Skip to content
Gestalt

Concept: Geist and Koerper

Status: stable. The Geist/Koerper split is constitutional. Every page in these docs assumes you understand it.

The split

Section titled “The split”

Gestalt models a company as two organs in tension.

Geist (the governed truth organ) holds:

standing        who may act on behalf of whom
mandates        narrower scoped authorizations
atoms           admitted serious acts
realities       record + projected worldlines
capabilities    accountable definitions of acts
evidence        signed bundles backing claims
effects         changes in what is now required, blocked, or warned
closure         surfaces of unresolved business pressure
tensions        first-class unresolved conflicts
fibers          continuing causal threads
proofs          signed, scoped bundles for disclosure
receipts        artifacts of every membrane crossing
scars           permanent marks of resolved-with-cost incidents

Koerper (the mutable operational body) holds:

UI state                shop pages, forms, list views, table layouts
drafts                  unsubmitted invoices, contract drafts, posting proposals
local tables            inventory, CRM contacts, support tickets
imports                 raw bank exports, raw shop CSVs, OCR scratch
agent scratchpads       LLM intermediates, retrieval caches
generated workflows     AI-generated apps, vertical-specific tools
caches                  projection-derived view caches
fixtures                local demo data

The rule of thumb:

If losing it makes the company legally, fiscally, contractually, or economically vulnerable, it belongs in the Geist. If losing it means rebuilding a workflow over a weekend, it belongs in the Koerper.

The two phrases everything reduces to

Section titled “The two phrases everything reduces to”

AI can write the Koerper. Gestalt preserves the Geist.

Application code may mutate the Koerper, but only the Geist may issue business reality.

These are not slogans. They are the design constraint that makes the membrane necessary and unburdens the Koerper to be opinionated, fast, and replaceable.

What Koerper opinionation is allowed to do

Section titled “What Koerper opinionation is allowed to do”

The Koerper should be opinionated. A useful business system cannot present every possible legal, contractual, tax, insurance, procedural, and professional path to every operator at every moment. A Koerper may:

  • prefer specific workflows,
  • prefill defaults,
  • hide rare branches,
  • route work to agents,
  • ask for evidence early,
  • present simple buttons over complex transitions.

What it must not do is pretend its supported path is the only legal path unless the authority topology really says so. Compliance lives at the commit boundary — i.e. at the membrane. The Koerper draws the button. The Geist decides whether pressing it admits anything.

Published navigation

Section titled “Published navigation”

Opinionated Koerper behavior should itself be publishable. A navigation profile is a declared route through active authority possibilities — not law, but a documented opinion.

A Verlag, Kanzlei, vendor, insurer, platform, or company policy organ can publish a navigation profile that declares:

  • supported company types,
  • supported jurisdictions,
  • preferred capability atoms,
  • default risk posture,
  • workflow choices,
  • suppressed branches,
  • escalation rules,
  • required evidence,
  • unsupported cases,
  • reliance terms.

The Koerper uses navigation profiles to make the product usable. The Geist records which profile influenced an act when that influence matters.

What a single act looks like across the line

Section titled “What a single act looks like across the line”

Take “issue an invoice.” Naively this is one click. In Gestalt:

Koerper side:

  1. Operator sees a list of recent customers in a table.
  2. Operator clicks “issue invoice” on a customer row.
  3. The Koerper opens a form prefilled from the navigation profile (“German GmbH, EU intra-community supply, GoBD posture”).
  4. Operator fills line items, dates, terms.
  5. Operator clicks “issue.”
  6. Koerper assembles an intent envelope citing capability:issue_invoice_fixture_v1 and the prefilled evidence bundle.

Membrane crossing:

  1. Envelope POST /v1/intents/commit.

Geist side:

  1. Gravity checks: subject valid, capability current, standing adequate, evidence cited, reality coherent, authority epoch active, signature binding correct.
  2. If admitted, an atom is created in reality:record with subject, cause, authority, content, evidence, governance, effects, commitment.
  3. The atom emits effects: RequireCounterpartyAck (the customer receives the invoice), OpenClosureSurface(receivable), possibly RequireAdvisorOpinion if a tax position is unusual.

Receipt back to Koerper:

  1. The Koerper receives a MembraneResponse with outcome: "admitted", the atom ref, and a receipt.
  2. The Koerper updates its UI: the customer row now shows an open receivable, a closure-surface marker appears on the period close indicator, the invoice list shows the new entry.

The Koerper displays the new state. It did not create the new state. The new state lives in the Geist.

Why this matters when the Koerper is replaced

Section titled “Why this matters when the Koerper is replaced”

Imagine the agency that built the original Koerper goes out of business. Or the AI that generated it produces a better one. Or the company switches from one shop platform to another.

In conventional software, this is catastrophic: the company’s operational reality is inside the app being replaced. Migrations cost months. Audit trails are broken. Legal continuity is uncertain.

In Gestalt, the Geist is untouched. The new Koerper:

  • subscribes to the same projections,
  • presents the same atoms differently,
  • attaches its own navigation profile,
  • and the same operator can keep working without losing a single signed fact.

The receivable is still open. The Steuerberater opinion is still binding. The contract obligation still exists. The audit can still trace causality.

This is the reason the membrane is non-negotiable. Without it, the “replaceable Koerper” promise is a marketing claim. With it, it is a structural fact.

The mesh comes later

Section titled “The mesh comes later”

Gestalt’s third trinity element is the mesh — the emergent field of all Geists in bilateral contact. Today the mesh has no API surface (see 022 gap report item 13). When it lands:

  • A company Geist will exchange proofs with a counterparty company Geist.
  • A company Geist will receive scoped Pendulum emissions (court orders, regulator notices, registry updates).
  • A company Geist will send entitled disclosures to a Steuerberater Geist.

The mesh is not a global graph. No participant ever sees the whole mesh. Each Geist sees only its own counterparties.

What this means for you, the integrator

Section titled “What this means for you, the integrator”

If you are building a Koerper: design for replaceability. Do not store anything in the Koerper that the company cannot afford to lose. Push every serious act through the membrane. Cite capabilities, never operation strings. Read the projections; do not invent your own truth. See guides/building-a-koerper.md.

If you are building infrastructure: respect the closed runtime boundary. Never invent paths around the membrane. Never expose raw database access. Never collapse separate refusal codes into a single error: true.

If you are operating Gestalt: the Koerper is what your users touch. The Geist is what they own. Both matter. Don’t ship Koerper features that depend on Geist capabilities you don’t actually have yet. The capability-state labels in these docs exist for exactly this reason.

Section titled “Where to read next”