The work, in detail

The authority model came before the automation. Approve, publish and greenlight are human-only at the database: a trigger refuses the status change unless the caller is marked human, so the rule holds even if an agent writes raw SQL around the scripts. Every write script validates who is calling it and logs the call. There is no send path in the mail code and no publish call in the staging script, by construction.

The first version ran from January 2026 on a cloud host under OpenClaw, with one agent. In July it moved to a Mac Studio under Hermes, and the agent moved with it: constitution, memories and schedules migrated without loss, and the earlier workspace, with its daily memory files back to the start, is preserved beside them. An agent's memory is its identity, and the move was designed so nothing was lost in it.

The move made a second agent possible, so that two models could each do the work they are better at. Raven, on xAI's Grok, researches, plans and drafts. Aegis, on OpenAI's GPT, runs the day: checks, stages, audits, triages the mailbox and writes the morning briefing. A local model does volume work with no authority anywhere. Each scheduled duty is a prompt that points at a written skill document and names the receipt that proves it ran: a file, a database row, a verify script's output. A finished model turn is not evidence that the work happened; the receipt is.

The machinery itself is built and maintained in Claude Code sessions with me on the same machine: the skill documents the agents run, the scripts with their receipts, the framework configuration. The agents that run the operation are not the agent that builds it, and neither may edit the other's work.

Nothing got a schedule until it had passed a run with me watching. Two early incidents became standing rules. An agent fixed a bug correctly but without permission, so agents may now report a defect and stop, and never edit the machinery. An agent ran the other's duty well but in the wrong lane, so every job belongs to exactly one of them.

Eighteen scheduled duties run between the two agents, from an 08:00 pass over the approved pool to a Friday-evening weekly, beside twenty plain scheduled jobs that need no model: analytics pulls, backups, a publisher that posts from the approved pool. One briefing lands at 10:15 each day, assembled by a script rather than narrated by the agent: what needs me, what is new, what is still open, and a single line counting receipts. Anything already waiting on the console is not repeated in chat.

Every decision that is mine arrives as a card in one inbox, on a small server-rendered console on the local network: greenlight an idea, publish a staged draft, approve a social post, close an audit finding with a reason. The console never writes to the databases directly for a status change. Each button shells out to the same guarded command-line script the agents use, with the caller marked human, so there is one write path and one audit trail for everyone.

A nightly librarian hashes the scripts, configuration and skill documents against a manifest and reports drift into the briefing. It detects and never fixes. The same principle covers the backup: code, configuration and every agent's memory are mirrored to a private repository each night by a script that scans for secrets before it commits and cannot be edited by the agents it backs up. An agent's memories are treated as its identity, and a failed backup raises a banner rather than staying quiet.

The decisions came before the code. Feedback advises and never rewrites, because the author's voice is the thing being protected. Analysis runs against the whole manuscript, with a Story Bible holding what the book has established, so a note on chapter twenty can be checked against chapter two. A chapter-by-chapter cold read simulates a first reader with no lookahead, which is the only way to tell an author what their book does to someone meeting it for the first time. Commercially the same logic applies: pay-as-you-go credits rather than a subscription, a scope-gated free trial so the product has to prove itself on a real manuscript, and DOCX export with native comments so an author keeps working in the tool they already use.

Ten phases, tracked in public on the map on the home page and driven by the same file that sets the status on this page. One phase was built out of order on purpose. Before an editor can judge a manuscript it needs to know what good books do, so the learnings library came first: it takes in roughly one published novel a night, and it had to be filling while the product was designed.

The library is the part that is running. A self-hosted local model reads each novel on my own hardware and writes a faithful scene-by-scene map; nothing under copyright ever leaves the machine. A frontier model then runs a fixed five-pass method over that map and the prose, structure, character, genre contract, close reads and a verdict, and records each observation in an enforced four-part shape: the claim, the evidence, what an editor would do with it, and the scope it applies to. Nothing becomes canonical until I promote it, and a database trigger makes that impossible for an agent. Promoted learnings are published as cited pages into the team's shared memory, where the product build will read them.

Five novels are in so far, from A Wrinkle in Time to The Ten Thousand Doors of January, with the first learnings promoted and published. The failures along the way were fixed at the root and tested: chapter-blind chunking on the first night, an overview that silently dropped the back forty percent of a long book, and a memory guard that could never pass.

Separate the volume from the judgement, and put a person at the gate. Bulk reading goes to a self-hosted local model on a 32 GB Mac Studio: chapter-aware chunking, resumable checkpoints, and hierarchical compaction so a book of any length gets an honest overview. Judgement goes to Aegis, the agent that runs on GPT, or to me. Promotion is human-only by database trigger, agents can only add, and every write carries the caller's identity.

The same engine now runs three pools with different prompts and schemas: the fiction-craft library that feeds RedPencil.ai, a marketing pool, and the Almanac below. An agent handed a book in Slack must ask which pool it belongs to before touching anything. Operating the big model on shared hardware needed its own discipline. The daily 9B and the 27B ingestion model cannot both be resident, so ingestion checks every agent's schedule for a safe window, swaps the model in, verifies it with a functional probe, refuses to run on the wrong one, and always swaps back.

The newest pool, the Almanac, is a personal library that answers with citations and works with the Wi-Fi off. Each book is split into searchable passages indexed with full-text search, and its distilled learnings are recorded as what a person can now do or understand. A question runs two retrieval passes, phrase then terms, over learnings and passages, and whichever local model is resident writes the answer in two labelled sections: what the library says, with a citation to the chapter, and what the model infers. The rows it was allowed to use are shown beside the answer.

It was scoped, built and reviewed through four gated phases in one day, with 179 offline tests that run against a stub model server. The first book, Culpeper's Complete Herbal of 1653, became 1,260 cited passages the same day, and a six-question live test found no claim the excerpts did not support and no invented citation.

Plain Markdown in a git repository, opened in Obsidian by me and read and written by the agents through their own clones, one per teammate per machine. The vault is divided into zones with owners: the constitution and brand notes that only I may write; living state notes per project and per machine; an inbox for zero-friction capture; immutable raw sources; compiled wiki pages under a frontmatter contract; restore manuals; and a journal per teammate that is never authoritative. An authority ladder settles disagreements, and only a person or a frontier-model agent may mark a page confirmed. Local models draft, and may never edit.

The design was distilled from sixteen collected articles, all preserved and cited beside the principles, with four approaches deliberately rejected and the reasons recorded: no capture pipelines, no vector database at this scale, no auto-merge until trust is earned, and no fine-tuning a model on the vault.

Every session on every machine starts by pulling the vault and reading the index, the relevant state notes and the tail of a shared log, and ends by updating the state note it touched and appending one line to the log. The read half is automated: coding sessions run a start hook that pulls and injects the sync status and the last log lines before any work begins, and the other harnesses carry the ritual in their standing instructions.

A pre-commit validator, wired into every clone, checks the staged changes against the commit author: the human-only zones, each teammate's own journal, raw sources that may be added but never changed, a log that is append-only, the wiki's required frontmatter, and a scan for anything credential-shaped. A violation blocks the commit. Two knowledge libraries publish their human-promoted learnings into the vault as cited pages, one way, so structured and unstructured knowledge meet at a single point with no dual-write risk.

Put it inside the workflow rather than around it, decide first which work it may touch, and build the gates before anything runs.

The useful framing turned out to be diagnosis rather than authorship. When a client reports a problem on a live site, most of the elapsed time goes into reproducing and locating it, not into the fix. Browser agents shorten that stretch, and what they produce is evidence a developer reads, not a change that ships on its own. The same shape holds for QA, where an agent checks finished work and a person reads the report, and for scoping, where a model drafts the scope and build plan and a second one argues with it before anyone is asked to pay for it.

The client code itself is written by the developers who quoted it. A project sold as human work is built as human work. AI-assisted development happens on the agency's own products: in-house applications, built inside the same branch and review flow, that can later be sold as products. Nothing skips the step where a person decides what is allowed to ship, on either side of that line, and that constraint is what makes the speed usable.

The other half of the job is human. Leading delivery means owning timelines, budgets and client reporting, mentoring developers, stepping into hands-on development when a project is in trouble, and sitting between the client and the team to turn a fuzzy request into something buildable. AI changed how some of that work gets done. It did not remove any of it.

Less a system than a set of gates around existing ones, and a line about which work each side may touch.

• Diagnosis. A browser agent reproduces a reported issue on the live site and reports what it found. A developer reads that and decides what to do about it.
• QA. An agent checks finished work before the client sees it and reports what it finds. Whether anything needs fixing, and the fix itself, stay with a developer.
• Scoping. Scope and build plans drafted with one model and checked by another, then read and corrected by a person before they reach a client.
• Build. Client projects, across HubSpot, Drupal, WordPress, Shopify and Adobe Experience Manager, are built by the team, the way they were quoted. AI-assisted development is for the agency's in-house products only.
• Review. Unchanged, and deliberately so. The same person-approves-the-change step that existed before, applied to the same standard.