Human in the loop.
Agent at work.
All on the record.

An operating and record-management system for AI-assisted work with a person in the loop. Built so the person gets more done, the agent is more efficient, and the output is a record that can be audited.

The drawing is the system laid out as a brain. The forebrain decides, the midbrain keeps it running, the hindbrain checks, and the record runs beneath all three. Each part has a job and a limit.

An illustration of the design. The two strands replay our own record, 7 September to 3 November 2026, counted from git. Light is activity. Red is an incident. Hover over a part to see what it is.

Forebrain · where judgment sits

A person decides. An agent does the grunt work. Every step is written down as it happens.

The forebrain is the only part that reasons. One hemisphere is the person, the other is the agent, and the session joins them.

The operator chooses the question and signs the answer. Work goes down to the record only after the person's typed word.

Each command, file read, file change and web fetch the agent makes through its tools is written down by a local program beside it, at the moment the call returns. The agent does not write these rows, and a later edit to one would show.

Midbrain and hindbrain · what runs without being asked

The routine holds no model. The checker is not the agent's own.

Below the forebrain nothing decides. The midbrain keeps the system awake, and the hindbrain compares what the agent said with what it did.

The routine is the midbrain. It wakes the system, starts fresh working sessions and pages the person. It holds no AI model.

The checker is the hindbrain. We call it the observer: a local model on a separate machine. It checks every claim the agent makes against the record. The agent's vendor does not control it, and its machine accepts additions only. In an enterprise that second machine's place would be taken by what we call federation; that is a direction of work and not yet built.

Each working session of the agent is a cell. It wakes, it works, it records, it dies, and the next one picks up from the record where the last left off.

The record · the one state every part reads

Signed, chained, copied and stamped. A change to the past shows.

The record is not a region of the brain. It runs beneath all three as two strands: the working copy and the observer's own copy.

Every entry carries the fingerprint of the one before it, and every commit is signed. A change to the past shows at the next check.

Three copies on machines you own. Red marks: each one is an incident, kept with its date, its class and the measure that followed.

Local models load inside the system's own programs, with no separate model server, and write their model file's fingerprint on each row. Built and measured on the working machine.

A gate at the point of saving refused 103 of the agent's saves in its first two weeks, 30 October to 12 November 2026, by fixed rules and with no person involved.

A local reader answers from the record when the agent is away: one command at a terminal since 11 November 2026. On ten sealed questions the operator ruled six of its answers correct.