The Org Solver.
Five dollars an hour,
aimed at half the company.*

A rented H200 is $5 an hour — less than the legal minimum wage, and it does not go home at 6 PM. Pointed at a chatbot it helps your receptionist write fancier-sounding emails. Pointed at the firm: up to half of an enterprise is compressible, because that half is coordination rather than content.

Watch what that half does all day. A person opens an application whose interface exists because a human needs eyes; behind it, the application queries a database. They haul a row the company already owns into their head, retype it into a spreadsheet, put it on a slide, and present it to other people in the same company — who take it back down and write a version of it into the database it came from. The data never left the schema. It is an organization paying salaries to pass notes to itself.

Now stack what the industry sells on top of that. The GPU serves the chat, the chat drafts the slide, and the slide only carries a row from the database back to the database. Copilot for PowerPoint is a frontier model helping you do faster the thing that should not happen at all. “Computer Use” is worse — screenshot a monitor, OCR the pixels, drive a synthetic mouse, to reach a row that was in the database the whole time.

In an AI-first organization there are three layers and no more. A data layer, where every fact the company owns already lives. An AI layer that acts on it directly — no interface, because nothing is looking. And a brain that decides where that layer looks and what it does about what it finds. Org Solver is the brain. It never writes the quote or adjudicates the claim; it decides which commitments get worked, by whom, in what order, and which ones stop and wait for a person.

ENIAC’s first job was ballistic trajectory tables — the scarcest compute on earth aimed at the one thing that decided a war. The first card an organization buys should not be aimed at its email.

An organization is an iterative solver, and its hierarchy is the preconditioner. On a substrate that relaxes the whole coupled system thousands of times a second, that preconditioner stops being necessary. What remains is a writ, a schema, invariants, warrant seats, a solver, a tape, and the residual — and the solver is resident: it starts once, holds every open commitment in VRAM, and stays alive until it is shut down.

The core, in three movements ↓ Every line Download the core The modules · MIT

There are two representations, and that is the whole trick.

The field holds every commitment in the company and a whole future fits in a single warp are both required, and they appear to contradict: a warp has about four kilobytes to work with and an enterprise has tens of thousands of open obligations.

They are both true, because there are two objects.

The projection between them is the bridge, and it resolves the contradiction cleanly: identity is a ledger property, flow is a lattice property, and only flow goes in the multiverse. A rollout does not need to know what the letter said. It needs to know the obligation went out on day three instead of day five and whether it cleared.

One decision inside the projection carries every replay claim in the system, and it is easy to get wrong. It accumulates in fixed point, never in float. A float atomic add is order-dependent, so the same ledger would project to a bit-different lattice on two runs, and every replay claim in the system would quietly be false. The falsifier runs the same ledger forward, reversed and shuffled and requires all three to be identical, and it confirms that the float version does differ — which is why the integer accumulator exists.

Storage is the deviation from a slow-moving baseline, not the level. A cell behaving like the incumbent stores a zero, so the residual — the thing you most want to read — is the primary object in memory rather than a derived one. That is the density trick from lattice-Boltzmann codes, transposed: spend the precision bits where the information actually is.

The sweep is red-black Gauss–Seidel, in place. Jacobi needs two copies of the field and converges more slowly on the same system; the colouring makes the in-place version parallel and order-independent at once. The diagonal is decay plus the incident couplings, not decay alone — dividing by decay is the classic way to make an unrelaxed sweep diverge on the interior, it looks right, and an independently derived reference is what catches it.

struct Commitment {
    uint64_t id;          // stable across ingest cycles; the systems-of-record key, hashed
    uint64_t opened_ns;   // when the obligation came into being
    uint64_t due_ns;      // when it must be discharged (0 = no deadline)
    uint64_t blocked_by;  // id of the commitment that must close first (0 = none)
    float    amount;      // magnitude in the class's own unit — money, units, cases
    float    margin;      // last judged margin; > 0 wants action, <= 0 is a hold
    uint32_t cls;         // decision class — the schema's type, not a department
    uint32_t seg;         // segment (a lattice tile)
    uint32_t seat;        // who holds it: a worker id, or 0 for unassigned
    uint32_t src_rev;     // the ingest revision that last touched it (the deposit clock)
    uint8_t  state;       // CState
    uint8_t  flags;       // CFlag bitfield — the whole type system in one byte
    uint8_t  verb;        // Verb, last emitted
    uint8_t  gear;        // 1 resident · 2 larger local · 3 leaves the box
};
static_assert(sizeof(Commitment) == 64, "Commitment must stay one cache line");
⋮@124 · 22 LINES — THE LATTICE'S DIMENSIONS AND ITS CELL INDEX
static const double FIX_SCALE = 65536.0;
OSV_HD inline int64_t to_fix(float v)   { return (int64_t)(v * (float)FIX_SCALE + (v >= 0 ? 0.5f : -0.5f)); }
OSV_HD inline float   from_fix(int64_t q){ return (float)((double)q / FIX_SCALE); }

struct Lattice {
    LatticeDims d;
    int64_t* load_fix   = nullptr;   // accumulated demand, fixed point, deterministic
    int64_t* count_fix  = nullptr;   // how many commitments landed here (fixed point for symmetry)
    float*   capacity   = nullptr;   // what the seats assigned here can discharge per slot
    float*   baseline   = nullptr;   // slow-moving incumbent reference
    float*   dev        = nullptr;   // THE STORED OBJECT: pressure - baseline
    uint8_t* flags      = nullptr;   // per-cell: warrant, exogenous, dirty
    // relaxation parameters — fixed at launch, never switched by size (one numerical path)
    float omega = 1.0f, decay = 1.0f, k_cls = 0.25f, k_slot = 0.25f, tol = 1e-4f;
};
⋮@159 · 20 LINES — THE SLOT RULE: OVERDUE IS MAXIMUM PRESSURE, NEVER NEGATIVE TIME
OSV_HD inline int project_one(const LatticeDims& d, const Commitment& c, uint64_t now_ns) {
    const int seg  = (int)(c.seg % (uint32_t)d.NSEG);
    const int cls  = (int)(c.cls % (uint32_t)d.NCLS);
    const int slot = slot_of(d, now_ns, c.due_ns);
    return cell_index(d, seg, cls, slot);
}

OSV_HD inline float step_cell(Lattice& L, int seg, int cls, int slot) {
    const int i = cell_index(L.d, seg, cls, slot);
    if (L.flags[i] & F_WARRANT) return 0.0f;              // a boundary condition is never relaxed

    const float d0 = L.dev[i];
    float lap = 0.0f, diag = L.decay;

    if (cls > 0)              { lap += L.k_cls  * (L.dev[cell_index(L.d, seg, cls - 1, slot)] - d0); diag += L.k_cls;  }
    if (cls + 1 < L.d.NCLS)   { lap += L.k_cls  * (L.dev[cell_index(L.d, seg, cls + 1, slot)] - d0); diag += L.k_cls;  }
    if (slot > 0)             { lap += L.k_slot * (L.dev[cell_index(L.d, seg, cls, slot - 1)] - d0); diag += L.k_slot; }
    if (slot + 1 < L.d.NSLOT) { lap += L.k_slot * (L.dev[cell_index(L.d, seg, cls, slot + 1)] - d0); diag += L.k_slot; }

    // the source term: unmet demand at this cell, relative to the baseline the deviation is from
    const float demand = from_fix(L.load_fix[i]);
    const float src    = demand - L.capacity[i] - L.baseline[i];

    const float r  = src + lap - L.decay * d0;            // residual of decay*d - lap = src
    const float nd = d0 + L.omega * r / diag;
    L.dev[i] = nd;

    const float moved = std::fabs(nd - d0);
    if (moved > L.tol) L.flags[i] |= F_DIRTY; else L.flags[i] = (uint8_t)(L.flags[i] & ~F_DIRTY);
    return moved;
}

        // --- pass 2: escalations under the human budget. Rank, take the top, and the rest HOLD.
        // The overflow is not silently downgraded to acting. It waits, and the waiting is counted.
        std::vector<int> esc;
        for (size_t k = 0; k < wants.size(); ++k) if (wants[k].v == V_ESCALATE) esc.push_back((int)k);
        std::stable_sort(esc.begin(), esc.end(), [&](int a, int b) {
            if (wants[a].value != wants[b].value) return wants[a].value > wants[b].value;
            return wants[a].c->id < wants[b].c->id;                 // deterministic tiebreak
        });
        for (int k : esc) {
            WarrantPool* pool = nullptr;
            for (auto& w : warrants) if (w.left() >= cost.escalate) { pool = &w; break; }
            if (!pool) {
                // THE SAFETY PROPERTY. No human left, so it holds — never acts.
                wants[k].v = V_HOLD;
                wants[k].why = D_BUDGET;
                ++R.budget_starved;
                if (wants[k].c->flags & F_WARRANT) ++R.warrant_held;
                continue;
            }
            pool->used += cost.escalate;
            R.warrant_minutes_used += cost.escalate;

A period engine has one clock. A controller has three.

Between real events the deterministic half of the field is extrapolated forward — deadlines advance, queues drain, dependencies release. When a real event lands, the field snaps to it, so error cannot accumulate across generated periods. Generated periods inform. Only real ones commit, and a generated one can never be cited as the provenance of a decision. The exogenous half — anything waiting on a counterparty nobody here controls — is never extrapolated at all, because that is the part of the world that is genuinely not ours to predict.

The exogenous flag is declared in the schema map, not inferred: osv_ingest.h L403, where a carrier is named as a counterparty nobody here commands.

It does not model a workflow. It declares when an obligation begins.

Ingest is a compiler. Change-data-capture rows in, commitment deltas out, driven by a schema map a human authors once per wire. The map is one of the few hand-written objects the design permits, and it says almost nothing: which table, which key, the predicate under which the obligation exists, the predicate under which it is discharged, and which columns carry the deadline, the amount and the seat.

inline SchemaMap olist_map() {
    SchemaMap m;
    ClassMap c;
    c.name = "order_fulfilment";
    c.source = "olist";
    c.table  = "olist_orders_dataset";
    c.key_col = "order_id";
    c.cls = 0;
    c.open_when  = Pred{"order_status", P_IN, {"created", "approved", "invoiced", "processing", "shipped"}};
    c.close_when = Pred{"order_status", P_IN, {"delivered", "canceled", "unavailable"}};
    c.opened_col  = "order_purchase_timestamp";
    c.due_col     = "order_estimated_delivery_date";
    c.amount_col  = "payment_value";        // via payments enrichment
    c.seat_col    = "seller_id";            // via items enrichment
    c.segment_col = "seller_state";         // via sellers enrichment (keyed through items)
    c.flags = F_EXOGENOUS;                  // a carrier is not ours to command
    c.enrich = { Enrich{"olist_order_items_dataset", "order_id"},
                 Enrich{"olist_order_payments_dataset", "order_id"} };

No workflow is diagrammed, no screen is mimicked, no application is puppeted. There is no computer use here — no screenshot, no OCR, no synthetic mouse. The user interface exists because a human needed eyes; there is no human at that node.

1. Enrichment is a left join that works whether the side tables arrive before or after the class row, because a real change stream gives no ordering guarantee across tables.
2. Monotonicity: an equal revision is an idempotent no-op and a lower one is refused rather than merged, so a full replay leaves the ledger bit-identical and a row from the past cannot silently rewrite the present. L313
3. Stable identity, as a pure function of source, table and key, so two ingesters never disagree about what a thing is. L186
4. Unmapped is named — a table nobody mapped is printed by name, not merely counted, because an ingest that is quiet about what it did not understand stops covering half the business without telling you. L305

A middle manager's product was four artefacts. Three of them are now a projection.

Not content — flow. A prioritised list, an assignment, a status rollup, an escalation. That is the entire product of a management layer, and three quarters of it is a readout. Dispatch produces the list and the assignment continuously, as a property of being resident. The rollup has no reason to exist once everyone reads the same object. Only the escalation survives, and it goes to a named human directly instead of climbing three layers to reach them.

Nothing here automates a manager. No bot behaving like one, no agent wearing the job. The role is deleted, because the artefact it produced is now a readout of a data structure — and nobody draws a salary for being a grid node.

One decision class, five verbs, and every open commitment receives exactly one of them every period: act, hand to a content worker, fetch more context, escalate to a human, or hold. The hold is a record with its margin, never a silence. A commitment nobody decided about is a decision made by omission, and it leaves no trace — which is the failure this whole design exists to prevent.

The budget is finite and the program says so. Adjudication bandwidth is a hard, serial, human number: so many minutes a period, no more. A system that escalates whatever it is unsure about does not compress an organization, it relocates the work into a review queue and calls the queue an improvement. So escalations are ranked by the value of the look, capped at the budget, and the overflow holds with a named reason — and the count of what nobody got to is printed. That number is the product. Hiding it is the failure mode.

Which produces the property the whole design rests on, and it is worth stating alone:

It emits three things and nothing else.

Committed actions, through an integrator that is the only writer. Every effect carries its inverse, so a commitment unwinds in dependency order when its forecast misses. Hazards are not forbidden by policy — the call for an irreversible obligation does not exist, so the path cannot express them. Warrant seats are boundary conditions, never grid nodes, which is why they survive.

Escalations, to a named human with a brief. Not a queue that three layers pass upward until it reaches someone. The person who has to decide gets the case, the margin, and the reason it reached them.

And a tape — hash-chained, append-only, every decision with its margin, holds included. The holds are the point. A commit-only log can never tell you where the organization almost acted, and that is exactly the signal an autonomous system needs and no enterprise log has. A commitment nobody decided about is a decision made by omission, and it leaves no trace — which is the failure this whole design exists to prevent.

The one number a model cannot game by becoming more confident.

Falling escalations, rising autonomy, and a shrinking headcount chart look identical whether the system is winning or whether it has automated a class that generates more supervision than it removes. Every dashboard number improves in both cases. That is not a reporting problem; it is the reason most of this industry's pilots produced no return and nobody could say why.

So the objective is not FTE compression. FTE compression is a readout. The objective is: minimise the instants that require adjudication, subject to the writ, and refuse any class whose automation creates supervision faster than it removes it. Supervision-minutes created per supervision-minute removed, per class, and above one the class is demoted no matter how good the model is — it may no longer act unattended, it escalates or it holds.

// The irony limit. Above this, automating a class makes the organization worse.
static const double C_A_MACHINE = 1.0;
⋮@145 · 1 LINE
struct ClassKappa {
    uint32_t cls = 0;
    double   created = 0, removed = 0;
    long     acted = 0, worked = 0, escalated = 0, held = 0, fetched = 0;
    long     budget_starved = 0;
    double   kappa() const { return removed > 0 ? created / removed : (created > 0 ? 1e9 : 0.0); }
    bool     cools_the_plant() const { return kappa() >= C_A_MACHINE; }
};

Two rules follow, and both are enforced in code rather than in a policy document. An autonomy count is never printed without the error rate of what ran unattended, because a field that becomes more sure without becoming more right produces exactly the same beautiful curve. And a kappa read before the outcomes have landed is a forecast: the removed side credits what a person would have spent, and only an arrived outcome can confirm the commitment did not come back. The report says so, in the report, every time. osv_dispatch.h L305

The middle is deleted, not automated.

Its whole function was to carry state between people who could not see the same thing at once. When the field is resident and everyone reads one object, the coarse grid is unnecessary. Concretely: no status reports, no rollups, no recurring alignment meetings, no coordinators, no dashboards whose only purpose is to tell one department what another is doing.

The individual work is done at the source. A resident worker reads the commitment's context straight from the database, does the content with a local model, and writes the result back through the fence. The row was always there; a person was reading it through a screen because a person needs eyes.

Four things survive, and they are not a consolation prize.

One distinction worth making before promising anyone a number. Departments whose driver is internal — they exist because there are humans to coordinate, onboard and correct — delete along with the coordination. Departments whose driver is external — a regulator requires the filing, a counterparty requires the attestation — do not. The obligation survives with a legal deadline attached; it simply stops being staffed.

One afternoon, no GPU, and the premise is measurable.

All of it rests on a single property: the organization's decision field is low-rank. A few hundred distinct decision classes and a few thousand genuinely open commitments explain a company of any size, and everything else is determined by law or policy given what is known, or is a copy of a decision already made somewhere else.

It is testable on any real event log with no card at all: build the open-commitment matrix from the tape and look at its singular values. The probe ships with the core, it checks its own instrument first — a planted rank-four matrix must read four, full-rank noise must read large — and its verdict thresholds are written in the source so they cannot be chosen after the number is seen.

Twenty-five falsifiers, each carrying a planted lie.

Twenty-five falsifiers pass on a synthetic world with planted structure. Each carries a planted lie that must fail, because an oracle that only ever passes is measuring nothing.

Fourteen of the twenty-five are in the two test files on this page; the rest are ingest's and the rank probe's. Every row above links into the line that runs it.

The whole thing, nothing folded away.

Pick a module. Click any line number to link to it; every reference on this page above lands here. Press / to search, Enter for the next hit, Shift+Enter for the previous.

Take it with you.

The bytes on this page and the bytes you download are the same — each hash below is computed in your browser from what you just read, so you can check it against what lands on your disk. Two headers, one .cuh, and the falsifiers that try to break them. The rank probe rides with the core. MIT: read it, build it, fork it, argue with it.

Build the falsifiers with g++ -O2 -std=c++17 osv_core_test.cpp -o osv_core_test — no card required, because the leaf is OSV_HD and the host build is the reference. The gate in this solver is fusord at one grid point; the kernel that says so, in full, is fusord.cpp. The substrate both belong to is FUSOR-1. What the residents are doing on an OPO floor is the watch; the record they watch is REGISTRAR.

If an organization buys one card, this is what it is for.

An enterprise that acquires a single H200 — or a B300, or rents one by the hour — is in the position the world was in when it had exactly one computer. That machine went to ballistic trajectory tables, because that was the one thing that decided the outcome. It did not go to correspondence.

And the arbitrage is not the price of compute. A card loses to an endpoint on any task that takes a turn — ask, answer, pay per token. What an endpoint cannot do at any price is stay. Per-token billing makes continuous presence economically incoherent; per-hour billing makes it free at the margin. You cannot fork a cache through an API, or read the logit that becomes a margin, or hold a company’s open state across a shift. That is a structural difference, not a discount.

Which is why the layer beneath you is the one to watch. The intelligence layer will be offered to you by whoever already hosts your data, and they will meter it, and they will book the margin on work you no longer have to staff. The compression is coming either way. The only open question is who books the savings. A firm that runs the field on its own card keeps its own alpha — its context, its workflows, the edge that made it worth anything. A firm that rents intelligence from its substrate takes the headcount reduction and hands over the surplus. That is how VMware was Docker’d: the value did not move to a competitor, it moved down, to the layer that made the boundary VMware sold irrelevant.

Start with one core wire. Order to cash, or claim to settlement — the whole wire, every commitment, with escalation to one named human and κ printed daily. Not a pilot on a slice: one wire proven end to end is worth more than ten departments assisted, because it is the only configuration where you find out whether deleting the middle works or merely relocates it. The second wire is a schema change, not a new system.