Autonomous Operators

Give an AI a job, not a prompt. An operator keeps its responsibility, memory, permissions, and history while models and computers stay replaceable parts — every action governed, every outcome verified, every run recoverable from a ledger.

The agent persists. Every action is governed. Every run is recoverable.

Run the demo The runtime underneath

The problem

An AI agent that lives inside a chat session dies with it. One that lives inside a VM dies with that. Give either a real job and the failure modes compound: nobody can prove which side effects already happened after a crash, the model authorizes its own actions, "done" means the model felt done, and replacing the model or the machine silently replaces the agent. What is missing is a runtime in which the agent is durable state — with its responsibility, memory, permissions, and history — while models and computers stay replaceable parts.

Seven concepts, kept apart

The product is the separation. When these collapse into each other — agent into chat session, run into VM, side effect into function call — you get software nobody can govern or recover.

AGENT               who/what the operator is (durable state)
ASSIGNMENT          its ongoing responsibility
TASK                one discrete desired outcome
RUN                 one execution attempt (records the model)
LOGICAL OPERATION   one intended side effect (ledger identity)
OPERATION ATTEMPT   one attempt to perform it
ENVIRONMENT         one disposable computer

The architecture

        PERSISTENT AGENT  ── assignment · state · grants
                │
                ▼
           TASK QUEUE
                │
                ▼
            GOVERNOR
     ┌──────────┼──────────┐
   Policy    Ledger     Verifier
     └──────────┼──────────┘
                ▼
           AGENT LOOP ◄── the model's one seat: DECIDE
                │
                ▼
        CAPABILITY BROKER  ── default deny, enforced in executors
                │
                ▼
     DISPOSABLE ENVIRONMENT ── checkpoints survive it

Autonomous Operators separates the agent from everything an agent is usually conflated with. An operator is durable application state carrying an ongoing assignment; tasks are discrete outcomes under it; runs are single attempts; environments are disposable workspaces restored from checkpoints; and every intended side effect is a logical operation in a ledger whose idempotency key is its identity — never its arguments. The model's only seat in the loop is DECIDE: it proposes one operation at a time, and a deterministic runtime validates against a closed vocabulary, evaluates default-deny authority (pausing for human approval where policy demands it), executes through boundary-enforcing capability brokers, verifies completion with acceptance criteria the model cannot satisfy by asserting, and commits durable state only after verification. Interrupt a run and recovery reads the ledger — committed operations are visibly skipped, unknown outcomes must be reconciled before retry, and nothing is ever blindly replayed.

What the demo proves

PERSIST

Scout finishes a task, its verified results become durable memory — and then its computer is destroyed. Not paused: the workspace ceases to exist. The agent, its history, its evidence, and its authority remain, and the next task starts from a fresh environment restored from a checkpoint, with nothing re-explained.

GOVERN

The model proposes exactly one operation at a time; a default-deny authority engine rules on each. Research and workspace writes pass automatically; publishing halts the run for a human decision — Scout cannot authorize its own action, and either decision becomes a permanent, attributed event before the same run resumes.

VERIFY

The model claiming completion triggers a deterministic verifier and nothing else: products researched, required fields present, every claim carrying evidence that resolves, the artifact present and schema-valid. Only the verifier's verdict completes a task, and only verified outcomes become agent state.

RECOVER

Interrupt the run mid-task and the environment dies with it. Recovery reads the operation ledger — committed operations are visibly skipped, never repeated, because identity is the persistent logical operation, not its arguments; an unknown outcome must be reconciled through a deterministic probe before any retry.

TWO EXPLICIT MODES

In LIVE AI mode a real model proposes operations under the site's daily budget — and can honestly fail, which is part of the demonstration. In DETERMINISTIC DEMO mode a scripted proposer stands in, labeled as a simulation everywhere it appears. The runtime treats both identically, records which one ran on every run, and never switches between them silently.

Capabilities

—A persistent agent as durable state: identity, assignment, memory, capability grants, and authority survive every run, every environment, and every model swap — versioned, with every mutation attributable to a verified run
—The seven-concept hierarchy as real contracts — Agent, Assignment, Task, Run, LogicalOperation, OperationAttempt, Environment — with checkpoints and artifacts on their own lifecycles, so destroying a computer destroys none of the work that matters
—An operation ledger that is authoritative for execution and recovery: database-enforced unique idempotency keys, at most one committed side effect per logical operation, ambiguous outcomes reconciled through deterministic probes before any retry
—Default-deny authority evaluated by the runtime, never the model: auto-allowed research and workspace writes, a human approval gate on publishing, and no path by which the agent can expand or approve its own authority
—Deterministic verification as the only door to completion — the model's claim of success triggers the verifier and nothing else; failed verification leaves the task incomplete with bounded remediation
—One live-AI boundary with two explicit modes: a real model proposes at DECIDE under the site's daily budget with budget exhaustion machine-distinct from provider failure, or a labeled scripted proposer stands in — and the two never switch silently
—A command-shaped public surface: visitors issue advance/approve/interrupt/control commands; model, prompts, capabilities, policies, and budgets are server-owned configuration no client can supply
—An append-only flight recorder per session — every proposal, authority decision, approval, attempt, artifact, verification, checkpoint, and recovery as sequenced events the demo renders verbatim

Claims, graded

Implemented & demonstrated

Everything the demo executes is the real runtime: the persistent agent as versioned durable state, the operation ledger with database-enforced unique idempotency keys and reconcile-before-retry ambiguity handling, default-deny authority with a human approval gate, deterministic verification gating completion and state commits, per-commit checkpoints restored into fresh environments, ledger-driven recovery with visible skips, live model proposals at DECIDE under the site's shared daily AI budget (budget exhaustion machine-distinct from provider failure), and an append-only per-session event stream the demo renders verbatim.

True, but scoped to a sealed demo

The world is deliberately fake: environments are sandboxed simulated workspaces rather than VMs, web.search reads a fixture corpus about fictional products with no live internet access, publishing lands in the demo's own research feed, and every demo agent is ephemeral-persistent — it outlives its runs and environments, and is deleted with its 24-hour session.

Deferred, and labeled in the plan

Real sandbox providers behind the EnvironmentProvider seam, real connectors and credential grants behind authentication and tenant isolation, multi-agent delegation, recurring routines, and long-lived customer agents — the authenticated product surface where those belong is designed for, not shipped.

Not claimed

This is not a chatbot, not an agent swarm, not a browser-automation product, not a persistent-VM product, and not an AGI claim. It demonstrates the runtime abstraction underneath persistent autonomous software agents — nothing more, and nothing less.

Limitations, stated

·The demo world is sealed and simulated: sandboxed workspace environments, a fictional-products corpus, and a demo-only publishing target. The runtime mechanics around them are real and gate-verified.
·Demo agents are session-scoped by design: Scout persists across runs, environments, and model swaps within its session, and the session (24 hours) is its lifetime. Anonymous visitors accumulate no permanent agents.
·The public surface is command-shaped: you can advance, approve, interrupt, and control — you cannot supply prompts, tools, models, or policies. That constraint is the security envelope, not a missing feature.
·Live AI mode can honestly fail — provider loss and budget exhaustion fail the run visibly and recovery is explicit. There is no silent fallback to the scripted proposer, ever.
·One agent, one assignment, one active task in V1. Delegation and cooperation are deferred with their whole class of concerns.

Run the demo Read about the Agent Runtime