical node. The learning loop's detector evaluates voice fidelity against channel guides that are themselves multilingual.

The hardware requirements are deliberately modest. The system is designed to run on a machine that costs less than a month of cloud subscriptions. The local inference path runs models that fit in consumer memory. The graph storage uses embedded engines that require no server process. The constellation renderer is Canvas, not WebGL — it runs on integrated graphics. The entire stack can be described to someone in a single sentence: download, unzip, run, open browser.

The accessibility commitment extends to cost. Local inference costs approximately zero dollars per turn. The graph is computed from the substrate, not from paid API calls. The embeddings are computed locally. The learning loop runs on local models. The only recurring cost is electricity and internet — and the internet is optional. A node that loses its connection degrades gracefully: local inference keeps working, local search keeps working, local agents keep working. The cloud is a fallback, not a requirement.

This is what it means to build intelligence that can be given away. Not intelligence that is free because someone else is paying for the servers. Intelligence that is free because it costs nearly nothing to run, and so can be installed on a machine in a community center, a school, a library, a home — anywhere there is power and a person who wants to think.