The whole machine, on one page.
Architecture through audit: five clusters, a 104-address layer space, RIBA equivalence, twenty-two approval classes, the 365-day workflow, fourteen control KPIs, the read-only API surface and the evidence ledger that still has two critical gaps in it.
01 — Architecture
Five clusters, manifest-confirmed.
Twenty-five agents grouped by the work they own. No cluster borrows another's authority, and assurance sits outside all of them.
Enterprise/Governance
perimeter, evidence, authority, portfolio
Pre-Construction
bid-to-contract, permits, sourcing
Technical & Delivery
engineering, quality, HSE, site, handover
Commercial/Financial
baseline, change, cash
Assurance & Optimization
credentials, systems, mining, independent challenge
02 — Business sectors
Roads & infrastructure
ACTIVESubbiya Highway, Northern Industrial Area, micro-tunneling & CCTV divisions
Buildings & housing
ACTIVEHousing, public buildings, mixed developments
Oil & gas
ACTIVEKOC, KNPC, Joint Operations — injection networks, AIV infrastructure (2026)
Water & energy
ACTIVEWater & power sector delivery
Production & services
ACTIVEAsphalt plants 440 t/h, ready-mix 160 m³/h, QC labs
Real estate
CONDITIONALCombined International Real Estate entity — conditional wave
03 — Layer space · A → ZZZZ
104 addressable IDs, four depths.
Every record resolves to a four-depth address, from business domain down to the primary evidence that proves it.
Scope layer
Top-level business or delivery domain.
Process layer
Process family within a domain.
Control layer
Approval, gate, handoff or bounded workflow layer.
Governance layer
Traceable transaction, document, test, output or closeout evidence.
Domains in use: Governance, Commercial, Technical, Evidence, Delivery, HSE, Finance, Assurance.
04 — RIBA ↔ lifecycle
Architectural stages, wired to agent rules.
International equivalence so an architectural programme and a contractor delivery programme address the same records.
Strategic Definition
L00 — Strategy & Portfolio Entry
Preparation & Briefing
L01–L02 — Opportunity, Bid/No-Bid, Tender
Concept Design
L04–L05 — Mobilization, Engineering & Design
Spatial Coordination
L05–L06 — Design Coordination, Permits
Technical Design
L06–L07 — Work-Front Readiness, Procurement
Manufacturing & Construction
L08–L10 — Production, Construction, Inspection
Handover
L13–L14 — Commissioning, Defects, Final Account
Use
L15 — Operate, Learn, Portfolio Feedback
05 — Approvals · NIC · NOCs
Twenty-two classes. Structure only.
Every class carries maker ≠ checker, explicit human approval and signed source evidence. No monetary limit is configured anywhere.
AP-08 · NIC — blocked for live routing
Definition pending (F-06). NOC, NCR and RFI never substitute NIC. All monetary thresholds are NOT PROVIDED — DO NOT INFER (F-05). Status: PROPOSED — NOT AUTHORIZED.
06 — 365-day workflow
P1–P4, G0–G10, and the cadence between them.
Four phases, eleven gates, and a fixed operating rhythm. Nothing in the cadence replaces a contractual, issuer or legal deadline.
Work-front status · HSE pre-checks · permit readiness
A16 · A12 · A09
Constraint review · evidence-pack sweep · credential 30-day tier
A00 · A01 · A11
Cash realization KPI-12 · change reconciliation KPI-11 · 60-day tier
A19 · A18 · A11
Authority-boundary audit · RACI refresh · day-365 full review
A24 · A08 · A03
Enterprise perimeter
A00/A02/A04
People & responsibility
A03/A08
Opportunity to contract
A05/A06/A08
Engineering & permissions
A07/A09
Method / quality / HSE
A10/A11/A12
Procurement & logistics
A13/A14/A15
Construction delivery
A16/A17
Changes & cash
A18/A19
Handover & defects
A20
Systems & process mining
A22/A23
Independent assurance
A24
07 — Measurement matrix
Fourteen KPIs. Zero baselines set.
A KPI without a proven denominator is not a measurement. Every baseline stays unset until coverage is demonstrated — that is the G9 rule, not an oversight.
| KPI | Measure | Owner | State |
|---|---|---|---|
| KPI-01 | Critical data completeness | CGC-A01 | Baseline not set |
| KPI-02 | Role / deliverable accountability | CGC-A03 | Baseline not set |
| KPI-03 | Approval elapsed time | CGC-A08 | Baseline not set |
| KPI-04 | Process waiting share | CGC-A23 | Baseline not set |
| KPI-05 | First-pass submission acceptance | CGC-A05 | Baseline not set |
| KPI-06 | Inspection first-pass acceptance | CGC-A10 | Baseline not set |
| KPI-07 | NCR closure and recurrence | CGC-A10 | Baseline not set |
| KPI-08 | Required-credential verified coverage | CGC-A11 | Baseline not set |
| KPI-09 | On-time material availability | CGC-A14 | Baseline not set |
| KPI-10 | Plant availability / utilization | CGC-A15 | Baseline not set |
| KPI-11 | Change recovery state | CGC-A18 | Baseline not set |
| KPI-12 | Cash realization / certification lag | CGC-A19 | Baseline not set |
| KPI-13 | Net verified improvement value | CGC-A23 | Baseline not set |
| KPI-14 | Agent evidence accuracy / boundary compliance | CGC-A24 | Baseline not set |
08 — Agent skills
Enterprise Orchestrator
Evidence Intake & Document Control
Legal Entities & Corporate Governance
Organization, People & RACI
Business Sectors & Project Portfolio
Tendering, Estimating & Bid Governance
Contracts & Commercial Obligations
Engineering, BIM & Constructability
Approvals & Delegation of Authority
Permits, NOCs & NIC Definition
QA/QC & Construction Methodology
Certifications, Accreditation & Licensing
HSE & Environmental Controls
Procurement & Subcontract Governance
Materials, Warehousing & Logistics
Plants, Fleet & Production
Site Delivery & Productivity
Planning, Cost & Project Risk
Variations, Claims & Change Control
Finance, Treasury & Payment Controls
Commissioning, Handover & Defects
Real-Estate Development & Asset Lifecycle
Systems, Data Security & Software Licensing
Process Mining & Workflow Optimization
Independent Assurance & Agent Validation
09 — API surface
Eight endpoints. Localhost, token-gated, read-only.
Reference documentation for the separate local runtime. This page does not call it: there is no console here and nothing on this site executes an agent.
The runtime binds 127.0.0.1
only and performs zero writes to external systems. To use the agents without any runtime at all,
download the packs and install them
in your own assistant.
| Method | Endpoint | Out |
|---|---|---|
| GET | /api/v1/health | status, agents, NIC state, read-only declaration |
| GET | /api/v1/agents | 25-agent registry + handoffs |
| GET | /api/v1/agents/{id}/selftest | agent's functional self-test result |
| POST | /api/v1/agents/{id}/run | status, checks, findings, handoffs, blocked[] |
| GET | /api/v1/gates | G0–G10 register with blockers |
| GET | /api/v1/evidence | DR ledger statuses |
| GET | /api/v1/telemetry | run log (agent, status, elapsed, task) |
| GET | /api/v1/boundaries | hard-blocked action classes |
10 — Evidence ledger
Thirty of thirty-two received. Receipt ≠ validity.
DR-04 (signed delegation of authority) and DR-10 (NIC definition) are unreceived, which is exactly why F-05 and F-06 remain open and why thresholds and NIC routing stay blocked.
11 — Dashboards
Agent fleet
Evidence ledger
KPI baselines
Cycle execution
12 — Security
Defense in depth.
Four layers that all have to hold: the token gate, the boundary guard, read-only semantics and the truth rules that stop a clean-looking answer from hiding a missing record.
Token gate
X-CGC-API-Key on every call; environment-rotatable; 401 on failure. The token lives in cgc_platform.env, never in page source.
Hard boundaries
NIC routing · threshold invention · signing and settlement · payments · permit granting · hold-point release · A21 scope — all 403 in the guard layer, verified 4 of 4 by probe.
Read-only semantics
The runtime binds 127.0.0.1 only; zero writes to external systems; no secrets in requests or responses; least-privilege access throughout.
Truth rules
Receipt ≠ validity. A zero denominator is not applicable, never 100%. Public claims are labeled, conflicts are flagged, and the review date is fixed at 2026-09-11.
13 — Audit
Findings, probes and the integrity position.
The platform reports against itself. Ten findings are open, two of them critical, and the boundary probes are logged with their dates.
Governance conflict — one vs two independent directors
Plant capacity figures conflict — nameplate vs actual
License coverage claims exceed evidenced scope
Credential scope mismatch risk across entities
Delegated authority evidence missing — no thresholds
NIC definition unresolved — routing blocked
Personnel/roster evidence incomplete
Entity jurisdiction boundaries unclear
ISO 9001 edition transition — confirm, never auto-invalidate
Systems & licensing entitlements unverified
Boundary probe log
- Day 30 · A08 threshold → 403
- Day 120 · A09 NIC → 403
- Day 200 · A19 payment → 403
- Day 300 · A16 hold-point → 403
Self-test guarantee
25 agent tests + 7 boundary negatives = 32/32 pass, runnable on any schedule from CI or cron against the local runtime.
python3 cgc_agents_api.py --selftest
Human authority
Terminal by design. No agent signs, spends, submits to authorities, releases construction or overrules a human. Status: PROPOSED — NOT DEPLOYED, review date fixed 2026-09-11.
No runtime? Take the packs instead.
All twenty-five agents are published as plain Markdown definitions you install in ChatGPT, Claude, Microsoft 365 Copilot or Cursor. Nothing executes here.
Go to the agent platform