There is a recording of Down in the River to Pray made at the Shenandoah Christian Music Camp that I have gone back to more times than I can count. So many voices, four parts, no instruments at all. The tradition it comes out of sings unaccompanied by conviction rather than circumstance, which is a distinction worth considering because it means the absence of a piano is not a limitation being worked around. Instead, it tells us where the music lives.
Nobody owns that song, it came up out of the nineteenth century without a clear author, moved through camp meetings and shape-note books and field recordings, got carried into a Coen brothers film, and has been sung by more congregations than anyone could count, each of them a little differently. The choir didn’t need to secure permission from anyone to sing it. There is no arrangement that has to be licensed back. The whole asset, the tune and the words and the practice of singing it in parts sits in the commons and every group that learns it makes it more theirs rather than less.
I want to hold that next to a piece Palantir published three days ago on building an agentic software security program, because the two things are arguing about the same question and only one of them has followed the argument all the way down.
The right insight, stopped early
The Palantir piece is careful and mostly correct, which is what makes disagreement with it worth it. Its five insights are, with one exception, things I would say myself: a model without a harness is not a program, a harness is only as useful as the organizational context it can reach, remediation rather than discovery is now the binding constraint, and the durable capability is the process and infrastructure surrounding the models rather than the models themselves. That fourth claim they state as a heading, and the wording is exact: process and infrastructure are the durable capabilities. I have been arguing a version of that sentence for years now and I am glad to have company.
The exception is their third insight and the problem is not that it is wrong but rather that it’s right in a way that does not stop where they stop it.
Their argument runs like this. Every detection an agent makes, every triage call, every remediation action, produces information about how an organization actually works. If a hosted model provider captures that signal instead of the organization, the feedback loop that should have compounded into its defenses compounds into the provider’s, and the gap widens every quarter because the provider’s system learns across its entire customer base while the organization sees none of the differentiated advantage its own operational history should have produced. They call that history the organization’s alpha. They say that alpha has to stay under the organization’s ownership and control. They believe it enough to have moved their own staff off frontier-vendor clients onto internal tooling.
This is correct. It is also a general principle rather than a special claim about model vendors. But, general principles have the inconvenient habit of applying in every direction, including downward.
The test, applied one layer down
If the party holding the feedback loop accrues the compounding advantage, then the question to ask of any architecture is not whether it protects against the model provider. Rather, at what depth does the protection stop?
Their answer puts the durable, sovereign, customer-owned thing at Foundry, AIP, and Apollo. Models are swappable; the platform is permanent. Institutional memory accumulates in the Ontology, orchestration runs through the agent harness, fixes move through the deployment control plane, and the organization owns its data and its decisions in the sense that all of it lives inside a system the organization operates.
Run the same test one notch lower and it fails on identical logic. Every adjudication, every reachability decision, every accepted risk, every source-to-sink path that survived validation, accumulates as structure inside a proprietary object model. That is sovereignty with respect to Anthropic and OpenAI, it is not sovereignty with respect to Palantir. The compounding loop still terminates somewhere the customer does not own and cannot carry out the door. When the relationship ends the customer leaves holding an export rather than the asset. The asymmetry was diagnosed correctly and then rebuilt one floor down with different beneficiaries.
Notice where the durability line got drawn. Models swappable, platform durable, and the platform is the layer with a license attached. That isn’t cynical but it is instead what happens when infrastructure is reasoned about from the application downward and stopped at the first controllable layer. But ask the question physically instead of commercially. What actually outlives what? A parallel file system outlives every data model ever laid on top of it. A workload manager outlives the applications it schedules; Songnian Zhou’s load index from 1987 is still running underneath production estates whose entire software stack has turned over four times since. Silicon outlives both. The genuinely durable layer sits considerably lower than the layer being sold as durable, and the distance between those two positions is precisely the amount of sovereignty on offer.
The camp did not need a licensing conversation to sing that hymn, and that is not because they negotiated well. It is because the thing they were standing on was already theirs.
Apollo and the homogeneity it inherits
Their fourth insight is where the architecture shows its foundation and it lands squarely in territory I have already mapped.
The observation is that agentic discovery has outrun human remediation, so the bottleneck has moved from finding vulnerabilities to deploying fixes across large heterogeneous estates. True, and well put. The answer for Palantir is Apollo, which manages deployments, upgrades, rollbacks, health checks, and distribution across connected and disconnected environments, serving as both the alerting surface and the remediation path so that detection and repair share a single auditable control plane.
Take the brand off that description and read it again. Thousands of assets with heterogeneous properties. A queue of validated work items carrying priorities, dependencies, and blast radius. Finite change windows. Health gates that must pass before the next phase proceeds. Per-phase failure and rollback policy. Multiple teams with different risk appetites contending for the same windows. That is not a deployment problem with scheduling features attached. That is workload management stated in full and it has been the problem statement for LSF and Symphony for three decades.
Apollo is, architecturally, a governed and hardened container delivery control plane with genuinely impressive reach into disconnected environments. In other words, Apollo is a Kubernetes-shaped thing with far better manners. A Kubernetes-shaped thing inherits Kubernetes’ founding assumption, which is that the unit of scheduling is a container on a node and that nodes are interchangeable except for labels and taints. I worked through this at length in my OpenShift analysis, and the finding was not close. Kueue, arguably the strongest governance extension the Kubernetes ecosystem has produced, sits at alpha API maturity and has no capability whatsoever in five of six ontological dimensions. Every capability in Run:ai turns out to be reproducible inside Symphony’s ELIM architecture using nothing but public GPU APIs. The gap is not maturity, it is category. A container placement engine answers where does this run. A compute ontology answers what kind of thing is this, what kind of thing does it need, and what does the estate owe it.
The homogeneity assumption is harmless when the estate really is homogeneous. It is false for exactly the environments this architecture claims to serve. Mainframes are not nodes. Disconnected edge is not a region. A neuromorphic chip like BrainChip’s Akida that learns on-die during inference is not a smaller GPU. A quantum resource that answers in four milliseconds and then wants recalibration is not a long-running pod. A logical partition where the authoritative data already sits is not a scheduling target that can be drained and placed elsewhere. A control plane whose vocabulary tops out at a container, somewhere, with these labels cannot express any of that, and so the heterogeneity gets handled the only way left: in application logic, by hand, per environment, forever. Enter Palantir’s resident FDE’s at your organization.
Here is the part the hymn says better than I can. The reason a hundred people singing without instruments produces something worth recording is that the four parts are genuinely different and are not made the same. The bass line is not a transposed soprano line. The alto is not a demoted melody. The arrangement calls its groups down to the water in turn, each entering on its own terms, and the piece holds together not despite that difference but through it. A container platform would have put everyone on the melody and called the result scalable.
Why homogeneity and sovereignty pull against each other
This is where things have not been made sharp enough, and it is why these are really one critique rather than two.
Flattening compute into fungible units does not merely cost expressiveness, it destroys the basis for sovereignty. If every unit of capacity is interchangeable, then the only remaining variables are how many units are available and who sells them. Both of those answers point outward: to a hyperscaler, a chip vendor, a capital market. Sovereignty over fungible capacity is not sovereignty. It is a purchase order with good governance wrapped around it.
Real sovereignty requires the ability to say what kind of thing a resource is and to schedule against that claim. This is what typed resource metrics with semantic direction actually buy, and it is why ELIM is load-bearing rather than a configuration detail. When the estate can express that this workload wants silicon that learns online, that one wants a QPU, that one must execute where the data already lives because moving it is the expensive part, then the composition of the estate becomes a decision the organization owns rather than a consequence of what was available to rent. Heterogeneity is not a complication to be abstracted away, it is the precondition for not being a tenant.
I worked the philosophical form of this out in the Chalcedonian paper and will only gesture at it here, but the shape is identical. Two genuinely different natures, held in one operating whole, without confusion, without change, without division, without separation, and all four constraints hold at once rather than in sequence. Substrate collapse, the move that makes many kinds of thing into one kind of thing so a single scheduler can address them, fails the first adverb outright, achieving unity only by confusion. Kubernetes is the confusion strategy expressed in YAML. A compute ontology is the attempt to hold the difference and the unity simultaneously, which is harder, why almost nobody does it, and also the only version that leaves anyone owning anything.
Two smaller things, which are not small
There is no tier beneath a model call. The methodological honesty in Palantir’s blog post is admirable: they acknowledge that agentic systems are probabilistic, that one clean run proves nothing about coverage, that different models surface different vulnerability classes under identical orchestration, and that the remedy is repeated execution and cross-model comparison. All correct. All priced, permanently, at frontier rates on rented accelerators. And a large share of what gets spent there is low-novelty repetition: has this asset drifted from its own normal, is this finding actually new, was this path already adjudicated, did the source schema move under us? Those are not reasoning problems. They are recognition problems, and recognition is cheap on silicon that learns online and answers in microseconds at nanojoules. Ten storage nodes in my own fleet each learned their own behavior on-die while running, in a model of four thousand one hundred fifty-seven bytes, and discarded the raw telemetry at the source so that only the answer ever crossed the wire. An architecture with nothing underneath the model call has to ship everything to the model, because there is nowhere else to send it.
And there are two ontologies where there should be none. Foundry holds the Ontology. Apollo separately builds a model of the environment’s properties. The two are reconciled by feeding Apollo’s view back into Foundry as a data source. That is a synchronization tax paid daily and permanently, plus an entire class of drift defect that exists only because a second copy exists. In a compute ontology there is no ingestion loop, because the resource model is not a representation of the environment. It is the environment’s own state, held by the workload manager and the file system that are already doing the work.
What sovereignty actually costs
Palantir has done the field a service by arguing for Sovereign AI in public. The claim that operational history is an asset which must not be permitted to compound into someone else’s system is correct, important, and thoroughly unfashionable in a market busily posting its entire institutional memory to inference endpoints. I would rather argue with people who have the argument right than with people who have not noticed there is an argument to be had.
But sovereignty is a property of the floor. An organization is sovereign only to the depth of the lowest layer it owns and can describe. Everything above that line is tenancy, however well governed. If the semantic model lives in an open standard, the data sits in open formats on a file system the organization operates, lineage rides open protocols, and the workload manager can name the difference between a GPU, an NPU, a QPU, and a logical partition on a mainframe, then leaving costs a migration. If any one of those is somebody’s product, leaving costs the asset.
So, back to the river. That hymn has survived a hundred and fifty years of transmission through people who mostly could not read music, across denominations that agreed on very little, into a film soundtrack and back out again into camps full of teenagers, and it survived for one reason: nobody held it. Every congregation that learned it added to a commons instead of paying into a catalog, and the compounding ran toward the singers. If it had been licensed in 1870 it would be a curiosity in an archive now, technically preserved and functionally gone.
The floor has been purchasable for thirty years, unglamorous, it appears on no analyst chart under any name the AI market would recognize, and it is not owned by anyone with an interest in renting an organization’s own operational history back to it. That is the entire argument. Everything else is where the line gets drawn, and I would draw it lower than they have, all the way down into the water.