THE CONSTITUTION

An autonomous agent fleet with real write access to a production homelab is not a novelty experiment — it is a risk surface. Agents that can edit files, trigger builds, restart services, and dispatch other agents need governance that survives three things that kill most governance: eager agents that find clever loopholes, prompt-injection attacks that try to launder external instructions through the trust stack, and model replacement that swaps the weights mid-run and calls it business-as-usual.

A rules file that agents can edit is not governance — it's a suggestion. A policy that lives only in a prompt has no persistence across session boundaries. And a policy written by the agents it governs, never challenged, is a policy that will be gently worked around the moment it becomes inconvenient.

The studio needed something harder: a document that could outlive any single model, survive a hostile reading, and be physically enforced — not merely trusted.

On July 5, 2026, the fleet's planning agent drafted a 7-article governance document in a single session. The mandate: define what agents may never do unattended, how truth is reported, how changes ship, and what happens when the principal goes dark or the model is replaced. The draft was thorough. It was also untested.

The same night, an independent session of the same model — no shared context, mandate explicitly REFUTE — read every line as an adversary would. Not a friendly review. Not a checklist pass. An exploit-read: every clause treated as a surface to punch through, every ambiguity treated as an invitation. The session ran live fact-checks against the actual system on disk.

The result: 27 findings, 5 of them critical. Version 1.1 was hardened against every critical finding. The principal ratified it the same night. It has been in force since.

Red-team first, ratify second. The review was not a style pass. Every clause was read as an attacker would read it, and every claim the document made about the system was fact-checked against the system itself. The most useful findings were not wording problems — they were places where the document described a protection the system did not yet enforce.

The red team's verdict on the draft, paraphrased: “This document describes the system. It does not yet govern it.”

Every critical finding was closed before ratification, and the fixes were verified against the running system rather than asserted in the text. The document now loads into every agent session, sits out of reach of the agents it governs, and changes only by the principal's own words, applied in a supervised session and recorded in version control.

The ratified document is seven articles, approximately 7 KB, 62 lines. Every article was stress-tested against the red-team findings before ratification.

The ratified constitution governs a corpus that grows with every session: 162 append-only engineering lessons, 414 memory files, 1,128 receipts on disk, and a default-closed spine registry. The document itself is 7 KB, 62 lines — small enough to load in every session's context, before any agent accepts an instruction.

Article VII's inheritance audit runs at every model cutover. The fleet currently runs three daemons on different model tiers; the governance layer does not care which weights are under any of them. See The Nervous System for how the model-agnostic spine is built and verified — the constitution is what each model inherits on every boot, before it touches anything.

The agent-platform architecture that dispatches work across the fleet operates inside these floors. See The Agent Platform for how delegation, verification, and the proposal queue are implemented in practice.