TUEO Product Introduction

A quick overview for decision-makers. For deeper technical detail, see the TUEO Product Whitepaper.

In one sentence

TUEO is the intelligent foundation for enterprise digitalization in the AI era — defining systems by task (rather than developing systems), so that an enterprise’s existing capabilities are reused and AI-enabled, running continuously on a self-operated foundation. AI participates in the organization as full-time employees, operating the business alongside people within the customer’s own environment.

Core thesis

The next stage of enterprise AI is not “smarter conversations” but “employees who can enter organizational operations.” AI needs positions, boundaries, growth, and auditability — TUEO engineers this mechanism and delivers it privately, with full support for running completely disconnected from the network.

System silos are a “doing” problem: moving data into a lake does not make systems talk. AI needs to log into systems, know what capabilities they have, execute actions safely, and leave an audit trail for every action. TUEO uses a ten-product system to link the “definition, production, operations, updates, and coordination” of systems into one complete loop — it does not replace your systems; it makes them, for the first time, capabilities that AI can invoke, authorize, audit, and meter.

Product family: ten products, one system

Experience layer   cohort (collaboration core) · studio (application orchestration)   ← people and AI work together
Capability layer   capabilities (capability marketplace · invocation gateway)          ← one capability contract, two consumers
Execution layer    executor (sandbox execution) · codex-build (coding engine)          ← where AI actually gets things done
Three foundation bases identity (identity foundation) · engram (knowledge-memory base) · inference (compute and model serving)   ← cross-cutting support for everything above
Operations base    console (private delivery · operations hub)
Ecosystem          skillplugins (skill plugin SDK)

Product	In one sentence	Problem solved
identity	One account to access every product, one directory managing people and AI employees	fragmented identity, directory drift, scattered permissions
engram	Knowledge base + conversational memory + entity graph, automatically organized and self-growing	scattered organizational knowledge, AI without memory, getting dumber with use
inference	Dual-pool compute independently managed, model serving, training, quotas and audit	fragmented heterogeneous compute, model invocations wired up separately, runaway costs
cohort	Humans and AI employees work and grow together in the same workspace	AI is only a chatbot and cannot enter organizational operations
studio	Business people use conversation to compose processes into thinking applications	business processes cannot be run by AI
capabilities	The App Store for enterprise AI capabilities	scattered capabilities, exposed credentials, procurement without governance
executor	The hands of AI: doing real work in isolated sandboxes	AI can only talk, not act
codex-build	The coding kernel: AI employees really modify code and really produce MRs	AI writing code is only a demo; delivery is untrustworthy
skillplugins	One capability contract, two consumers	enterprise capabilities cannot be used by both AI and people
console	Turns bare metal into a production environment with one click, operates everything from one interface	private delivery is hard, operations are hard, updates are hard

Product overview

identity — the identity foundation

Unified identity and access management across the entire platform: standard OIDC single sign-on, a single source of truth for the org directory, three role tiers (platform_admin / tenant_admin / member), SCIM automatic account provisioning, and a verifiable cryptographic audit hash chain. AI employees and human employees share the same identity — AI is a full-time employee, not a plugin.

cohort — the collaboration core (flagship)

Humans and AI employees work together in the same workspace. AI employees have positions, responsibilities, behavioral boundaries, and long-term memory: they join group chats like colleagues (who responds is decided server-side), run work orders (from triage to merge, fully automated), host weekly meetings, accumulate organizational knowledge, and learn the owner’s tone of voice to act as a shadow twin.

Positions determine boundaries, and AI employees are equally governed: a secretary is a secretary — Su Wan is a secretary; she cannot operate operations servers. Out-of-bounds tools are hard-rejected at the server with an audit record, and four lines of behavioral defense back each other up; changing positions edits one config and the capability scope follows everywhere. AI and human employees follow the same governance logic. Enterprise data is not scattered on clients and is auditable end to end.

studio — the application orchestration platform

Business people use natural language to compose processes into AI applications (the AI-native successor to BPM). The event-sourcing engine makes every step replayable; acceptance tests are the release gate; AI employees and people are peer actors in the process. Business people themselves can compose AI that gets things done.

capabilities — the capability marketplace

The App Store for enterprise AI capabilities: market-based governance of skills — procurement, authorization, metering, credential vault, and invocation gateway. One capability contract: AI uses it as a tool, people use it as a UI; signed licenses activate with zero network access and distribute offline, so even air-gapped environments can use them.

executor — the sandbox execution base

Where AI actually does work: code packages / commands / images enter isolated sandboxes for execution, schedulable (five priority levels + tenant quotas), auditable, and scalable. User code is treated as untrusted — no privileges, read-only root, network-isolated sandbox, least-privilege credentials.

codex-build — the coding engine

Lets AI employees “really work, really produce”: genuinely reading codebases, modifying files, running tests, and producing MRs. No longer a self-reported agent — the output is real files, real diffs, real branches. Enterprise identity boundaries, credentials that never leave the server, and a triple confirmation gate for subagents / permissions / folder trust. The AI development team is using it to develop TUEO itself.

skillplugins — the skill plugin SDK

Developers write plugins against one contract: manifest (capability declaration) + backend (executor execution) + frontend (desktop rendering). Defined once, used by AI as a tool and by people as an interface. Reference implementations: deck presentations (17 layouts / 4 design languages / preview equals export), and pharma-doc for pharmaceutical compliance recognition.

console — private delivery and operations base

From bare metal to a TUEO production environment: built-in k3s, offline bundle + license, operations for all services and middleware from one interface, configuration center / status wall / backup and upgrade / offline updates. An appliance standard, not a multi-subdomain SaaS; data stays inside the enterprise and can run fully disconnected.

engram — the knowledge-memory base

The suite-level knowledge / memory foundation of TUEO, a beam on par with identity. Three in one: document knowledge base, conversational memory, and entity relationship graph — hybrid vector + keyword retrieval keeps answers grounded in the knowledge base without fabrication; the Dream auto-organization distills conversations into long-term memory, so the knowledge base grows by itself; the entity graph supports multi-hop Q&A. A lightweight single-Postgres base, data never leaves the domain, domestic models, Chinese-first. identity answers “who you are”; engram answers “what you know and remember.”

inference — compute and model serving

The unified model serving and compute control plane for enterprise private AI infrastructure. Heterogeneous accelerator cards (Ascend 910B3 / Hygon DCU) are managed independently in two pools — no disguising different hardware as one uniform resource pool; an OpenAI-compatible API masks runtime differences; the full lifecycle of models / versions / deployments / training; access governance + quotas + usage + audit wired into one closed loop with identity; offline install, upgrade, rollback, diagnostics, and on-site acceptance. The more heterogeneous the compute, the more honest the control plane needs to be.

Why “one system” rather than ten tools

Standalone tools solve standalone problems; a system solves systemic problems. The ten TUEO products share the same identity, the same org directory, the same capability marketplace, the same audit chain, and the same delivery base — every boundary has a single source of truth:

Change one person → directory, work orders, and the whole platform follow (one change in identity);
Add one AI employee → triage, capability routing, and broadcast attribution all take effect (one configuration in identity + job profile);
Procure one capability → cohort, studio, and AI employees can all use it, with unified governance of authorization / metering / credentials;
Deploy one stack → 10 products installed into the customer’s data center at once, operated from one interface.

This is what “we sell the system, not standalone tools” means: the coordination between the products is the real TUEO product.

A real scenario

"Help me fix this bug" @engineering AI
   ↓ group chat routing (server-side responsibility scoring + audit)
work order triage → spec/plan → coding execution (really modifies files / really runs tests / visual self-verification)
   ↓ MR → Code Review → Merge gate
results written back to the work order, AI retrospective into long-term memory
   end to end: identity authorization · capabilities governance · sandbox isolation · audit trail

All data stays inside the customer’s data center: identity, knowledge, code, credentials, and audit — nothing leaves the enterprise.

Who it is for

Manufacturing · contract fulfillment / Finance · risk-control processes / Healthcare · sensitive collaboration;
Government, public security, energy, logistics, retail, education, legal;
Mid-to-large enterprises that already have digital systems and want AI to truly enter organizational operations;
Enterprises that already have AI but lack an execution layer, security layer, governance layer, and recovery layer.

Security and compliance in one sentence

Site-wide OIDC PKCE + ES256, multi-tenant physical isolation (Postgres RLS), model keys never leaving the server, cryptographic audit hash chains, sandboxed execution isolation, content-safety gates, and encrypted credential vault storage — built for organizations with complex processes and strict compliance requirements, able to pass MLPS / SOC 2 / PIPL review.

Contact us

Book a demo and walk the complete chain from login to real sandbox execution — see how ten “colleagues who never clock out” collaborate in your business.

TUEO — making AI a full-time employee of your organization.