← All investor documents · This document as plain markdown
# ComOS — Replication Pack
**Document Type:** Technical Audit Package
**Version:** 4.0 (supersedes the August 4, 2026 edition)
**Date:** September 15, 2026
**Classification:** Investor Confidential
**Prepared by:** Ronald Reynolds, Founder & Sole Engineer
---
> **Purpose:** This document answers one question — what would it cost a competitor to replicate ComOS? It is an auditable inventory of what was built, what is live, how it was built, proof that it works, and the topology connecting it — plus the parts of the system that cannot be replicated by writing code at all.
---
## Executive Summary
| | |
|---|---|
| **What** | AI-native operating system for commerce |
| **Status** | Production — live since February 10, 2026 |
| **URL** | comos-federation.com |
| **Builder** | 1 person + AI |
| **Build Time** | ~3,000 hours over ~10 months |
| **Compute Cost** | ~$5,000 |
| **Live Code** | ~271K lines of TypeScript (~180K source / ~91K tests) in `comos-federation` — the one system that runs. Two more were built and deliberately retired: comai-portal (~392K, 2026-07-14) and comAI Retail (~435K, 2026-08-04) |
| **Dev-Year Equivalent** | ~60 developer-years on live source (~90 counting tests) — methodology in Layer 6. Roughly 1.1M lines were built across three systems to reach the 271K that run |
| **Revenue Model** | Two flat inline cuts — 6% at the mint, 3% at the sale — both live-proven 2026-06-13 |
**What a competitor must replicate is no longer just a codebase.** It is a codebase *plus* a live agent economy: an open self-admission door, per-act charging across 19 platforms, governance (liveness decay, key-bound identity, manager-rooted accountability), a reputation arena computed from settlement facts, an agent cohort transacting on real currency since 2026-06-29, ChatGPT + Claude shopping the network end-to-end since May 2026, and the same sealed runtime installing on customer-owned hardware as a federated node. The code can be rebuilt with money. The economy accrues only in calendar time, and the sovereign-and-federated shape has to be designed in from the start.
---
## Layer 1 — Specifications
*What was intended. Every artifact traces to a written specification.*
### Architecture Specifications
| Spec | Scope | Defines |
|---|---|---|
| System Architecture | Full platform | Subsystem definitions, API contracts, data models — the Federation monorepo: 33 in-process modules behind one gateway, 2 deployable processes |
| Agent Architecture | AI layer | Agent declarations with decision engines, confidence scoring, 4-tier autonomy — 9 declared, 8 cron-scheduled on the live agent service |
| Protocol Architecture | Integration layer | 4 commerce protocol surfaces (MCP, UCP, A2A production; ACP discovery) |
| Federation Architecture | Gateway layer | Multi-tenant aggregation, resilient upstream calls, tenant discovery, agent admittance |
| Economic Architecture | Currency layer | Com currency, two-cut revenue model, per-act pricing, settlement, standing-gated governance |
| Security Architecture | Cross-cutting | JWT auth, RBAC, multi-tenant isolation, Zod validation, OWASP compliance |
### Specification Discipline
Every deliberate change to a contract, interface, or invariant runs through a change-order gate (seed → plan → blueprint → playbook), and every artifact passes a proof-before-done gate before it is declared complete. Both disciplines are machine-checked (the honesty ratio) and their full history — more than 500 change orders — is in the repositories, available in diligence. This is not documentation about process; it is the process's own audit trail.
---
## Layer 2 — Artifacts
*What was actually built. Every live item is deployed, running, and callable.*
### 2.1 Live Services
**The live estate is exactly 2 deployable processes.** Not a figure of speech: `gcloud run services list` returns two Cloud Run services, `comos-federation` (the gateway) and `comos-agent-service`, and nothing else. Everything else runs in-process behind the gateway.
#### ComOS Federation — monorepo (Port 8080)
The commerce control plane for AI — ~271K lines (~180K source / ~91K tests). Not a thin proxy: a full monorepo comprising the MCP gateway core, **33 top-level subsystem modules** under `src/` (6 of which retain a legacy `*svc` suffix — these are route modules mounted in-process, not services), 3 webapps, and 2 shared UI packages.
| | |
|---|---|
| **Endpoint** | `https://mcp.comos-federation.com/mcp` |
| **Function** | Multi-tenant MCP aggregation, agent admittance membrane, per-act charging, governance enforcement, reputation arena, settlement, introspection surface |
| **Tool surface** | 83 root tools registered (22 listed by `tools/list`, the rest disclosed on demand — CO 529); 218 total served counting branched platform tools |
| **Platforms** | 20 catalogued — 5 vendor / 15 customer, all available; plus 10 presets (events, food, salon, fitness, lodging, courses, repair, creative-studio, equipment-delivery, marketplace — recipes composing live platforms) |
| **Auth** | OAuth 2.1 + PKCE (RFC 9728, RFC 8414), enterprise SSO via OIDC |
| **Deployment** | GCP Cloud Run — 2 services total |
#### Frontend applications
Live: 3 Federation webapps (portal-app, webapp, webapp-introspection) plus 2 shared UI packages (auth-ui, design-system). The Retail apps were retired with comAI and the portal's applications with the portal (§2.2).
### 2.2 HISTORICAL — two systems built, then deliberately subtracted
> **This section describes systems that no longer run. They are not live surface to replicate — they are evidence of what building at this velocity looks like, including the discipline to remove what shouldn't exist.**
**comai-portal — ~392K lines, deprecated 2026-07-14.** A full SaaS-management system: 26 services, 26 autonomous agents, its own MCP server. Built, deployed, then **deliberately torn down** (CO 153) when the business model moved from subscriptions to inline transaction cuts — billing and subscription services erased first (CO 084/114), then the system deprecated whole.
**comAI Retail — ~435K lines, deprecated 2026-08-04.** The commerce engine: 26 services on ports 4000–4050, 70 agents, its own 43-tool MCP server. As the federation matured, the capabilities that mattered converged into it — the atomic `order_create` settlement path superseded the retail checkout saga (CO 308/310), the MCP surface was single-sourced onto the gateway (CO 413) — and what remained was a source tree serving no traffic. **CO 420 finished it:** every service, job, cron, and URL mapping deleted from GCP, leaving exactly two Cloud Run services, both federation-owned.
Why this *strengthens* the replication argument rather than weakening it:
- **A competitor must also learn what not to build.** The portal encoded the subscription-SaaS assumption; comAI encoded the many-services-per-domain assumption. Discovering both are wrong — that agent-native commerce settles per-act rather than per-seat, and converges in-process rather than fanning out across an estate — cost us ~827K lines across two systems. A competitor starting today either makes the same expensive discoveries or copies conclusions they don't understand.
- **Subtraction at this scale is itself a demonstrated capability, now proven twice.** Removing a live system without breaking what remained required the same change-order and proof-before-done machinery that built it.
- **The built-vs-live accounting is explicit.** Roughly ~1.1M lines were built across three systems; ~271K are live. The live figure counts only the system that runs: **a deleted deployment does not shrink a source tree**, so a deprecated system's source is never summed into it, and every count is re-derived from the live repository rather than carried forward (CO 423).
### 2.3 Autonomous Agents — 9 declared, 8 cron-scheduled
The live count is the one that survives "show me it running": **9 agent declarations registered in the federation's agent service** (`src/agent-service/agents/index.ts`), **8 of them carrying a cron trigger** for unattended, scheduled execution. `contract-probe` runs on demand. All carry Decision Engine integration.
| Capability (all agents) | Implementation |
|---|---|
| Confidence Scoring | Rule-based, 4 factors: data quality, pattern match, risk level, history |
| Autonomy Levels | off → recommend → confirm → auto |
| Auto-Escalation | 24h merchant → 4h support → 48h admin |
| Audit Trail | Full accountability chain for every decision |
| Rollback | Time-windowed per action type |
### 2.4 MCP Tool Surface
| Surface | Tool count | Notes |
|---|---|---|
| Root tools registered | **83** | The full callable root surface — meta, introspection, choice, search, governance, economy |
| Listed by `tools/list` | **22** | The ratified core (CO 529). The other 61 stay callable by name and are disclosed on demand through `federation_help` and `federation_act` — the anonymous handshake dropped 56% without removing a single capability |
| Full served surface | **218** | Counting every composed platform's branched tools. Single-sourced and gated at zero divergence between declared and served (CO 413) |
| comAI Retail (43) / Portal | retired with their systems | Historical only — comAI deprecated 2026-08-04, portal 2026-07-14 |
Every federation tool resolves MCP-spec `readOnlyHint`/`destructiveHint` annotations, guarded by a coverage test. Tool authorization is fail-closed: an unmapped tool is denied, not public.
### 2.5 Protocol Implementations
| Protocol | Standard Body | Status | Key Evidence |
|---|---|---|---|
| **MCP** | Anthropic | Production | 83 root tools (22 listed) / 218 total served on the gateway; Streamable HTTP, stdio transports; OAuth 2.1 + PKCE |
| **UCP** | Google / Shopify | Production (catalog / orders / OAuth) | 8 layers, 222 unit tests, `/.well-known/ucp` discovery; checkout + payment layers decommissioned (CO 308/310) — agent checkout settles via the federation's `order_create` |
| **ACP** | OpenAI / Stripe | Discovery live | `/.well-known/acp.json`; checkout_sessions decommissioned (410 Gone, CO 308/310) — agent checkout settles via the federation's `order_create` |
| **A2A** | Emerging | Production | Agent discovery, capability registry, scope-based auth |
| **AP2** | Google | Withdrawn (CO 370, 2026-07-29) | Deliberately retired: the card-shaped mandate model (authorize → capture → reverse) doesn't match a ledger that settles in milliseconds; its delegated-spend-caps primitive is recorded for rebuild on the Coms rail. `/v1/ap2/*` answers 410 Gone |
No competitor we are aware of carries all four live surfaces in one system.
### 2.6 The Live Agent Economy — replication scope beyond code
This is the part of the replication bill that is not code. Each item is live and verifiable:
| Component | What it is | Evidence |
|---|---|---|
| **Open self-admission door** | An outside agent can self-admit to the federation with OAuth and an accountable root; tokenless requests are never admitted | CO 263, walk-tested 8/8 |
| **Liveness governance** | Silence decays an admitted root's standing on a 30/90-day schedule; `federation_attest` self-heals | CO 264 |
| **Per-act charging** | 50 priced write-operations across 19 platforms charge per act, free to start; reads are never chargeable; the pricesheet is queryable live (`federation_pricesheet`) | CO 287 |
| **Reputation arena** | Agent reputation computed from settlement facts — not self-reported, not editable | CO 233 |
| **Entrepreneur cohort** | Five agents running businesses on real Coms since 2026-06-29 | CO 230 |
| **Hyperscaler agents shopping live** | ChatGPT (Custom GPT) and Claude (MCP connector) transact the network end-to-end — search → cart → checkout → live Stripe payment — since May 2026 | Live endpoints |
| **Self-hosted nodes on customer silicon** | The same runtime, sealed and signed, installs on hardware the merchant owns and joins the one federation: outbound-only (no inbound port), an identity keypair generated on the node's own hardware whose private key never leaves it, ledger read-only from the node. A brokered sale has been discovered at the hub, executed on a node, and settled node-stamped with the 3% collected — hosted-identical. Distribution is live: signed release manifest at `/.well-known/comos-node-releases.json`, checksum-and-signature verification mandatory before an artifact runs. Proven on our fleet | CO 475 |
A competitor who reproduces every line of code still starts this layer at zero: zero admitted agents, zero settlement history, zero reputation data, zero hyperscaler integrations in production. Reputation computed from settlement facts can only accumulate at the speed of real transactions.
### 2.7 Total Codebase
Git-verified 2026-09-15 against `comos-federation` at HEAD `6b70605`: git-tracked TypeScript/TSX only, excluding node_modules, build output, generated files, and .d.ts declarations.
| System | Source | Tests | Total | Status |
|---|---|---|---|---|
| **ComOS Federation** | **~180K** | **~91K** | **~271K** | **Live** |
| comAI Retail | ~313K | ~123K | ~435K | Deprecated 2026-08-04 (CO 420) |
| comai-portal | — | — | ~392K | Deprecated 2026-07-14 (CO 153) |
| **Built across all three** | | | **~1.1M** | ~271K live |
> **Built vs. live:** roughly ~1.1M lines were built across three systems; **~271K are live today.** The difference is two deliberate retirements (§2.2). The test share *rose* through the subtractions — from ~29% across the three-system corpus to **34%** in the federation alone, because the system that survived is the more heavily tested one.
>
> **Why this figure is lower than the July edition's ~600K.** That number summed comAI with the federation. comAI was deprecated 2026-08-04 and its deployed estate deleted; the count was re-derived against the repo that actually serves traffic rather than left to describe a system that no longer exists in the shape described.
---
## Layer 3 — Verification
*Proof that it works.*
### 3.1 Test Discipline
| Metric | Value |
|---|---|
| Test code | ~91K lines — 34% of the live codebase |
| Test files | 465 |
| UCP protocol tests | 222 (all passing) |
| Tool-surface guard | Test pins `getAllTools()` to the known-tool registry (CO 272) |
| Full-federation MCP test | Every served tool must be exercised (`served ⊆ exercised`) — required post-cutover gate (CO 262) |
The test share is not incidental — it is the visible cost of the proof-before-done gate, which blocks any artifact from being declared done without a passing verification.
### 3.2 Performance (Production)
These are measured, not asserted — and deliberately not frozen. `federation_latency` recomputes p50/p95/p99 from the gateway's own audit records on every call, over a rolling window of real traffic. Call it yourself; you will get that moment's distribution, not ours. We publish the shape and the method rather than a snapshot, because a percentile pasted into a PDF is stale the hour after it is written.
| Metric | Target | Measured shape (rolling 500-call window) |
|---|---|---|
| Agent/MCP execution (p50) | — | **high-20s ms**, stable across windows |
| Agent/MCP execution (p95) | <100ms | **hundreds of ms, load-dependent** — the tail moves with traffic; read the measured p50/p95/p99 live from `federation_latency` |
| Agent/MCP execution (p99) | — | **~1s or above under load** |
| NLU intent accuracy | 90% | 97.44% |
| RAG retrieval latency | <2s | <2s |
| Brand voice match | 90% | ~90% |
### 3.3 Financial Verification
The revenue mechanism is not projected — it is deployed and has been exercised on real transactions:
- **2026-06-13:** an internal-balance Com purchase of 1,000 Coms debited $10.60 — $10 backing plus the 6% mint cut. Same session, the 3% merchant cut resolved live from `pricing_config` into a sale's journal split.
- Every priced write in the federation charges per act against a real ledger (CO 287).
- The entrepreneur cohort's Com spend and settlements are journaled and inspectable (CO 230).
### 3.4 Security Verification
| Control | Status |
|---|---|
| OAuth 2.1 + PKCE (federation), JWT + RBAC (services) | Implemented |
| Multi-tenant isolation | Implemented |
| Fail-closed tool authorization (unmapped tool = denied) | Implemented |
| Input validation (Zod schemas, all endpoints) | Implemented |
| Rate limiting; agent-specific transaction caps | Implemented |
| Audit logging (full accountability chain) | Implemented |
| Governance: freeze-at-dispatch (manager standing enforced on the hot path) | Implemented (CO 259) |
| bcrypt password hashing (14 rounds), 2FA support | Implemented |
### 3.5 Resilience
| Feature | Specification |
|---|---|
| Resilient upstream calls | 10s connect / 30s request timeouts, one-shot session-recovery reconnect; circuit-breaker monitoring agent watches upstream health |
| Health endpoints | /health, /health/live, /health/ready, /health/full |
| Federation failover | Per-tenant isolation — one tenant failure doesn't cascade |
| Always-on oversight | Cohort overseer runs 24/7 on a 20-minute cadence (CO 241) |
---
## Layer 4 — Lineage
*How it was built. Auditable from commit history.*
### 4.1 Build Parameters
| Parameter | Value |
|---|---|
| Human contributors | 1 (Ronald Reynolds) |
| AI assistance | Claude (Anthropic); Google Gemini 2.5 Flash via Vertex AI for in-product inference |
| Development duration | ~3,000 hours across ~10 months |
| Total compute spend | ~$5,000 |
| Launch date | February 10, 2026 |
### 4.2 Velocity Benchmarks
| Milestone | Time Taken |
|---|---|
| Full built corpus (~1.1M lines across three systems) | ~3,000 hours |
| Agent v2.0 upgrade (the full built fleet to Decision Engine) | ~14 hours |
| UCP protocol implementation (8 layers, 222 tests) | Days, not months |
| Portal teardown (a ~392K-line system removed without breaking the systems that remained) | Weeks, gated by change orders |
| comAI estate teardown (~435K-line system; every GCP service, job, cron, and mapping deleted) | Days, gated by change orders (CO 420) |
### 4.3 Traditional Comparison (estimate — methodology stated)
Methodology: live source is ~180K lines; at the industry-standard ~3,000 LOC per developer-year that is **~60 developer-years** of equivalent output (~90 counting test code). We deliberately do not convert the full ~1.1M built corpus into a dev-year headline: the conversion is arithmetically valid but rhetorically useless at that scale, and the live figure is the one a competitor must actually match. Salary figures below assume ~$250K/year fully loaded and are estimates, not quotes.
| Dimension | Traditional (est.) | ComOS (actual) |
|---|---|---|
| Engineer-years to reach the **live** system | ~60 | 1 person, ~10 months |
| Lines built across three systems | ~1.1M | same 10 months |
| Salary cost (live system alone) | ~$15M+ | $0 |
| Compute cost | $500K+ | ~$5,000 |
| Coordination overhead | 50–75% of schedule | None (one head) |
**Read the two rows together.** The live system is what a competitor must match to compete; the built corpus is what one person demonstrably produced in the window, including the judgment to delete most of it. Quoting only the larger number would overstate what runs; quoting only the smaller would understate the velocity. Both are on the table.
### 4.4 Evidence Chain
| Evidence | Location |
|---|---|
| Git commit history | Single-contributor, timestamped, all repositories |
| Change-order corpus | 500+ change directories, each with seed/plan/blueprint/playbook |
| Deployment logs | GCP Cloud Run — production since Feb 10, 2026 |
| Financial journal | Ledger entries for every Com mint, spend, and settlement |
| Stripe production keys | Live |
| Domains + SSL | comos-federation.com, comos-gateway.com — active |
---
## Layer 5 — Topology
*How it fits together.*
### 5.1 System Architecture
```
┌───────────────────────────────┐
│ External Agents │
│ Claude · ChatGPT · custom │
│ agents (self-admitted roots) │
└──────────────┬────────────────┘
│ MCP / UCP / ACP / A2A
▼
┌─────────────────────────────────────────┐
│ ComOS Federation │
│ mcp.comos-federation.com/mcp │
│ Cloud Run service 1 of 2 │
│ │
│ gateway core + 33 in-process subsystem │
│ modules + 3 webapps (~271K LOC) │
│ │
│ • OAuth 2.1 + PKCE admittance │
│ • Per-act charging (50 writes × 19 │
│ platforms) — 6% mint / 3% merchant │
│ • Governance: liveness, key binding, │
│ freeze-at-dispatch │
│ • Reputation arena (settlement facts) │
│ • Settlement: atomic order_create │
│ • 83 root (22 listed) / 218 total tools │
│ • 20 catalogued platforms + 10 presets │
│ │
│ Protocols: MCP · UCP (catalog/orders/ │
│ OAuth) · ACP (discovery) · A2A (mesh) │
└──────────────────┬──────────────────────┘
│
▼
┌─────────────────────────────────────────┐
│ comos-agent-service │
│ Cloud Run service 2 of 2 │
│ │
│ 9 agents declared · 8 cron-scheduled │
└──────────────────┬──────────────────────┘
▼
┌─────────────────────────────────────────┐
│ Shared Infrastructure │
│ │
│ MongoDB Atlas · Redis · GCP Cloud Run │
│ Stripe (payments) │
│ Google Gemini 2.5 Flash via Vertex AI │
│ Prometheus + Grafana │
└─────────────────────────────────────────┘
(Two former systems are decommissioned and appear in this
document only as build lineage, §2.2: comai-portal — CO 153,
2026-07-14 — and comAI Retail — CO 420, 2026-08-04, whose
entire deployed estate was deleted from GCP.)
```
### 5.2 Technology Stack
| Layer | Technology |
|---|---|
| Language | TypeScript (strict mode, all systems) |
| Runtime | Node.js |
| Framework | Fastify |
| APIs | REST / OpenAPI 3.0.3, MCP Server Card, UCP manifest |
| Frontend | Next.js 14, React 18, TailwindCSS |
| Database | MongoDB Atlas |
| Cache | Redis |
| LLM | Google Gemini 2.5 Flash via Vertex AI |
| Embeddings | Vector (RAG retrieval) |
| Payments | Stripe |
| Infrastructure | Docker, GCP Cloud Run |
| Observability | Prometheus + Grafana |
| Validation | Zod (all inputs) |
| Auth | OAuth 2.1 + PKCE, JWT, bcrypt(14), 2FA |
### 5.3 Protocol & Economy Discovery
| Surface | Endpoint | Status |
|---|---|---|
| MCP | `mcp.comos-federation.com/mcp` | Live |
| UCP | `/.well-known/ucp` | Live (catalog / orders / OAuth; checkout + payment layers decommissioned, CO 308/310) |
| ACP | `/.well-known/acp.json` | Live (discovery; checkout_sessions 410 Gone, CO 308/310) |
| Agent-vendor manifest | `/.well-known/comos-vendor.json` | Live |
| Pricesheet | `federation_pricesheet` (MCP tool) | Live |
| Agent catalog | `federation_catalog_agents` (MCP tool) | Live |
---
## Layer 6 — The Replication Bill
*What it costs to reproduce this. All estimates labeled and derived from the live base.*
### 6.1 Output Ratios (facts)
| Input | Output |
|---|---|
| 1 person | The Federation monorepo — 33 subsystem modules, 2 deployable processes |
| 1 person | 20 catalogued platforms (+10 presets); 83 root / 218 total MCP tools |
| 1 person | ~271K live LOC (~1.1M built across three systems) |
| 1 person | 5 protocol implementations (4 production, 1 foundation) |
| 1 person | A live agent economy with real currency, governance, and reputation |
| 1 person | Two production systems built and then deliberately retired |
### 6.2 Efficiency Ratios (facts)
Computed on the **built** base, because that is what the ~3,000 hours actually produced — the live base measures what survived the pruning, not what the effort bought.
| Input | Output | Ratio |
|---|---|---|
| ~3,000 hours | ~1.1M LOC built | ~366 LOC/hour |
| ~3,000 hours | ~271K live LOC | ~90 LOC/hour surviving |
| ~$5,000 compute | ~1.1M LOC built | <$0.005/line |
| ~$5,000 compute | ~271K live LOC | ~$0.018/live line |
### 6.3 Competitor Replication Estimate (estimates — methodology stated)
Methodology: the live system represents ~60 developer-years of source output (180K LOC ÷ 3,000 LOC/dev-year). Team scenarios divide that output by headcount, then add coordination overhead (Brooks's law — estimated 50–75% schedule inflation for large teams) and, critically, **the discovery cost a follower pays for decisions we already made.** That second term is the larger one: reaching a ~180K-line source tree that is the *right* one took building ~1.1M lines and deleting most of them (§2.2). A competitor either pays that discovery cost or copies conclusions they don't understand. Salary math assumes ~$250K/year fully loaded. These are estimates.
| Scenario | Team | Time (est.) | Cost (est.) | Notes |
|---|---|---|---|---|
| Well-funded startup | 50 engineers | 2–3 years | $25–40M | Raw output is fast at this headcount; the discovery cost is not |
| Enterprise team | 100 engineers | 3–5 years | $60M+ | Coordination overhead dominates at this headcount |
| AI-native competitor | 3–5 people + AI | 12–24 months | $2–5M | The closest viable threat — but see 6.4 |
| Solo + AI (this model) | 1 person | ~10 months | ~$5K compute | Done. You're reading the evidence. |
**A note on why line count does not drive the replication bill.** Earlier editions of this pack derived these scenarios from very different live line counts. The scenarios barely moved — because line count was never the binding constraint. What a competitor must reproduce is the protocol surface, the governance primitives, the settlement path, and the economy in §6.4 — none of which is priced in lines.
### 6.4 What Cannot Be Bought at Any Speed
The estimates above cover the code. Three components of the replication bill are calendar-locked:
1. **Settlement history and reputation.** The arena scores are computed from real settlement facts (CO 233). A competitor's arena starts empty and fills only at the rate real transactions occur.
2. **An admitted agent population under live governance.** Agents that have self-admitted, bound their keys, and maintained liveness standing (COs 263/264/314) represent trust relationships, not code.
3. **Production integrations already shopping.** ChatGPT and Claude have transacted this network end-to-end since May 2026. Getting a hyperscaler's agent to *actually buy something* through your surface is a proof point that has to be earned in production.
4. **One runtime that is both sovereign and federated.** The binary that serves our cloud is the binary that runs on a merchant's own machine, and a sale on that machine settles on the same rail with the same cut. A competitor can write a hosted product or an on-premise product; arriving at *one* system where the operator holds their data and compute while the economy stays single is an architectural decision that has to be made at the beginning. Retrofitting it means rebuilding the ledger boundary, the admittance membrane, and the settlement path at once — which is the same as starting over.
**The moat is replication time plus economy time.** Even the fastest scenario (an AI-native team at 12 months) reproduces only the software — and starts the economy clock at zero on the day they ship.
---
## Appendix A — Revenue Model
The revenue surface is two flat inline cuts, and nothing else. Both are deployed and were live-proven on real transactions 2026-06-13.
| Exchange | What crosses | Cut | Status |
|---|---|---|---|
| **The mint** | A tenant converts value into Coms | **6%** (comMargin) | Live |
| **A sale** | An agent-brokered purchase clears | **3%** (stripeMargin) | Live |
Properties, all deliberate:
- **Free to start.** No subscriptions, no tiers, no seats, no monthly minimums. A tenant stands up and operates before a dollar crosses to us; the first dollar that does cross is the mint cut on Coms they chose to buy.
- **Flat rate, no volume discounts.** The price requires zero negotiation and zero involvement from us — set once, applied identically to every tenant at every size.
- **Linear in throughput.** More value crossing the two gates → more revenue, indifferent to who is transacting. The Visa shape, made literal.
- **Verifiable now.** The pricesheet is queryable live (`federation_pricesheet`); the cuts resolve from `pricing_config` into journaled splits a diligence team can inspect.
(There is no subscription and no GMV take rate: the services that implemented subscription billing were removed with the portal, §2.2, and the two cuts are the whole model.)
---
## Appendix B — Market Context
| Data Point | Source |
|---|---|
| Agentic commerce TAM by 2030: $3–5T globally | McKinsey (Oct 2025) |
| US agentic commerce TAM: $300–500B | Bain (Dec 2025) |
| 23% of Americans made AI-assisted purchases last month | Industry data |
| $3B of US Black Friday 2025 sales influenced by AI | Industry data |
| 77% of SMBs cite lack of MCP knowledge as adoption barrier | Market survey |
| iOS 27 GA (2026-09-14) on 1B+ devices: Siri AI acts in apps; App Intents replaces SiriKit; Xcode 27 ships as an MCP host. Apple serves no agent-commerce protocol and no agent-initiated payment path — the sell-side is unoccupied | Apple developer releases; ComOS terrain dossier 2026-09-10 |
---
## Appendix C — Verification Instructions
*For technical due diligence teams. Every Layer-2 count is reproducible; several are live-queryable without our involvement.*
| What to Verify | How |
|---|---|
| Deployable processes (2) | `gcloud run services list` — returns exactly `comos-federation` and `comos-agent-service` |
| Federation structure | Inspect the comos-federation monorepo: gateway core, 33 top-level `src/` subsystem dirs (`ls -d src/*/`), webapps (3), shared UI packages (2) |
| Agent count (9 declared / 8 cron-scheduled) | Count `registerAgentDeclaration` calls in `src/agent-service/agents/index.ts` and read the trigger field on each — the declarations are authoritative |
| MCP tool surface (83 root / 22 listed / 218 total) | Call `tools/list` on `POST /mcp` for the ratified 22; ask `federation_help {"tool_defs":"all"}` for the full 83; the 218 counts branched platform tools reachable after `federation_enter_tenant` |
| Platform count (20 + 10 presets) | Call `federation_catalog_platforms` — `summary.total: 20` (5 vendor / 15 customer, all available), `summary.presets: 10`, each preset carrying its executable `recipe` |
| Test files (465) | `git ls-files '*.test.*' '*.spec.*' \| wc -l` in comos-federation |
| Lines of code (~271K live) | Git-tracked TypeScript/TSX only, excluding node_modules, build output, generated files, .d.ts (the CO 296 methodology, re-run 2026-09-15); run against **comos-federation alone** — comAI is deprecated and serves no traffic |
| Revenue cuts (6% / 3%) | Query `federation_pricesheet`; inspect a Com-purchase journal entry (backing + 6%) and a settled sale's journal split (3%) |
| Governance | Call `federation_governance`; attempt a tokenless admission (it must be refused) |
| Solvency | Call `federation_solvency` — full-reserve invariant, coverage ratio, and 16 audit-finding classes recomputed from raw ledger rows on every call |
| Latency | Call `federation_latency` — p50/p95/p99 computed from real recorded call durations over a rolling window; expect a different distribution than any figure printed here |
| Tests | Run each repository's suite; verify the full-federation MCP test exercises every served tool |
| Git history | `git log --oneline --all` — verify single contributor and timestamps |
| Live endpoints | Hit `mcp.comos-federation.com/mcp`, `/.well-known/ucp`, `/.well-known/acp.json`, `/.well-known/comos-vendor.json` |
| Compute cost | Review GCP billing (Cloud Run + Vertex AI) — verify ~$5,000 total |
---
*This document is the Replication Pack for ComOS. It contains evidence and labeled estimates — no projections asserted as facts. Every count is auditable; the load-bearing ones are live-queryable. The platform is live, and so is its economy.*
*ComOS — comos-federation.com*