System Design

Persisting has two primary product domains:

• pVisor virtualizes and governs Agent execution;
• pChronicle organizes durable trajectory Sources into queryable Datasets.

pPilot extends pVisor from one Run to many. Gateway, OverlayFS, and OverlayNet are pVisor runtime mechanisms. Where available, stable Run identity connects the domains, but each also has a standalone entry path.

Cross-product contract

Configured pVisor capture
  Gateway trajectory events ─┐
  pVisor lifecycle records ──┴─> canonical event Source ─┐
Pinned external Sources                                  │
  ATIF / ACTF / OpenAI Messages / Storyline ─────────────┴─> Catalog Snapshot
                                                               └─> normalized Dataset views

Attempt finalization writes a private, versioned Run Bundle and leaves Effects staged for later review/apply/drop without pChronicle. Configured capture sends Gateway trajectory events and pVisor lifecycle records, including the Evidence those records carry. The full Bundle and its Artifact, lineage, Effect, and broader Evidence inventory remain local unless moved separately.

External file and Storyline Sources are pinned and normalized directly without passing through pVisor or becoming canonical events. Each path retains source-specific guarantees; ingestion does not add Evidence that its Source did not provide.

Concern	Owner
One Run's execution boundary	pVisor
Planning and recovery of many Runs	pPilot
Model, network, and filesystem runtime drivers	pVisor
Canonical events, terminal facts, and Dataset history	pChronicle
Query, exchange, and revision lineage	pChronicle

Continue by question

• Complete architecture and target model
• Local-to-fleet continuity
• Security and evidence model
• pVisor implementation boundaries
• pChronicle implementation boundaries

Delivery state is reported in the product Design pages and Project Engineering Notes. Target architecture is not evidence that a capability is implemented.