Domain-AdaptiveManufacturing

It standardizes the workflows, screens, and logic — the things that genuinely differ between companies and should be bespoke. And it leaves the primitives rigid and implicit — material, lot, operation, genealogy, measurement — the things that are actually universal and should be bedrock.

The result has weak opinions about physics and strong opinions about your daily routine. So the real process migrates into spreadsheets and tribal knowledge that live around the system, and the system of record becomes a fiction maintained for auditors.

The agentic era makes this affordable, because the cost that forced one-size-fits-all — human dev-years per customer — is collapsing. Build-once-sell-many only mattered when building cost human-years.

Two layers authored once. Two induced per tenant. One derived.

The kernel and the regulatory packs are written once and reused. The ontology mapping and adapters are induced or configured per tenant. The defaults are derived from archetype × risk. No layer requires a code fork per customer — which is what keeps "adapt to anyone" a product rather than a consultancy.

And it demotes your ERP: in the data fabric, SAP and the historian and the MES become sources and sinks among others, not the tyrants whose schema you must obey. The semantic center of gravity moves to the platform's open, customer-fit ontology. Run it over what you have; migrate authority into the ledger on your terms.

The startup grows continuously into the enterprise shape instead of hitting the traumatic replatforming cliff — the "rip out the spreadsheets and survive an 18-month SAP implementation" rite of passage. Removing that cliff is, by itself, a serious value proposition.

Spec-as-data. An IATF clause, an AS9100 requirement, a 21 CFR control, a HACCP critical control point, a control-plan line, a GD&T callout — each decomposes into atomic requirement nodes with stable IDs, bindingness, and revision. The manufacturing analog of an addressable standard.

Conformance bindings. Every part — a capability block, a control limit, a workflow, a generated screen — declares which nodes it satisfies. Bidirectional: node → implementing parts (coverage), part → nodes served (justification). Orphans and gaps fall out automatically.

Evidence, and a live posture. A tag is a claim; evidence is proof. Each binding links to design-time evidence and to runtime results streamed from the ledger — and carries live state: satisfied / at-risk / failing. Compliance posture is just another projection over immutable truth. No binder is assembled before an audit; the posture is always current.

A control signal, a capability drop, or an out-of-cal gage flips the posture — and the flip lights up against both the drawing node and the IATF clause at once, because both are computed from the same ledger facts. The auditor's compliance view and the engineer's process view are one truth rendered twice.

And because bindings are live and bidirectional, a spec change — a drawing rev C → rev D tightening the tolerance — emits a precise re-validation worklist: exactly the one affected part, nothing more. Continuous adaptation produces a scoped delta instead of a full re-validation.

If the entire bespoke surface is human-readable text under version control, the governance machinery is simply modern software practice: the human gate is a pull-request review; the validation envelope is CI — schema validation, golden checks, and the born-aligned conformance check; the audit trail is commit history; signing is your commit-signing policy; rollback is a revert; and the re-validation worklist is a CI job triggered when a requirement node changes.

Any platform-initiated physical action passes through a governed actuation contract — itself a representation-layer artifact: human-readable, schema-validated, signed.

The guardian that enforces on_violation lives at the certified layer, not in the platform — an out-of-envelope command is physically rejected regardless of what the cognition believes. And the human gate doesn't disappear at 3 a.m.; it relocates to design time. A human already approved exactly what the cell may do; at runtime it executes autonomously inside that pre-approved envelope.

The runtime's intelligence is boundary detection and safe degradation — recognize you're outside the validated domain, fail to a safe state, quarantine the WIP, page a remote human — never improvisation in a novel situation. Because lights-out removes the human who'd catch a bad config, "validate before deploy" for physical actuation means simulate against a digital twin first, not merely schema-check.

Left implicit, authority is the weakest link in the chain of trust: a gate is only as strong as the identity behind the signature, and a signature with no governed graph behind it proves nothing. So authority earns the same bedrock treatment as the fact ledger — a governed, event-sourced primitive in Stratum A, not a per-tenant access-control afterthought bolted to the surface. And the thesis applies to it exactly as it applies to everything else.

It threads the conformance layer with no new machinery. A clause like "special characteristics dispositioned only by qualified personnel" becomes a binding from a requirement node to an authority grant — and authority carries the same live posture as everything else. A revoked role or a lapsed qualification flips failing the instant it happens, lighting up against both the SOP and the IATF clause, because both are computed from the same ledger facts as an out-of-cal gage.

The same separations hold. The authority graph is declarative config — a representation-layer artifact: human-diffable, schema-validated, signed, revocable by revert. The exercise of authority is immutable events in the ledger — who did what, when, under which grant. Config and events stay strictly apart. And where authority gates a physical action, the check is evaluated deterministically and locally at the certified boundary alongside the guardian: an out-of-authority command is rejected regardless of what the cognition believes. No agent grants authority, and no agent sits in the path that enforces it.

The kernel ontology

The invariant entity set the reframe named in passing, now enumerated and closed at the kernel — extended open-world at the edges. Every concept carries a global, stable, opaque identity; extensions may subtype, add attributes, or add relations, but may never redefine a kernel concept, and each extension passes the same validation an artifact does. This is what lets "a customer adds concepts the core doesn't know" coexist with "the core is fixed."

The event envelope

The fact ledger is append-only, and every fact takes one shape. Fix that shape once and conformance posture, reconciliation, schema migration, and the audit trail all inherit from it. It separates event-time from ingest-time (the §18 time substrate), names the actor and the grant it acted under (§08), threads causation and correlation, version-stamps its own schema so it can be upcast forward and never rewritten (§11), and signs itself so the ledger is tamper-evident.

The block contract

A block is the unit of the engine — a validated, domain-blind capability, of which SPC is one. It declares the ontology types it consumes and produces, the conformance nodes it can discharge, the parameters a tenant configures (and which of those are unsafe to guess and therefore gated), and the envelope that validated it once. Composition is wiring blocks over the ontology by identity — not glue code — which is precisely why bespoke fit never becomes a forever liability.

The landscape, and who owns what

Every system below is a distinct integration with its own semantics and its own system-of-record (SoR). The platform does not seize authority on day one; it declares, per entity, who is canonical and in which direction truth flows. This table is the integration contract in summary form — each row decomposes into a binding artifact.

System-of-record arbitration

Master-data drift is where integrations rot. The platform's open-world ontology must co-exist with the ERP and PLM as authorities for years, not absorb them. So every entity carries a binding that names the SoR, the sync direction and cadence, the key crosswalk, the conflict rule, and the staleness budget at which conformance posture starts to warn. The SoR's authority is absolute on the entities it owns — the platform never silently overwrites SAP's material master.

Transactional writeback — the part that's actually hard

A running plant means the platform must post to the ERP and survive every failure mode: a confirmation that times out, a downstream rejection, a duplicate delivery, a partial batch. The writeback is therefore a governed contract in the same family as the actuation and authority contracts — idempotent (exactly-once effect, not merely once delivery), retried with bounded backoff, dead-lettered rather than dropped, compensated by an explicit reverse step when a downstream rejects, and reconciled against the ERP of record on a schedule to catch silent drift. Crucially it binds to an authority grant from §08 — posting a confirmation is an exercise of authority, logged to the ledger as an immutable event.

The order lifecycle

A plant runs on orders dispatched from L4 / APS, and the platform owns their floor-side state machine — receive, acknowledge, schedule, dispatch, run, confirm (often partially, many times), complete, close — with hold/resume and a rework branch that re-enters the line. Every transition is a ledger event bound to the responsible authority and the governing conformance nodes, so the order's history and its compliance posture are the same truth.

Standards at the boundary — open-world within

To make "run it over what you have" a product rather than a per-customer integration project, the boundary speaks a defensible standard even though the core stays open-world. The platform maps to ISA-95 / IEC 62264 objects — Production Schedule, Production Performance, and the Material, Equipment, Personnel, and Process-Segment definitions — and exchanges them as B2MML where the customer's middleware expects it. The ontology induces freely inside; the wire is standard. That single decision is what lets a new tenant connect to an existing ESB without a bespoke adapter per object.

Connectivity & transport

Real enterprises sit behind firewalls and route through middleware. The adapter posture is explicit: SAP via OData / BAPI / IDoc, the OT side via OPC-UA, generic systems via REST and durable message bus; reach into on-prem through a cloud-connector or edge agent; authenticate with OAuth2 client-credentials plus mTLS; ingest by CDC where a system emits change events and fall back to bounded polling where it does not; preserve per-key ordering so an entity's events never arrive out of sequence; and keep the privacy invariant that no personal or sensitive data is ever placed in a URL.

Identity federation

The authority graph of §08 is meaningless if it is a parallel directory. It federates: single sign-on via OIDC or SAML against the enterprise IdP, user and group provisioning pushed in via SCIM, enterprise groups mapped to platform roles, and a competency feed from the LMS standing behind the live authority posture — the source that makes "a lapsed qualification flips to failing" real. De-provisioning a person in HR revokes their grants and recomputes posture automatically.

Availability & disaster recovery

Recovery objectives are stated per data class, because the classes differ in kind. The fact ledger is the irreplaceable truth — near-zero RPO, replicated active-active, point-in-time restorable. Configuration lives in version control and recovers by redeploy. Projections are derived, so they are never backed up — they are rebuilt by replaying the ledger, which is why "compliance posture is a projection" pays off operationally as well as conceptually. The edge buffer from §18 is the partition-survival mechanism: it holds and drains in order when the link returns.

Upgrade & schema migration without a window

Manufacturing is twenty-four-seven; there is no maintenance window mid-batch. Because the ledger is append-only, its schema evolves by versioned event schemas with upcasting — old events are read forward, never rewritten. Because projections are derived, a projection schema change is a redeploy-and-rebuild, not a destructive migration of live data. The cognition tier deploys blue-green or canary, and platform rollback (revert the deployment) is kept strictly distinct from configuration rollback (revert a commit) — the two are different undo buttons for different layers.

Scale & cost envelope

This is the scale envelope named in §04, given teeth: the dial that turns per tenant while substrate, blocks, and engine stay identical. It states ingest throughput from a full historian, the latency budget for a live-posture query, ledger partitioning, retention and tiering, and a metered, predictable cost basis — so a startup and an enterprise run the same platform at honestly different settings.

Self-observability & the support model

The platform observes itself the same way it observes the floor: its health is a projection over its own events, with golden signals — ingest lag, ERP-posting success rate, posture-compute freshness, projection drift — each carrying an SLO and a live state. A breach pages on-call and opens an incident. This is the answer to the only question that matters at 3 a.m. — who do I call when it stops posting to SAP, and how do I know before the plant does? — and it is the same metabolism, turned inward.

Trust boundaries & data classification

Four boundaries matter, and the architecture already implies three of them. Untrusted ingested documents meet the generator. The determinism line of §07 is also a security boundary. Tenant meets tenant. Operator and vendor meet the platform. Data is classified and handled accordingly — facts, configuration, secrets, personal data, and regulated records each get a distinct regime: encryption in transit and at rest throughout, secrets held in a manager and never written into config or the ledger, and keys rotated under policy.

The agentic-generation threat — the one unique to this design

The onboarding agent induces configuration from SOPs, control plans, recipes, and supplier documents. That is an untrusted-input-to-artifact-generation path: a careless or poisoned document is an injection vector. The decisive point is that the governance machinery is the security control. The generator is sandboxed and holds no ambient authority — it emits proposals, never effects. Every proposal must clear the validation envelope, the golden checks, and the conformance check, then a human gate, before it can do anything. Each artifact carries provenance — which inputs induced it — and nothing generated acts before review. The stance that makes generation trustworthy is the same stance that makes it safe from poisoning.

The OT security line

The determinism boundary of §07 doubles as the security boundary, and it maps cleanly to IEC 62443 zones and conduits: the cognition tier and the certified layer are separate zones, and the actuation contract is the only conduit between them — already a signed whitelist with hard clamps. The guardian that rejects an out-of-envelope command lives at the certified layer, so defense-in-depth holds even if the cognition tier is compromised: there is no inbound path that bypasses the conduit, and no command executes outside the pre-ratified envelope.

Multi-tenancy & isolation

"One platform, every scale" rests entirely on an isolation model, so it is stated outright. Code is shared; data is not. The kernel ontology, the capability blocks, and the adaptation engine are shared as code across all tenants; the fact ledger, configuration, projections, data-fabric adapters, and secrets are isolated per tenant — which the ontology identity scheme already anticipates by carrying the tenant in every URN and every event. Cross-tenant access is denied by default, a tenant's generation is scoped to its own data, residency is per-tenant for sovereignty, and the per-tenant scale envelope of §11 is also the noisy-neighbor control.

Records & signatures

The signed-config plus immutable-ledger design is 21 CFR Part 11-shaped by construction: every event is attributable to an actor and a grant, contemporaneous by its dual timestamps, original and tamper-evident by signature, and audit-trailed by the ledger itself — the ALCOA properties fall out of the event envelope rather than being bolted on. What remains for a regulated deployment is procedural, not architectural; the same is true of GAMP 5 validation and ISO 27001 controls, which the block-and-envelope model and the governance trail are built to satisfy.

The cognition tier runs in a per-tenant cloud region (§12 isolation), the ledger replicated active-active for the recovery objectives of §11. It reaches the enterprise only through governed conduits — encrypted, authenticated, change-data-captured inbound and signed-config outbound. Each plant runs a thin edge agent that buffers and drains in order across a link loss (§18), holds local projections so the floor keeps working offline, and speaks OPC-UA to the historian and controllers. Below the determinism line sits the certified OT zone, a distinct IEC 62443 security zone whose only conduit upward is the signed actuation contract — and whose guardian rejects any out-of-envelope command regardless of what the cloud believes. Nothing in the cloud tier is in the interlock path; nothing on the floor depends on the cloud being reachable.

A block is validated once, by its envelope — golden checks, property tests, and twin validation, then signed; its instances inherit that validation. You qualify the generator together with the validation envelope it must pass, so any artifact that clears the envelope is trusted by construction rather than re-validated by hand. When a governing spec changes, the conformance layer emits a precise re-validation worklist — exactly the affected parts and nothing more — which is the mechanism that makes a continuously adapting system validatable at all. Any change that drives a physical action is simulated against a digital twin before deploy. For the regulated case, this maps cleanly onto risk-based GAMP 5: the block-and-envelope model supplies the documented qualification, and the conformance posture plus the immutable ledger supply continuous IQ/OQ/PQ evidence rather than a point-in-time snapshot. The remaining work is regulatory engagement, which §17 names honestly.

Statistical process control is one entry in the capability library — and it has its own invariant kernel, its own adaptation layer, its own tenant profile. The same pattern holds at the level of a single quality method and at the level of the entire platform: a fixed validated core, agentic adaptation, a governed bespoke surface.

That self-similarity is the strongest evidence the abstraction line is drawn in the right place rather than a convenient one. Build the platform and SPC is one of its first, best-defined capabilities. Build SPC well and you've prototyped the platform's whole metabolism in one domain.