Support Dark Factory · Serdica estate

The trainable intellect that operates the systems behind your products.

People teach it how their products and systems work. Their expertise becomes reusable skills and verified knowledge, refined through reviewed results. They define the outcome and authorise consequential changes; AISA carries out configuration, development and support, checks the result and retains what the next case needs.

Design specification · platform implementation has not started. The screens below are concepts grounded in past cases.

How it works

One platform carries the work across the systems it touches.

A request arrives on a channel the customer already uses. The platform opens a durable case, issues its grants and starts its clocks. The Support root classifies and identifies it; trained agent profiles work it, in the module the work belongs to, across every system it touches. Between decisions the software proceeds within its authority.

Hover or focus a module for its flow. Open a module for its purpose and operating model; each stage links to its technical explanation. The platform opens as its own diagram.

The middle of this picture is the product. The top and the bottom are the Bulstrad case study. The platform is for complex products — products that span many services, systems and procedures — whatever administers them. Bulstrad on Serdica and IPAL is the case study this page draws. A second customer replaces bricks and not the building: its channels, its systems and their connectors, its clocks, its environments and its field catalogue are the plug-in.
Input channels · For Bulstrad case study
Jira ServiceDesk Mailbox HelpDesk (OTRS) Serdica UI … or any other
The platformthe part that does not change per customer or complex product UI · Backend · Agent framework · Agents and their graphs · Knowledge domains Platform diagram
Every case, whichever module works itHover a module above for its stages. Click a stage to read the relevant stage in the technical documentation.a person decidesa signed resulta person decides on a signed resultafter the workflow · asynchronous · dashed = conditional step · paired = parallel branch

The same seven steps carry a support case, a configuration case, a data correction and a code change. What differs is the stage set inside „agents work“ and where each gate fires. That is why the platform carries all four modules.

The desk decides whether and who; the working module decides how. Waiting is a route, not a gap: a wish for the next release or a step only the customer can perform is held with its reason, its clock treatment per the contract and its age visible — 148 fixed tickets sat in Pending without a resolution date, and a held write backlog sat for twelve weeks. Whichever module does the work, the case, its clocks and its closure stay with the desk, so the customer hears one voice.

The two branches of phase 2 prepare their work together. Shared labels and returned identifiers still impose dependencies on individual writes. Each phase ends with its own tests passing and a sign-out document that the next phase reads instead of its transcript. Driving the sales wizard needs both branches, so quoting and issuing are proved once, together. The chosen deployment follows preview proof and remains part of the case until the target result is verified. Accepting a preview does not mean accepting an undelivered release.

Investigation is what happens when there is no ready solution. A case an existing skill covers, or one memory and the experience index answer, goes from the desk straight to the take and never investigates — which is the whole point of precipitating recurring work into skills. When the answer does not exist, the case leaves the take, works the databases and the source until the mechanism holds, and returns. A phase that found nothing is recorded as „ran, found nothing“, which is evidence, and never as skipped, which is a gap. The verifier receives the evidence and none of the reasoning: it is the direct countermeasure to the three retraction cycles. A case that turns out to be configuration or code goes back to the desk, which raises the handover. Closure is the desk’s; precipitation runs when the working stages end and does not wait for it.

Systems connected · For Bulstrad case study
Serdicathe suite the customer's insurance systems run on — and the suite this platform is built insideConfiguration · Data and information · Development
The incumbent systemoutside the suite, with its own document and interface servicesData and information
Infrastructurenot systems the platform configures — how it builds, delivers and observesthe platform's own operation
Authority comes from grants and gates, never from content. A ticket, a file or a database row cannot widen what a case may do — which is what makes the stretch between two gates safe to run unattended.

The desk makes the work explicit.

A request becomes one case with an owner, a reasoned route and visible waiting. The customer keeps one conversation while the required modules do the work.

The change in working practice is that people correct consequential decisions instead of finding, forwarding and supervising every request.

A configuration becomes something the customer can try.

Documents become a shared specification, a tested rating and a usable product. Preview acceptance and delivery to the chosen target are separate decisions in the same case.

The aim is for the customer to make routine product changes without waiting for a specialist to assemble the systems by hand.

An answer or correction carries its own proof.

The platform first checks for a usable skill or precedent. Where investigation is needed, it establishes the mechanism, applies an authorised correction and verifies the customer's actual symptom.

Knowledge becomes repeatable work that does not depend on the one person who remembers how to do it.

Small changes stay close to the customer's need.

A change starts on the code the customer runs. The platform proposes its placement, prepares and tests it, uses the estate's release process, and verifies what is actually serving.

Customer-specific fixes can move within their approved scope. A core product change still belongs to the owner's development process.

Estate · Insurance systems

Two policy administrations, a rating engine, a process engine.

One product lives across all of them, per environment. The platform configures, investigates and repairs them; it does not replace them. Every access goes through a connector under a grant that is refused before contact.

How the estate is reached

  1. Only through connectors, one per system, per environment scope, with a capability description per operation: input, target, expected effects, authorization, timeout behaviour, recovery. An unlisted operation is a capability gap to escalate, not a call to improvise.
  2. Under grants refused before contact. A case opened as an incident holds read grants and nothing else; a data fix needs a gate; a second, unshown statement is refused before the connection is used.
  3. Per environment as a real credential boundary, so a case opened against a test environment cannot reach production even if every other detail is right.
  4. Simulation first, except for changes both very small and without blast radius; the exemption has five conditions and is recorded in the plan.
  5. Effects no transaction covers are named: process instances, queue messages, generated documents, consumed numbering, external registrations — compensable or irreversible, declared per step before approval.

Facts

  • Configuration for one product lives in four places in two databases with no foreign key between them. Nothing enforces consistency, and two of the four have no maintenance screen.Product Configurator Requirements § 01
  • The rating call computes a quote without changing policy data, so it supports the repeated checks in configuration and pricing work; its operational effects are declared by the connector.Stage Abacus
  • The rating engine prices only a deployed version, so a version on the working environment can be tested under its declared scope and effects — and the deployment set to customer-facing targets stays a separate, role-gated act that names every version consuming a changed file.Product Configurator Product design § 05, decision D113
  • Code changes to the incumbent system stay change requests to the customer. Data corrections under a grant are the whole write scope there.Non-Goals N-1, N-10
Estate · Engineering

The platform prepares. The estate's mechanism executes.

Build, push and deploy are the estate's own pipeline and job; a deployment agent resolves the right job by a per-environment rule and triggers it once the target gate is passed, while the operations team keeps the rights and the compose units. Database changes the platform prepares are applied by its own write executor under the DDL gate, with the identity the database administrator grants. The platform records what ran and verifies the runtime.

Who operates what

  1. Operations: build, push, deploy, container restarts. The platform is one more unit alongside the existing services.
  2. Database administration: the identities, their rights and the backup inventory; the platform's own schema is created by the DBA once; estate PL/SQL changes are applied by the write executor under the DDL gate, always a human decision.
  3. The customer's IT: network and the agreed identity/operational prerequisites — the platform's six roles are rows it adds itself and Authority issues as claims, so there is no directory request; a direct route the reach probe finds closed becomes one specific network request.
  4. The platform team: a reachability probe on first deployment; every connection is direct, and reach per target — reachable or not — is written as data; a closed route becomes one specific, named network request.

Facts

  • The minimum alert set raises into the existing log channel: ledger export lag, connector health, budget hard-stops, gate escalation, a red eval set, parked-case age, the kill switch flipped.Software Architecture § 10.5
  • Secrets never reach the repository or a model. Files read from a worktree are scrubbed before a model sees them.Trust and Data § 4
  • The QA database — the environment the platform runs on — had no working backup on 02.09.2026 (last RMAN 26.07.2024, failed). Restoring it precedes the platform's schema; until then the 15-minute off-database export is the only durable copy.Software Architecture § 10.5
  • The process engine is a configuration target, not the agents' orchestrator. Agents control their own jobs.Non-Goals N-4
Goals · Proof

What this operating model should change.

The first two columns describe the existing work: archive observations and adjusted planning estimates. The last column states targets for the platform to be built. They are a way for the owners to judge the operating model, not results already achieved by AISA v2.0. One goal is common to all four: stages that can be isolated and tested one at a time, and gates that a person answers while a work type is learning and that policy answers once it is proven. Human effort is expressed in hours; no monetary figure appears.

ModuleBaseline · by handBaseline · current agentThe goal, and how it is judged
Support — the rootevery request, at the desk Every ticket is classified and answered by hand, and the conversation with the customer is a phase of every one of the 330 tickets that carry one. 148 fixed tickets sit in Pending without a resolution date, and an approved write backlog sat at 39 of 51 issues for twelve weeks.Support Module § 0.2Data and information § 0.2Stage Classification § 1 The agent classifies on request and drafts the reply — about 7 ticket folders per working day with a median of 3 human turns, on one machine, for the ticket a person hands it. Nothing watches the channels, and nothing decides what can wait.Baseline § 2–3Metrics No operator on duty at the desk: every request classified, identified and routed the moment it arrives, its clocks running, and what can wait held with its reason and its age. Judged by: the classification correction rate and the re-routing rate; breach warnings raised ahead of the violation; no case waiting without a recorded reason; human turns per case falling to gate decisions.Support Module § 1–2Metrics
Configurationone product or tariff change 9–11 days median to close a configuration or master-data request, against 1–2 days for a correction, over 175 customer-closed tickets. A written specification covers 4 to 6 of the 12 configuration parts, so the rest is discovered per surface.Data and information § 0.2Configuration goals CG-2 There is no configuration agent. This is manual labour. A person reads the documents, decides the configuration, writes it and executes it, across four surfaces in two databases with nothing enforcing consistency between them. The one end-to-end machine run — product 9951 — was a single-purpose sibling on one environment, with no sessions, no gates, no audit and no deployment stage.Baseline § 6 From files and a short conversation: a product preview within a business day, and customer acceptance within five business days. Judged by: elapsed time from intake to a preview the business can look at (target one business day); elapsed days from intake to customer acceptance against the 9–11 day median (target five business days); unresolved items at the specification gate (at most five) and at close (none); zero unreachable-product incidents.Configuration CG-13Metrics
Developmentone change 106.75 developer-days estimated over 46 dual-estimated rows of one delivery file; the change-request schedule at 179 days. A customer-specific change waits behind vendor communication and the full change procedure.Baseline § 3 49.5 developer-days on the same rows — 2.16×; 2.5× personally over one month; the schedule at 136.1 days, −24 %, on technical phases only. A median of 18 human interventions per session.Baseline § 3Metrics Any small or customer-specific delivery inside hours or days, safely — instead of vendor correspondence and a long procedure. Judged by: elapsed time from brief to a verified deploy on the named target; human interventions per case; share of changes landing entirely in customer-specific seams (target 80 %, every shared-code landing with a recorded proposition); the port to master opened within a business day of production verification; reverts at most one in twenty deploys, executed within the hour.Development DG-9Metrics
Data & informationone correction or answer About 40 minutes of a skilled person's own time on the median ticket (0.63 h, adjusted). One person leads 33 of 35 shapes, with half or more of the work on 25 of them; seven shapes have at most two holders with more than one ticket, and the team's own judgement adds print, multi-year, the three cargo families, currency and process registration as knowledge that sits with one or two people.Value and ROI § 2bData and information § 0.2 — knowledge holders 1.5 h of agent time (2.0 h measured, adjusted −25 %), median over 185 tickets with a reliable timing (02.09.2026), of which the operator spends roughly 15–30 minutes. It produces the written analysis, the ticket notes and the memory entry as by-products, and it runs on one machine at a time. Three retraction cycles came from pattern-matching a past ticket into a confident root cause.Value and ROI § 2bBaseline § 5 No reliance on person-specific knowledge: the work can run without any particular human. Judged by: the count of shapes with two or more operators who have closed a case with the skill; the seven thin shapes reduced to none and every shape closed by at least two operators; reuse recorded on at least 60 % of cases within two quarters; verifier and auditor at most a quarter of a case's reasoning; retraction cycles at zero; retrieval on held-out cases at or above 50 % top-5 hit-rate per domain, against the measured 10 % search baseline, before that domain is accepted.Support SG-3, SG-10Agents Memory and Skills § 7.2

What the platform holds, for all four

Platform

Autonomy that graduates

Consequential actions stay with people while a work shape is learning. Once a shape has three clean, person-confirmed instances and the auditor's pass, and the organisation has accepted the shape's risk class in a recorded decision, policy answers the same gate for that case type alone. One revert suspends the shape. Nothing customer-facing, irreversible or a schema change leaves the human set without an accepted risk class.

Gating § 9
Platform

Audit by construction

Every action lands in an append-only, hash-chained ledger. The chain head is sealed and exported off-database every 15 minutes. Metrics are parsed from it by tools, never counted by agents, and the database administrator is in the threat model for detection.

Architecture § 3.2
Platform

Knowledge confirmed before it is shared

What a case learns stays with the case. A reusable finding is a proposal and becomes shared knowledge on a human review or two independent uses, version-pinned. A domain is accepted only when its retrieval on held-out cases beats the search baseline of 3 hits in 30.

Agents Memory and Skills
Platform

Built for complex products, not for one estate

The subject is a product that spans many services, systems and procedures. Channels, systems and their connectors, contract clocks, environments and identifier patterns are the customer's plug-in; the platform, the four modules, the gate set and the ledger are not touched. Bulstrad on Serdica and IPAL is the case study.

Whitelabel Catalogue

What it is deliberately not — a policy administration system, a process engine driving the agents, new modules in Development, or autonomy the platform granted itself: the non-goals.

Technical documentation

The implementation specification, for developers.

Start with the developer guide: components and dependencies, the LLM action loop, durable execution, permissions and recovery. The stage pages carry the insurance-system detail. Facts, plans and open implementation evidence are distinguished.

Follow the 68 real case types through the screens, backend and agents: what proves the result, what is learned afterwards, and how the next similar request begins.