Tessera
A local-first sovereign agent system — presence and absence on one kernel
Last devlog: June 30, 2026
Key boundary: The capability boundary. The autonomous actors cannot perform a world-touching effect — not because a rule forbids it, but because they hold no credential that performs one and have no network egress to reach the world. Only the bailiff holds world-touching credentials, and it releases a queued effect only on explicit operator approval. The trees do reversible work and stage proposals; reaching the world directly is not an action they can express.
Why it matters: An agent working for days with no human in the loop must be structurally unable to do harm, not merely instructed against it. An instruction not to act is a comment; the absence of the capability to act is a boundary. If it failed, absence-time work would inherit presence-time permissions and a single bad inference could publish, spend, or deploy with no one watching.
Notable decision: The local model never orchestrates. It reads a compact record, reasons about a bounded step, and returns a schema-validated proposal; the deterministic kernel decides and executes. The reasoning lives beside the control loop, never inside it — so the system's behavior survives a hallucination, a latency spike, or a model swap.
Tessera is a local-first sovereign agent system built around the operator's presence/absence cycle. Two trees share one kernel: the Presence tree serves the operator in-session (context, memory, fast orchestration, tool-calling), and the Absence tree works while the operator is away on rotation (plans, builds, researches, tends a goal ledger for days). The kernel is the shared substrate — a durable event bus and the single-writer memory store.
The central safety property is structural, not instructed: the autonomous actors cannot perform world-touching effects (publish, send, deploy, spend) not because a rule forbids it, but because they hold no credential that performs one and have no network egress to reach the world. Only the Bailiff holds world-touching credentials, and it releases a queued effect only on explicit operator approval. This is capability-separation, not instruction-separation — the difference between "told not to" and "cannot."
The local model never orchestrates. It reads a compact record, reasons about a bounded step, and returns a schema-validated proposal; the deterministic kernel decides and executes. The reasoning lives beside the control loop, never inside it — so the system's behavior survives a hallucination, a latency spike, or a model swap.
Tessera was migrated from a fourteen-daemon HTTP federation onto the typed-actor kernel phase by phase, across eight phases, without breaking the running system once. The old system was retired by succession — proven equivalent, then stood down — not by demolition.
Devlog posts about Tessera
The system that learned to know its own limits
A local 9B model hits capacity walls it can't see. The engineering wasn't building the wall — it was teaching the system to notice when the model was stuck on the wrong side of it, and route around it without a human in the loop. Three signals, two timing bugs, and the moment the system became self-escalating.
The seam that four walls make
A local agent needs tools. Some are safe, others touch the world. The question is where to draw the line. The wrong answer is a prompt that says 'don't touch the world.' The right answer is a seam in the code that makes touching the world structurally impossible — and four independent boundaries that happen to land in the same place.
The clock that preempts itself
A shared GPU is a contention problem. When the operator is present and a background batch is running, something has to wait. The wrong answer is 'whatever arrived first.' The right answer is 'whatever the operator is doing, always.' The quartermaster makes presence preempt absence by construction — typed permits, reserved slots, preemption in the type system rather than in a policy.
Moving a live store, and the two bugs the last gate caught
I moved a live agent system's memory from the old hub to a new kernel — one writer, zero rows lost — and the checks I ran at the irreversible step caught two real bugs before the point of no return. The bugs are the evidence the gates work.
Make the unsafe path impossible to build
Eight phases moving a live fourteen-daemon system onto one typed-actor kernel, without breaking it once. The methodology that held: not 'remember not to do the dangerous thing' but 'make the dangerous thing structurally impossible to construct.' The difference is the whole story.