Nothing becomes memory until a person says so.
The record under the Brief, Forge and Manage: its layers, the pipeline, the four human gates and the controls. This is what Nexora does, how it is enforced, and what it refuses.
Three layers. One source of truth.
An append-only event log is the authority. A property graph is projected from it for reasoning. A vector index finds candidates by meaning, and is never the authority.
Event log
Facts are never updated; a new event supersedes. The source of truth.
Property graph
Typed nodes and edges the product reasons over, projected from the log.
Vector index
pgvector. Finds candidates by meaning. Never the authority.
| The question | Pattern | Layer |
|---|---|---|
| Why does billing work this way? | Lookup | Graph |
| If I change this requirement, what breaks? | Traversal | Graph |
| What did anyone say about intercompany? | Similarity | Vectors, then graph |
| Which deliverables lack approval evidence? | Query | Graph |
| What did we believe in March that is no longer true? | Temporal | Event log |
Every fact is a typed, addressable object.
Session, evidence, requirement, conflict, decision, fit theme, delta item, blueprint section, test artifact, interface, risk, deliverable. Every node carries state, confidence, provenance, as-of, confirmed-by and supersedes. An object missing any of them cannot be promoted to memory.
proposed → confirmed → superseded
Only confirmed objects are memory. A draft is always labelled a draft.
IDs are never reused or renumbered. In the field, a renumbering done outside Nexora silently broke 278 conflict citations. Nexora's counter makes that failure impossible.
From a workshop to a signed blueprint.
Ingest
Parse, hash and chunk each session; flag capture gaps. Idempotent and resumable. A shared room microphone is flagged, never credited as a speaker.
Extract
One requirement per node, never compound, each cited to its evidence. Scored against hand-written expert cases; on a weak score it stops.
Detect and fit
Contradictions across sessions by exhaustive review, not similarity search. Themes checked against a pinned Best Practices baseline.
Adjudicate
A ruling pack goes to the owner: both positions, the evidence, a labelled root-cause hypothesis, candidate rulings. The ruling binds.
Graph
Confirmed facts and rulings become nodes and edges in the property graph, so Aiden can walk them and the impact of any change can be traced.
Blueprint
Assembled from fits and rulings; signed, then immutable. The signed version stays retrievable byte for byte, for as long as the system runs.
Regenerate
Scoped rebuilds: tests, change impact, BPMN, training. Only what the ruling touches; a person reviews the diff and commits.
Controls
Citation check, format steward, test evaluator, value manifest. Each one refuses rather than guesses, and says in plain words why it refused.
The Gatekeeper is the only way into memory.
Six conditions, checked twice: the application explains every refusal in plain language, and a database trigger guarantees it. A test fails if the two ever disagree.
| # | Condition | Why it exists |
|---|---|---|
| 1 | A named person confirmed it | Machine confidence is not ratification. |
| 2 | Requirements and rulings cite evidence | Without a citation it asserts what the record cannot support. |
| 3 | Every citation resolves | A citation pointing at nothing reads as support, so it is worse than none. |
| 4 | No superseded ground beneath it | Otherwise it is a confident fact on a decision that no longer holds. |
| 5 | Rulings carry rationale and rejected options | Six months on, the question is always "did we consider X?" |
| 6 | Confidence is stated | An unqualified assertion is the dangerous kind. |
Those who decide, and those who do, are kept apart.
| Role | Rule | Override | Sign | Commit | Produce | Read |
|---|---|---|---|---|---|---|
| Process expert | Yes | Yes | — | — | — | Yes |
| Process owner | Yes | Yes | Yes | — | — | Yes |
| Program lead | Yes | Yes | Yes | Yes | — | Yes |
| Change and training lead | — | — | — | — | Yes | Yes |
| Test lead | — | — | — | — | Yes | Yes |
| Viewer | — | — | — | — | — | Yes |
Every ruling has a name
Rulings bind, so each names a person who can be asked why.
Reversal is supersession
A new ruling replaces the old; the old stays readable in full.
Refused before written
A test lead attempting a ruling is stopped before anything reaches the record.
Signed means signed. Change means a new version.
When a ruling lands, only the sections it touches are rebuilt. The rest stays byte-identical, and v1.0 stays retrievable forever.
Immutable
v1.0 stays retrievable byte for byte, forever.
Scoped
Only what the ruling touches is rebuilt.
Committed
A person reviews the diff and commits it.
Governed
Each change feeds the change control board.
Tests that prove your design, not SAP's standard.
A pack that runs green and proves nothing is refused.
Test plan
Cycles, coverage and traceability from the signed blueprint. Test lead approves.
Test scenarios
One per process variant, each with an outcome a tester can see. Process owner approves.
Test cases
Steps, test data and the negative cases each rule implies. Test lead approves.
Results read
Results in, coverage-weighted maturity out, anomalies flagged. You sign the read.
Every section has a test; critical sections have two
An untested section is named up front, not discovered in UAT when it is expensive.
At least fifteen percent are negative
A rule that forbids something gets a test that tries it. In the field, 51% of 96 seeds were negative.
When something changes, see everything it touches.
Change Navigator
Every artifact a change touches, with its next version. The bar is 95% recall: a miss is the failure; an extra is noise a person can discard.
Change plan
Who is affected and how they'll react: named groups, today's real practice, honest resistance, then training mapped to ADKAR stages with behavioural objectives.
Process Cartographer
The current process drawn in BPMN 2.0, with layout, so it opens in Signavio, Cloud ALM, Camunda or Visio. Every step carries the requirement and ruling behind it.
Honest about coverage: "We can trace 7 affected artifacts; coverage in P2P is 40%, so there may be more."
Eighteen agents. Three roles. No self-approval.
Authors 12
Draft the work. Never approve it. Extractor, conflict detector, fit mapper, blueprint assembler, regenerator, test authors, change impact, brand steward.
Reviewers 2
Check every draft, on a different model from its author. The auditor confirms each citation supports its claim; the judge rules on quality.
Readers 4
Answer from the record. Never write. Aiden, navigator, documentarian, cartographer — every answer carries its citations.
Model choice is configuration
Each agent's provider and model is set in one file, never in code.
Evals on every agent
A regression gate runs on any model or prompt change.
Two providers, proven
The runtime is trusted only after two vendors pass with real keys.
Fit is measured against a baseline you declare.
Before a theme can be called standard or a gap, Nexora needs to know what standard means here. You declare the slice — platform, edition, release, region and the process areas in scope — and that pinned baseline is what every fit decision is checked against, so "fit to standard" means something specific rather than someone's recollection.
You dictate the scope
No baseline is assumed. Nothing is pulled until you declare what belongs in it.
References only, by default
The corpus stores scope item IDs, titles, taxonomy and your own embeddings. SAP's copyrighted descriptions are not copied — the safe default, and the one we ship.
Pinned, so fit is reproducible
A theme checked last month was checked against the same release it would be checked against today.
Sovereign memory, portable by design.
Every project declares one origin: fresh, inherit or consolidate. Consolidation raises every disagreement as a conflict and never picks a winner by precedence. Read-across stays within one customer — refused in code, and again by the database.
| Export | What it is |
|---|---|
| events.jsonl | Append-only log, the source of truth |
| graph.jsonld | Nodes and edges, regenerable |
| manifest.json | Counts and round-trip proof |
Nothing asserted that cannot be cited.
Citation check
Confirms the cited passage actually supports the claim before it is promoted.
Format steward
Restyles form only, with meaning guarded. Client-facing output needs a person.
Test evaluator
Turns results into coverage-weighted maturity and flags anomalies for sign-off.
Value manifest
Each value claim is measured from the record or attributed to who said it. Unbacked claims are refused; AI spend is reported against value.