THE AGENT PLATFORM

Unattended AI systems fail in ways that are hard to inspect and harder to trust. A daemon that operates overnight, issues commands against a live homelab, and makes decisions on behalf of a principal it cannot consult in real time has exactly one structural guarantee by default: none. It will eventually do something the operator did not authorize, and there will be no record of how it decided to do it.

The standard response is to restrict capability — short-context, tightly-scoped, human-in-the-loop at every decision. That trades one failure mode for another. A system that requires constant human input is not autonomous. It is a complicated interface.

The real problem is not autonomy — it is uninspectable autonomy. The question is whether a system can act with genuine authority inside explicit, verifiable limits: floors it cannot cross, a record of every material action, and a learning mechanism that converts failures into permanent rules rather than one-off corrections.

The studio designed and operates a fleet of three always-on AI daemons running on a single Linux container, backed by a small self-hosted cluster and local GPU inference. The system is operated via a messaging command channel — voice or text from anywhere, zero laptop required — with autonomous overnight execution and a morning digest as the primary interface.

The architecture has three load-bearing ideas. First: governance as structure, not policy. A written constitution — seven articles, adversarially red-teamed and ratified — defines floors that no daemon may cross regardless of instruction. No auto-merge. No autonomous spend. No outbound messages to external parties without approval. Deletes require human approval. Secrets never leave the host they live on. These are not guidelines enforced by trust — they are hard gates enforced by pre-execution checks and an outbound guard that stops credentials from leaving the system.

Second: verification is adversarial and independent. The daemon that builds a thing does not verify it. Conductors spawn separate builder subagents; verification is assigned to a different model or a different daemon with a mandate to refute, not confirm. A subagent the builder spawned is not independent — this is stated explicitly in the governance document and enforced by dispatch structure.

Third: every material action leaves a receipt on disk. Work that exists only in a context window does not exist. The corpus holds 1,564 work receipts spanning March through July 2026, written incrementally during execution, not reconstructed afterward.

The platform is governed by a written constitution — seven articles, independently adversarially red-teamed (27 findings addressed), hardened, ratified by the principal, and kept under version control. Amendment rights belong to the principal alone. An agent that reinterprets an article to unblock itself has violated it — this is stated explicitly, not implied.

The floors are enforced in code, not convention. A pre-execution gate intercepts destructive commands and holds them for human approval. An outbound guard keeps credentials from leaving the system. Untrusted inbound content is screened before the agent acts on it. These guards fire before the model generates a response that could cause harm — the model's reasoning about whether to comply is never the last line of defense.

The constitution also specifies what "verification" means. A green signal must measure the real quantity: "job ran" is not the same as "artifact exists." "Tests pass" is not verification if the test does not exercise production code. A detector that inspected zero items reports NO-DATA, never PASS. These are not formatting preferences — they are failure modes the system has encountered, documented, and converted into permanent rules.

The lessons archive. Every failure becomes a lesson in a permanent, append-only archive. As of this writing: 160 lessons spanning prompt injection defense, liveness detector design, incident triage discipline, and multi-agent contention patterns. The archive is indexed for fast recall — a hot-load index carries the headline of each lesson (the headline is the rule in a phrase), and the full text is read on demand when a situation matches. The system does not re-learn what it already knows.

Conductor / builder separation. The planner daemon decomposes tasks and dispatches them to builder subagents. Builders write code and receipts. The conductor verifies. The conductor's verifiers are never spawned by the builder — and when a decision is above routine tier, a different model family is preferred for the verification pass. A subagent the builder spawned is not independent; this is not a preference, it is stated policy.

Liveness watchdogs. Each daemon writes a session-state file at step boundaries and on blocked or done transitions. A restarted daemon reads this file on wake and resumes warm instead of cold-starting. Watchdogs distinguish a heads-down conductor — its own session log goes quiet while its subagents keep working — from a genuinely frozen daemon. A false-positive restart mid-task strands in-flight work with no handoff; the watchdog design must tell the difference.

Multi-model spine. The platform mixes hosted frontier models with local open-weights models running on in-house GPUs at interactive speed, as a stated design goal: model-agnostic infrastructure so no single model family is a dependency. Expensive frontier models handle judgment calls and adversarial verification; cheap local inference handles volume labor. The local model is never used for grading or judicial decisions.

Memory corpus. 406 persistent memory files with a 121-entry curated index. The index carries one-line recall hooks; the full files are read on demand. Shared memory is write-separated by daemon role — each shared file has a single owning daemon, and the others contribute through append-only paths. Sensitive memory is under integrity monitoring, so tampering surfaces instead of silently propagating.

The system converts failures into permanent rules. Below are three real incidents from the verified record — each with a documented root-cause writeup in the lessons archive.

The platform operates a homelab, the studio's AI consultancy infrastructure, and a portfolio of personal systems across three persistent daemons, a small self-hosted cluster, and a multi-model inference layer. It runs overnight, handles incidents, writes code, manages deployments, and produces a morning digest — without requiring human intervention for routine operations.

Honest capability statement, using only verified numbers: 3 always-on daemons, 160 append-only engineering lessons, 1,564 receipts on disk, 406 persistent memory files, 50 installed skills, a layered guard stack, and a security pipeline with end-to-end alert delivery verified by synthetic injection.

MTTR, uptime percentage, and cost savings in dollars are UNMEASURED — the instrumentation exists but the baselines have not been formalized. Those metrics will be cited when measured, not before.

The system's primary design output is not a product — it is a working answer to the question of whether an autonomous AI platform can be genuinely trusted to act without supervision. The constitution, the lessons archive, the receipts, and the guard stack are the evidence. They outlive any individual model's weights.