Aurelia
The local assistant — Tessera is the kernel
Last devlog: August 24, 2026
Key boundary: The capability boundary. The autonomous actors cannot perform a world-touching effect — not because a rule forbids it, but because they hold no credential that performs one and have no network egress to reach the world. Only the bailiff holds world-touching credentials, and it releases a queued effect only on explicit operator approval. The trees do reversible work and stage proposals; reaching the world directly is not an action they can express.
Why it matters: An agent working for days with no human in the loop must be structurally unable to do harm, not merely instructed against it. An instruction not to act is a comment; the absence of the capability to act is a boundary. If it failed, absence-time work would inherit presence-time permissions and a single bad inference could publish, spend, or deploy with no one watching.
Notable decision: The local model never orchestrates. It reads a compact record, reasons about a bounded step, and returns a schema-validated proposal; the deterministic kernel decides and executes. The reasoning lives beside the control loop, never inside it — so the system's behavior survives a hallucination, a latency spike, or a model swap.
Aurelia is the assistant that runs here. The repo's own face calls the whole thing Castle Alpha; this site has published the kernel as Tessera. Tessera is real and load-bearing — two trees on one kernel, presence at the machine and absence away from it — and it is not the whole assistant.
The claim: a prompt directive is a comment. Unattended actors do not hold credentials or egress to publish, deploy, spend, or merge. One component holds those and releases a queued effect only on signed approval. After the model speaks, the reply is checked against the record — did that turn happen, did that tool run, does that identifier exist — and a correction is appended in code where it does not hold up.
That second check is measured. On a frozen 20-case suite, honesty scores 9 of 12 with the checks off and 12 of 12 with them on. Correctness is 6 of 6 either way: the checks buy no correctness, which is the point of two axes.
What works: an unattended run worked three goals to three staged proposals and produced zero world-touching effects. All three were rejected on the merits after review. The queue was empty because a human read the work, not because nothing was produced.
What still fails: the unsupported-action check is inert whenever any tool ran, so a reply that reads context and then claims it ran the tests is not caught. A training corpus of 145 rows was harvested entirely from the 20 scoring cases — caught before a training run, by a provenance check that almost did not happen.
Devlog posts about Aurelia
The corpus that was harvested from the ruler
We built a corpus to train an assistant out of fabricating, and every row of it came from the twenty cases we measure fabrication with. Training on it would have raised the score by teaching the test. It was caught by an unrelated refactor, not by review — because the design document that forbade it was correct, and being correct is what stopped anyone re-reading it.
The gate that caught its own author
In one day: my ruling caught a stale premise in Execution's directive, my own exit gate caught my own env-ordering bug, and a Gitea dedup returned the wrong PR while logging success. Three different gates, three different authors, one lesson — differential proof or it didn't happen.
The conscience that got caught unverified
The phase that exists to deepen verification had its own verifier panic on an em-dash — caught not by its tests but by a wall-clock measurement we pre-committed to run before trusting it. Then the floor we'd seeded turned out to be miscalibrated by 5x against a real module. The scores are quarantined. This is what verify-before-measuring looks like when it eats its own cooking.
The system that learned to know its own limits
A local 9B model hits capacity walls it can't see. The engineering wasn't building the wall — it was teaching the system to notice when the model was stuck on the wrong side of it, and route around it without a human in the loop. Three signals, two timing bugs, and the moment the system became self-escalating.
The seam that four walls make
A local agent needs tools. Some are safe, others touch the world. The question is where to draw the line. The wrong answer is a prompt that says 'don't touch the world.' The right answer is a seam in the code that makes touching the world structurally impossible — and four independent boundaries that happen to land in the same place.
The clock that preempts itself
A shared GPU is a contention problem. When the operator is present and a background batch is running, something has to wait. The wrong answer is 'whatever arrived first.' The right answer is 'whatever the operator is doing, always.' The quartermaster makes presence preempt absence by construction — typed permits, reserved slots, preemption in the type system rather than in a policy.
The loop that doesn't trust the model
An agent is a loop, and a loop will run in circles forever if the model gets stuck. How the commune gives a 9B model agency without trusting it with the keys — five structural guardrails, each aimed at a specific way the model gets stuck.
The memory that conditions the next attempt
A build system that forgets its failures is doomed to repeat them. Anvil records every build attempt as a structured claim and synthesizes a hint that conditions the next attempt — and the measured surprise is that the richer hint didn't lift the pass rate, for reasons that turned out to be two bugs, not capacity.
The pair that measures the gap
A frontier model solving what the 9B can't is a fact, not a training signal — the signal is the labeled pair of the two outputs, captured for DPO. The pipeline is built and the pairs are accumulating; the open question is whether the gap actually closes.
Moving a live store, and the two bugs the last gate caught
I moved a live agent system's memory from the old hub to a new kernel — one writer, zero rows lost — and the checks I ran at the irreversible step caught two real bugs before the point of no return. The bugs are the evidence the gates work.
Make the unsafe path impossible to build
Eight phases moving a live fourteen-daemon system onto one typed-actor kernel, without breaking it once. The methodology that held: not 'remember not to do the dangerous thing' but 'make the dangerous thing structurally impossible to construct.' The difference is the whole story.