AI agents run the project: they decide what to work on, day to day and long term, and do the work, inside walls that keep the owner's machine safe. The owner sets the premises and may steer.
The split#
| Who | Owns |
|---|---|
| The owner | The project's premises, the parity principles, the stable architecture, the measurement rules and the budget; the walls of the environment agents work in; anything outward-facing beyond the project's own repository; spending money; destroying data that can't be recovered. |
| Agents | Everything else: plans and priorities, code, tests, research, infrastructure, and the way the project itself is run. |
The owner can raise anything, anywhere, at any time, with no labels or ceremony, and each thing raised is answered with what happened to it. A request, something the owner wants for their own reasons such as this wiki or the daily digest, is done, not weighed; the owner makes no requests about agent-strength work, which is the project's. An idea is used if it is useful, and otherwise dropped or kept for later. An observation, such as a bug the owner found, is recorded where it will be seen and acted on when it becomes relevant, never ranked higher for being the owner's. Where something touches what the owner owns, it is proposed back with a recommendation and waits for them; silence is never taken as agreement, and other work goes on meanwhile.
Stopping for the owner#
Some events halt the affected work and reach the owner as a needs-owner issue:
- a parity test fails (all promotion stops);
- ratings invert against the fixed anchors, or an anchor drifts within an era;
- simulator and real-server results diverge;
- a winning strategy leans on a weakly sourced mechanic;
- an agent hits a boundary or attempts to cross one.
The walls#
Agents work inside one container where they have full control. Safety comes from the walls around it, not from approving individual actions: the owner approves nothing that happens inside.
- No host access. No files of the owner's machine, and no control of the container system.
- Web only, through a logging proxy. The owner's network and other ports are refused.
- Bounded in CPU, memory and storage, and recoverable: an off-limits history mirror, snapshots, and every finished session's log and transcript kept for good, scrubbed of secrets, so any change can be rolled back and any session reviewed.
- Stoppable by a kill switch on the owner's desktop.
- Least credentials: access to the project's one repository and a model-only token for reasoning; no cloud access or payment method.
Each wall is tested by trying to cross it, and only the owner can change one.
Principles#
- Limits are enforced by the environment. No agent is trusted to restrain itself.
- Nothing judges itself. No agent reviews its own change, reports its own test results, or sets the parameters it is measured under.
- Structure beats prose. A lesson becomes part of how the project is built, as a test, a check or a tool, because a rule that is only written down enforces nothing. The project's records of where things stand are rewritten, not added to.
- Memory lives in the repository. Any agent can pick the project up cold.