Record
Agent Terrarium
A sanitized extraction of a private multi-agent operations system, published with a list of what is missing from it.
What it is
A sanitized open-core extraction of a private multi-agent operations system. A department is one JSON file, and one generic engine runs each of them the same way: read-only allowlisted inputs, then role steps through a model router, then a markdown report and a hash-only receipt. Anything with an outward effect waits behind a typed-phrase human approval gate in a localhost console.
What it proves
The walls are the work, and they are readable in the code rather than described in a diagram. The engine sends, posts, deploys and mutates nothing. The gate only runs executors from a hard-coded allowlist, so a hand-made approval card naming an off-list executor is refused before it can run. Receipts store SHA-256 hashes of inputs and outputs instead of the content. Gathered inputs are wrapped in a preamble telling the model never to follow instructions found inside them, so prompt injection is the default assumption. The router fail-closes from subscription CLIs to flat-rate models to local Ollama to an optional budget-capped API, with no model name hard-coded anywhere.
What it does not prove
What is public here is the extraction, not the operating record of the private system. The README describes 13 department lanes running continuously on a private VPS; none of that is inspectable from this repository, and every number on the console screenshots is invented demo data. The 14 real department configs, the company memory graph, the deployment scripts and the email agent chain are held back, and the README says so in its own open-core section.
Artifacts
The engine, the model router, the console generator, the localhost server and approval gate, the read-only fetchers, one real department config, three synthetic demo configs and the full test suite are public and run on the Python standard library alone. The README reports 95 tests with one skipped, and the console can be regenerated from seeded synthetic data in two commands.
Takeaway
What to take from it.
Autonomy is safe to exactly the degree that the wall around it is written down and testable.