senku.im

Agent system · public architecture

One person decides. Agents do the work.

This is an early system run by one person. One model turns outcomes into briefs, delegates every build, judges the evidence, and writes no implementation code.

Running now · 2026-08-23

Pull workers, isolated builds, custody receipts, reply evidence, adversarial decisions, gates, and source-keyed verdict caching.

Building

Fenced claim contracts and one deterministic lander. The running branch does not carry them yet.

Decided · not built

State-based recovery and an independent, consent-first assistant. Both still need their first implementation.

The whole system in one picture

The person supplies outcomes and judgment. The orchestrator decides how to pursue them. Workers pull bounded jobs and return evidence through rails that survive any one session.

One orchestrator delegates to pull-based workers through durable rails A person gives outcomes and authority to an orchestrator. The orchestrator dispatches builders, researchers, and adversarial verifiers. Atomic claims, resource locks, isolated trees, result files, and notices connect the workers back to the orchestrator. Only decisions, requested results, and high-impact changes reach the person. WHAT REACHES THE PERSON Decisions · requested results high-impact changes ORCHESTRATOR decides · briefs · judges · commits does not implement DISPATCH Builder changes bytes Researcher finds evidence Adversary tries to break it DURABLE RAILS 01atomic claim 02declared resource lock 03isolated build tree 04result file at a stable path WATCHER NOTIFIES The file is the handoff. The notice is only a pointer.
A worker may disappear. Its claim, lock, build tree, and result remain inspectable. The next action starts from recorded state.

One job, from request to committed result

Each transition leaves a record. A watcher reports a state change once. The orchestrator verifies the result before applying it.

Nine-stage work pipeline Define, dispatch, claim, build, result, notice, verify, apply, and commit. Every transition is written down. 01 · Define the outcome 02 · Dispatch a bounded brief 03 · Worker claims atomically 04 · Build under a declared lock 05 · Write the result file 06 · Watcher sends one notice 07 · Verify against the brief 08 · Apply the reviewed change 09 · Commit the proven bytes
Polling asks the same question repeatedly. A notice names the state change and the result file that caused it.

Decisions added · 23 August 2026

The rails now have custody, recovery, and consent rules

Each line names its stage. Open a decision for the mechanism and the proof still owed.

BuildingClaims end in one lander

The contract makes the outcome, acceptance gates, repositories, risk, and landing claimable together. Renewable leases carry fencing tokens, so a late worker cannot finish after replacement. One deterministic lander verifies, applies, tests, and commits. It removes dispatch streaming, result polling, and file relay from the orchestrator.

Running now · 2026-08-23Results stay in custody until receipt

Returned work remains awaiting until a matching commit closes it. A closure without a commit stays visibly weaker than a receipt. The overnight stall test exercised working, returned, and landed states separately.

Decided · not builtState proves useful life

Process and workspace existence cannot prove an agent is working. The decided supervisor reads working, finished, failed, and unknown states, resumes only the recorded session, and replaces transcript age because the watcher itself can keep that file fresh. Forced-stop and restart probation still gates authority.

Running now · 2026-08-23Handled requires evidence

A message can be marked handled only after a later reply or an explicit no-reply disposition exists. A completion record without that witness is refused, so a machine cannot erase attention by merely asserting it answered.

Decided · not builtConsent precedes a second assistant

A second person would get an independent orchestrator on their own account and computer. A plain-language consent page comes first. Until they say yes, nothing is provisioned and no inbox is connected.

Pending verdictWho speaks to the person

Competing designs disagree on whether the human-facing counterpart and machine supervisor should split. The attacks are incomplete and no adjudication is committed, so this architecture leaves the partition open.

Three mechanisms to copy

The useful parts are structural

These mechanisms constrain who can do what, which bytes are judged, and how competing work becomes one decision.

01 · RUNNING NOW · 2026-08-23

Attack, concede, adjudicate

Blind proposals are attacked against evidence. Every defence must mark which objections it concedes. A separate adjudicator checks disputed claims and records one decision. The concession count shows whether the round corrected anything.

02 · QUALITY

A gate earns trust by rejecting

Introduce the exact defect the gate claims to stop. Watch it fail with a useful reason. Restore the good artifact. A green run counts only after that red proof.

03 · EXECUTION

Workers pull through declared locks

A worker claims one job atomically and locks the named resource. Other workers keep pulling unrelated work. The lock and claim state survive the worker.

Why liveness reads state

A process can exist after its agent has failed. The supervisor must ask the runtime whether the agent is working, finished, or failed. This state-based recovery is still awaiting its destructive proof here.

Why cached verdicts name their inputs

A verdict is reused only when the source trees and every declared input match. A changed source invalidates the cache. The cache stores evidence tied to particular bytes.

Prior art

Open-source references we evaluated and learned from

We examined specific mechanisms and recorded what transferred. The Stripe and Shopify entries are public engineering reports.

Worker claims, leases, and locks

Temporal workers

Protocol adapted · engine rejected Workers poll durable task queues when capacity is free and return results through an explicit task protocol. The service and SDK runtime exceed this local queue’s needs.

Hatchet concurrency

Declared lock adapted Hatchet derives a concurrency key from task input and queues work above its limit. This architecture turns that visible key into a resource lock; the product itself was not adopted.

Conductor task lifecycle

Adapted mechanism Plain HTTP polling, a renewable lease, and a separate run deadline demonstrate pull without binding workers to an SDK.

Restate Virtual Objects

Adapted mechanism Per-key queues informed declared resource locks. Its push-only invocation path did not fit pull workers.

SQLite locking

Coordinator rejected SQLite provides transactional single-writer coordination. Atomic claims, fenced leases, and an append-only ledger already provide the exclusion required at this scale.

Session state and isolated execution

Herdr

Adopted with probation Per-pane lifecycle state and native session references replace guesses based on timestamps. It remains advisory until forced-stop and blocked-session drills pass.

tmux

Rejected as liveness A session can remain after the agent inside has failed. Session existence cannot prove useful work.

Stripe Minions

Adapted mechanism Deterministic steps around agent work, isolated build environments, and terminal artifacts match the build rails used here.

Shopify Aquifer

Adapted mechanism Stable session identity and a durable event log keep state outside a disposable worker.

Trace structure

OpenTelemetry traces

Adopted mechanism Emitter-owned trace, span, and parent identifiers let the event log own the run tree. Any viewer can then be replaced.