ai-os — Autonomous Work Control Plane
An orchestration layer that runs AI agents unattended overnight under enforced spend budgets, refuses to mark work done unless an independent verification command exits zero, and escalates to a human after three failures. Running nightly in production since September 2026.
The Challenge: Agent frameworks are easy to demo and hard to trust. The failure that prompted this one was mine: a system I had built died on 7 August 2026 and went unnoticed for 25 days, because its errors went to a log file nothing ever read. It was not a model failure or a prompt failure. It was an operations failure — nobody had asked the system to prove it was still alive.
The Result: A control plane that runs autonomous work on this machine every night at 03:00 and can be driven from a phone over SSH. It has been running daily without silent failure since it replaced the thing that broke.
The design position is that an agent's own report is the least trustworthy signal in the system, so nothing in the architecture depends on it.
What makes it safe to leave running
- Budgets are enforced, not estimated. Cost is read from the model runner's own accounting (
total_cost_usd), not guessed from token counts. Caps are $5.00/day globally and $1.50 per builder run, with a 900-second wall clock. A run that would exceed a cap is refused before the model is launched, and the refusal is logged — you can prove what did not happen, not just what did. - Verification is independent of the agent. Every task must be declared with both a completion condition and a verification command. The orchestrator runs that command itself and reads its exit code. The agent's claim of success has no vote. A task whose verification fails is marked
verify-failedwith the last 40 lines of output retained for diagnosis. - Failure escalates rather than loops. Three failures blocks the task and raises it to a human. There is no retry-until-it-works path, because that is how a broken task quietly consumes a budget.
- Heartbeats, because of the 25 days. Scheduled jobs write a heartbeat on success; a status check flags anything stale. Absence of a signal is treated as failure, which is the entire lesson of the original incident.
- Autonomy is a number, and it is deliberately low. Level 2 permits drafts and local code changes. Level 3 would add commits. Nothing above 3 is implemented — not "not enabled", not implemented — so there is no configuration mistake that grants the system deploy, spend, email, or production database access.
Why it matters commercially
Most businesses evaluating AI agents are not asking whether a model is capable. They are asking what happens at 3am when it is wrong, how much it can spend before someone notices, and what it is able to reach. This system exists because those were my own questions first, and the answers are architectural rather than aspirational.
It is also the reason a single freelancer can carry the workload of a small team: the repetitive engineering runs unattended and under budget, and human judgment is spent on the decisions that actually need it.