Architecture
The shape of the system. Five layers top to bottom, three agent families that compose top to top, and three primitive envelopes that make every claim citable and every action auditable. The same machine OpenEvidence, Harvey, and Palantir built for medicine, law, and operations, now for the physical world of food systems.
The same machine, a new domain
OpenEvidence (medicine), Harvey (law), and Palantir (operations) look like different products. Strip the domain away and each is the same machine:
- a curated, provenance-tracked corpus behind a trust boundary, never the open web;
- a semantic layermapping heterogeneous sources into canonical entities, relationships, and cited properties (explicit as Palantir's Ontology · implicit as a “patient” or “matter” in the others);
- reasoning grounded by construction · every claim traces to a source · the model reasons over governed evidence, never free-generates;
- locality as a property, not a fork· Harvey's jurisdictions, our per-state water law;
- governance · permissions, write-back, audit.
Their moat is never the database. It is the corpus plus the grounding fidelity plus the semantic layer. Anymal OS is the same machine for the physical world, and the place (the parcel) is the patient. What we add on top: a triplet of agents that observe, act, and attest, plus a rail that lets the attestations cross the trust boundary into the open economy.
Five layers, top to bottom
Four layers run today. The fifth is what makes the others portable, payable, and independently verifiable.
A trust rail for agent-to-agent verification. Notaries sign and anchor claims any party can verify without trusting our database. Payment, attestation, and on-chain anchor in one atomic flow.
Role-specialist agents that run real operations end-to-end. Each Anymal handles one function (Contract · Supply · Compliance · Logistics · Banking · Settlement · …) and drafts moves for human approval, grounded by SpineFacts.
Domain-specialist agents that watch over a place and know it. Water · Land · Soil · Carbon · Cattle. Each Sage composes typed SpineFacts about a domain, with source, vintage, and confidence on every fact.
One parcel-anchored, source-cited graph all agents read. Entities and relationships are explicit. Every property carries provenance. Storage sits beneath the ontology, sized per job.
Government, open, licensed, satellite, and sensor data behind a trust gate. Quarantine, then promote. Locality lives here · one adapter per jurisdiction, one shared ontology.
Storage sits implementation-side beneath layer 2: a hot Postgres spine for lookups, vector tiles for drawing polygons, columnar geospatial compute at national scale. Onboarding a region is “register an adapter,” not a schema change.
The triplet · Sages, Anymals, Notaries
Three families of agents. Each emits one primitive envelope. Each builds on the one below it.
SpineFactsDomain-specialist agents on the Earth Layer. Each Sage watches one domain (Water, Soil, Land, Carbon, Cattle) and emits typed, cited evidence.
CasesRole-specialist agents on the Operations Layer. Each Anymal handles one operational function and drafts moves grounded by SpineFacts, recorded as a Case.
AttestationsSpecial Anymals on the Proof Layer. Each Notary signs a claim, anchors the proof on Solana, and bears reputation in its wallet.
The catalog of who lives where is on Agents. This page is about the envelopes they emit and how the envelopes compose.
SpineFact · the citation envelope
A bare value is data. A value that carries its provenance (source, vintage, confidence) is a SpineFact. Every claim a Sage emits ships as a SpineFact, never a raw scalar.
type SpineFact<T> = {
domain: "carbon" | "water" | "soil" | "land" | "cattle";
fact: string; // what claim
scope: Scope; // what subject (parcel, ranch, county, …)
value: T;
source: { authority: string; dataset: string; url?: string };
as_of: string; // vintage of the underlying data
observed_at?: string; // when WE fetched or derived it
confidence: number; // 0..1
trust?: "authoritative" | "derived" | "candidate" | "quarantined";
method?: string; // for derived facts: how it was computed
}No SpineFact, no assertion. The agent cannot state what it cannot cite. Enforced by the type, not by a prompt.
By as_of (recency) and confidence, the way a clinician weighs study grade or a lawyer weighs controlling vs persuasive authority.
as_of drives refresh, feeding the self-extending pipeline that re-sources a fact when it ages out.
A model output is trust: "derived" with a method citation, never laundered into an authoritative number.
The Evidence Ontology · entities and relationships
The anchor is the Parcel (a county-qualified id), then withinCounty, then withinState, where the legal regime lives. A location or address resolves to a Parcel. Evidence entities attach to it, each property a SpineFact:
Relationships are first-class links. A Parcel is servedBy a WaterRight (place-of-use intersect), hasSoil a SoilUnit, hasCover a LandCover, and is a memberOf a Holding. A WaterRight is governedBy a State. Agents reason over entities, links, and SpineFacts · never raw tables.
Two anchors, one system
The ontology has two anchors. The parcel anchors the physical world · the shape that ties soil, water, cover, and carbon to a place. The Anymal ID anchors the biological asset · the identity that carries an animal's whole history. Where, and who.
Soil, water, cover, carbon, and the legal regime attach to a county-qualified parcel. The Sages reason over it.
A persistent identity per animal, with a lifelong, append-only record of health, compliance, movement, evidence, Cases, and audit. The Anymals act on it.
Parcels and Anymal IDs are joined by occupancy · which animals live on which parcel, when.
Case · the operational envelope
A Case is what an Anymal runs. It is an immutable, evidence-rooted record of an intent, the SpineFacts that ground it, the actors who touched it, and every move that happened. Cases are the operational journal of the system.
type Case = {
case_id: string;
intent: string; // natural-language ask
scope: { kind: "ranch" | "parcel" | "holding" | …; id: string };
record_type: "sale" | "transfer" | "diligence" | "compliance" | …;
effective_date: string;
evidence: SpineFact[]; // grounding, attached at open
actors: { anymal_id: string; principal_id: string }[];
moves: CaseMove[]; // append-only log, every action cited
status: "open" | "executing" | "closed";
attestation_ref?: AttestationRef; // when notarized
}One evidence base sits under every Case, like a control system. That shared anchor is what makes human and agent coordination safe.
Anymals draft and coordinate the steps. A person confirms. No irreversible action without authorization.
Each CaseMove carries the SpineFacts it acted on. The whole timeline is replay-grade.
When a Case closes and a counterparty pays for proof, the Notary lifts it into the Proof Layer as a signed, anchored Attestation.
Attestation · the proof envelope
An Attestation is what a Notary publishes. Raw evidence stays off-chain. Only the compact proof artifacts cross the boundary.
type Attestation = {
request_id: string; // the counterparty's diligence request
payment_tx: string; // Solana tx that paid for proof
evidence_root: string; // Merkle root of cited SpineFacts
proof_hash: string; // tamper-evident binding of inputs
attestation_hash: string; // the signed claim itself
issuer_wallet: string; // the Notary
status: "valid" | "revoked";
timestamp: number; // when it was anchored
}A counterparty (a lender, an insurer, a regulator) verifies a claim by reading the on-chain Attestation and re-checking the proof hash against the issuer's evidence root. They do not need access to the underlying Cases or SpineFacts. They do not need to trust our database.
Composition · how a claim moves through the system
The three envelopes compose. A SpineFact lifts into a Case. A Case lifts into an Attestation. Each lift adds context and signature without losing the citations beneath.
SpineFact[] ─┐
│ (Anymals run a Case grounded by these facts)
▼
┌─────────┐
│ Case │ intent · scope · moves · status
└────┬────┘
│ (Counterparty pays the Notary; Notary asks Sages,
│ packages the citations, signs)
▼
┌──────────────┐
│ Attestation │ evidence_root · proof_hash · issuer · anchor
└──────────────┘
│
▼ anchored on Solana
lender · insurer · buyer · regulator
verify independentlyA concrete walk-through · cattle-collateral verification:
- The Cattle Sage emits SpineFacts about life, breed, location for the herd in scope. The Carbon Sage emits SpineFacts about forage and headroom for the parcels in scope. The IDx Registry emits SpineFacts about ownership and holdings.
- An Anymal on the lender side opens a Case · scope: the herd, record_type: diligence, evidence: the SpineFacts above, moves: the underwriter checks.
- The Anymal Notaryreceives the lender's payment on Solana, walks the Case's evidence into an evidence root, signs the Attestation, and anchors it.
- The lender verifies the Attestation themselves · payment confirmed, proof hash matches, issuer wallet is the Anymal Notary, evidence root is non-empty. The claim is now a bearer instrument they can hand to an insurer or a regulator.
The triplet, in the live backend
The three families aren't just brand words · each one becomes a concrete surface in the running anymals-backend. Sages live as enrichment surfaces over an animal's context. Anymals live as Cases, Workflows, Tags, Lots, and Ranch operations. Notaries live as Audit and signing. Same animal, three families of endpoints.
Enrichment + per-domain knowledge. Each Sage produces typed, cited evidence on demand and writes it back as section subdocs the rest of the system reads.
Cases, Workflows, Tags, Lots, Ranch ops. Every move is a Case scoped to an animal or a herd, grounded in the Sage facts above, drafted by an Anymal, confirmed by a human.
The append-only chain plus the signing primitive. A Notary reads the chain end-to-end, packages the citations, and binds a payment to a signed Attestation.
Mongo holds the canonical record · Firestore projects the live view · REST handles mutations and bounded queries. Same shape powers the IDx reference app, the ranch dashboard, and the per-animal page at /anymal-id. The full spec lives at anymals-dev.petastic.com/openapi.json.
Reasoning at scale, globally
Precompute evidence rollups (county-level summaries). The Sage reasons over curated digests and fetches raw evidence, with citations, only on drill-in. This is how OpenEvidence stays tractable over the whole literature.
as_of lets reasoning prefer fresh evidence and trigger re-sourcing when a fact goes stale.
The ontology is invariant. Locality is a property. A new country (e.g. Australia · NSW water licences) plugs in as an adapter mapping to the same entities. The Sages don't change.
The moment a fact loses its source, vintage, or confidence it stops being a SpineFact and the thesis leaks. This is the one discipline never traded for speed.