FOUNDER OS

A solo founder's time is the bottleneck. Every tool that promises to save it demands presence in return: open the dashboard, review the queue, approve the draft, close the loop. The interface becomes the job.

Automation frameworks compound the problem. A Zapier flow saves the click but not the monitoring. A cron job saves the scheduling but not the verification. Something still has to watch the output, catch the failures, and surface what matters — and that something is usually the founder, at 11pm, on a laptop.

The design target was different: zero-laptop operation. A command arrives as a voice note or a chat message from wherever the operator happens to be. Agents decompose it, execute it overnight, and the next morning's digest returns outcomes, receipts, and any decisions that need a human eye. The operator reviews in five minutes, approves what needs approval, and continues their day.

Three always-on AI daemons run as supervised services inside a single Linux container on a self-hosted hypervisor. Each daemon has a distinct role — curator, operator, planner — and strict per-daemon write-rights so no two agents can corrupt the same files. Shared filesystem, git worktree isolation per daemon, restart-safe session-state resume so a reboot doesn't strand in-flight work.

The command channel is a messaging app. The operator sends a goal — text or voice transcription, from a phone, from anywhere. A slash-command router (15+ commands) dispatches it to the right agent lane. The agents plan, decompose, and execute: searching, writing, filing, building, orchestrating subagents for parallel workloads. Everything material writes a receipt to disk as it runs — mid-flight API errors don't lose work.

A morning digest aggregates overnight receipts into a structured briefing: what ran, what completed, what needs a decision, what to ignore. The operator sees outcomes, not operations.

The approval-card pattern. The system draws a hard line between actions the agents can execute autonomously and actions that require the principal's explicit sign-off. Outbound communications, spend, destructive operations, and network/security changes are all in the propose-only class: the agent writes the proposal to disk, surfaces it as an approval card in the digest, and does nothing further until the operator responds. The card states what it wants to do, why, and what the one-command revert is. Approval is a reply; refusal is silence or a “no.”

Silence discipline. Agents ping on three conditions only: blocked (missing credentials, conflicting spec, destructive ambiguity), done (task complete with receipts), or approval needed. No progress updates, no lint-error notifications, no “working on it” acknowledgments. The operator's phone stays quiet while the system runs.

Task receipts. Every unit of work leaves a receipt on disk before the session ends. The corpus has accumulated 1,564 work receipts (1,002 active, 562 archived, March through July 2026). Receipts serve two purposes: they are the ground truth for the morning digest, and they are the handoff artifact when a daemon restarts mid-task. A new session reads the receipt and resumes; no work starts over from scratch.

Engineering lessons as living policy. Every incident, correction, and system failure produces an append-only lesson entry. The corpus now holds 160 lessons covering failure modes across networking, container orchestration, LLM session limits, multi-agent contention, and cross-browser rendering. Every new agent session loads the lesson index at startup — the mistakes are structural memory, not individual recall.

Defense in depth. Because the system executes autonomously while the operator sleeps, the guard stack is not optional. A pre-action command hook blocks destructive shell operations. A credential-egress guard blocks any outbound message containing secret patterns. An ingest guard with a local-LLM prompt-injection classifier flags web content that attempts to issue commands. Integrity monitoring on sensitive memory detects unauthorized changes to the persistent corpus. Automated write-rights verification surfaces any daemon that wrote outside its lane.

The governance layer is a written constitution — seven articles, ratified by the principal, independently adversarially red-teamed the same night and hardened against 27 findings. The floors it sets — no auto-merge, no auto-send, no auto-spend, secrets never leave the host — are not configurable at runtime. Autonomous mode operates inside those floors; “never pause for approval” never applies to the gated classes.

Multi-model spine. The fleet mixes frontier models with local open-weights models running on self-hosted GPU inference at interactive speed. The model-agnostic spine is a stated design goal: expensive frontier models handle judgment calls and adversarial verification; the local model handles high-volume pre-filtering and classification. The system doesn't depend on any one provider staying available or affordable.

The security pipeline is a concrete example of this tiering. A network IDS sensor feeds raw alerts to a deterministic pre-filter, then to the local model for context-classification, then to a push alert only when warranted. Alert path verified end-to-end with a synthetic injection. The first time an IDS suppression rule silently failed to load, the lesson went into the permanent archive and the suppression verification method changed.

The system has been running continuously since early 2026 across a small self-hosted cluster. The operator manages it from a phone — voice note in, morning digest out. No laptop required for task issuance; the digest keeps review to under five minutes.

Specific scale figures — MTTR before and after, uptime percentage, cost savings in dollars — are UNMEASURED and not reported here. What is measured: the corpus holds 406 persistent memory files with a 121-entry curated index, 1,564 work receipts, 160 engineering lessons, 50 installed skills, and 21 learned beliefs that shape agent behavior (6 hard gates, 15 advisory). Five documented incidents each have a root-cause writeup and a lesson entry — the hypervisor firewall that silently dropped bridged traffic, the backup freeze that caused fleet-wide false “network down” alarms, and three others. None of them happened a second time.

The studio's AI consultancy uses the same infrastructure to run client-facing automation builds — the system that delivers overnight is the same system the studio demonstrates and deploys.