Six conceptual layers, one durable core
This is a conceptual model of how AIOS is structured — it deliberately does not describe or reflect the literal private deployment topology, hostnames, or infrastructure of any running instance.
Conceptual architecture, not a deployment diagram
Clients and adapters change. The gateway enforces the rules. The canonical knowledge underneath outlasts all of it.
AI Clients & Thin Adapters
ChatGPT, Claude, local models, voice interfaces, and future tools are treated as clients — replaceable interfaces, not the place knowledge lives. Client-specific adapters are meant to stay thin, translating a client's protocol into calls against the canonical gateway rather than holding their own copy of your memory.
Bootstrap & Governance
Before any project content is loaded, governance and security establish who is asking, what policy applies, and what fails closed if anything is ambiguous. See the layered bootstrap tiers on How It Works.
Project-Aware Gateway
A shared layer that performs discovery, deterministic routing, authorization, project-scoped search and retrieval, and governed mutation — for every authorized project, not one gateway per project.
Project Knowledge & Canonical Store
Each project's knowledge is isolated. Underneath all of it, durable, human-readable Markdown is canonical — indexes, embeddings, and runtime metadata are derived and rebuildable from it, not the other way around.
Deterministic, project-aware, fail-closed
- Requests are routed by subject and domain, not by whichever project a client happens to have open.
- Visibility into a project's existence does not imply access to it.
- A client's hints can suggest a project; they cannot expand what that client is authorized to do.
- Ambiguous routing fails closed rather than guessing at the "most likely" project.
- Cross-project fallback is prohibited wherever it would be unsafe.
- Routing and retrieval decisions remain server-controlled, not left to client-side logic.
What's authoritative, and what's disposable
This distinction underpins recovery, portability, and client neutrality: if it isn't canonical, it should be rebuildable.
Canonical
- Human-readable durable knowledge (Markdown)
- Governance and authorization policy
Derived (rebuildable)
- Search indexes and embeddings
- Connector and client runtime metadata
- Client-side caches
Curious about the narrow administration model, or how mutation is governed?
Security & Governance covers fail-closed authorization, least necessary authority, and the full governed-memory decision flow.