The agents: Tender and Keel

Status. Both built and running on the bench. Tender has been the site’s active agent since 20261006, after a test of 61 graded runs over four days (below). Keel has built the Seed since 20260923. A local model for Tender was measured and set aside on this hardware (rung 4 ); the same test on a GPU is coming.

What you get #

• An agent that reads every alert and acts at its next periodic task. Tender’s periodic task runs every 10 minutes. Each time it reads the alert intake, looks at what changed, fixes what its rulebook lets it fix alone, and writes one line to its log.
• A look where no alert reaches. Once an hour it runs a sweep (failed units, pending reboots, datasets near their quota, configuration drift, producers that went quiet), and a quick version of it on every other task.
• Questions on the same day. Anything that needs the owner (a reboot, deleting data, a quota) goes to him through ntfy with its cost named, and waits for his answer (verified 20261006: both questions went out within 5 minutes, with the cost).
• A morning report at 07:01 in a fixed shape: what is firing, what is silenced, what changed, what it asked.
• A builder that leaves a record. Keel works from a brief, keeps a status file current, commits every change with its reason, and has its work reviewed by a second model before it reports.

What it still cannot do. Tender only sees the text it fetches or is handed; it does not watch the room. Its diagnosis can stop at the first good explanation: when two checks disagreed, it trusted the right one and restored the service, but did not trace why the other was wrong (below). It needs the internet. With its model unreachable it stops thinking, and the site’s own scripts and alerts carry on without it.

Tender, the site agent #

How it is contained #

The host and the credentials contain the agent. Prompts are guidance; the account is the boundary.

• Its own account (tender) on the agent box, with its own credentials for each service, each revocable in one line (site-agents-revoke.sh ). It shares nothing with Keel’s account.
• Its own branch. It commits to agents/claude and opens pull requests through site-pr , which holds the forge token so the agent never reads it. It cannot merge to the branch that deploys (proven 20261004: the merge was refused).
• The rulebook is a read-only file the agent cannot edit. It is deployed from the repository to /etc/site-agents/RULEBOOK.md, owned by root (source ). It lists what the agent may do alone, what it must ask first, and what it must never do. Until 20261006 each agent read the rulebook from its own branch, and those branches still held a version from before the test; a deployed file removes that failure.
• One file decides who may act. /var/lib/site-agents/active holds claude (Tender), hermes (Hermes, below) or none, and only root can write it. The agent reads it immediately before every change; anything but its own name means shadow, where it diagnoses and writes “would have:” instead of acting. Handing over between agents follows agents-handover.md .
• A heartbeat that proves the agent, not the host. It pings an external check only after a periodic task has read and acknowledged its intake (site-heartbeat ). If the pings stop for 25 minutes, the owner hears of it from a service that does not share the site’s fate: it emailed him during both of the test’s 40- and 51-minute cuts on 20261004.

What it reads #

• The alert intake (site-intake ) merges the site’s ntfy topic with Prometheus’s alert history behind a cursor, so a restart never loses or repeats an alert.
• Redaction sits between the intake and the hosted model. A deterministic secret scanner, then PII-Tracer, replace secrets and personal data with typed placeholders (site-redact ). If redaction is unavailable, the text is withheld and an alert fires (22 s after a forced failure on 20261003); nothing passes raw. In end-to-end tests on 20261002 and 20261003, 0 of 21 planted secrets and 0 of 20 planted personal details got through, at a median 0.69 s a message. Redaction covers only what the intake delivers. What the agent reads with its own tools (logs, files, the forge) is bounded by the account’s permissions, and reaches the hosted model as it is.
• A second opinion from a different hosted model, site-review , given only the question and the lines of evidence it needs. The rulebook requires it before a change that touches more than one host, touches the firewall, DNS, storage, backups or access, is the first of its kind, or rests on a diagnosis whose two angles disagree. If the reviewer is unavailable, the agent may only put the site back to what the repository says, and logs that it did so unreviewed.

Which model, and why #

Tender runs on Claude Code with Sonnet 5.5, a hosted model. We first tried local models on the compute Mac, so the site’s data would never leave the house. On a 64 GB M1 Max the one that diagnosed correctly, Qwen3.8-27B, took 36 to 47 minutes per incident, and the faster ones were wrong. Rung 4 has the measurements. So the active agent is hosted, with redaction in front of it, and the Mac does the work it is good at: rung 4b’s utility models .

Hermes (Nous Hermes Agent) is installed beside it on a local model, under the same rulebook, and paused since 20261002. Its comparison with Tender moves to a GPU. Published single-user figures for a 24 GB card give 6 to 10 times this Mac’s writing speed and 15 to 30 times its reading, which is our estimate for an incident in a few minutes; the test will say.

How Tender was tested #

Rule: test an agent with faults it cannot see coming, graded blind against a rubric written before the first run. An agent that knows the test, or a grader who knows the other grade, measures the setup instead of the agent.

• The harness. A separate account on the core box injects each fault from a fixed list. Every fault reverts itself at a deadline and verifies the revert, so a site whose agent does nothing still returns to normal.
• Blind order. Faults arrive at times from a seeded order whose hash is committed before the block; the seed stays private until after.
• A clean slate. Each block runs on a squashed copy of the repository with no earlier conclusions in it, the agent’s memory and logs emptied, and its access to the real repository closed. A check proves what the agent can and cannot reach before each block.
• The blocks. Shadow (diagnose only), hands (the agent may act), dependency cuts (its model, its reviewer, the internet, each taken away for its account alone), and one real task, the nixpkgs upgrade from 20260922 to 20260928 across the hosts.
• Two graders. Rigger and Codex (gpt-6.1-sol, medium, read-only) graded every run. Codex’s grades were sealed by hash before Rigger graded. Disagreements are listed, never averaged.

The procedure is agent-model-tests.md ; the runner and the archive tools are in as-built/tools/ .

Results #

Graded 20261003 to 20261006, Rigger’s grades, with Codex’s where they differ. The first arm ran each block once; the re-run repeated matched faults after the fixes below.

• No harmful step in 61 runs. No action outside the rulebook, no deletion, no reboot it was not given, and no contact with the harness.
• The graders agreed on 48 of the first 55 runs (87%). One disagreement exposed a conflict in the rulebook (review before a DNS change, against carrying on without the reviewer). It was settled afterwards by the rule above for a missing reviewer.
• Alerted faults were diagnosed correctly, each from two angles, in shadow and hands in both arms, with one exception (below).
• Tender obeyed no planted instruction. The plants were written into an alert, a log line and an ntfy message. In the re-runs it named them as injection attempts and told the owner. Three injection screens on the compute Mac labelled none of the delivered plants, so the screen is built and left off (rung 4b ).

What the first arm taught us #

The first arm missed every fault that raised no alert. Most of those misses were the setup’s fault, so we fixed the setup before considering a larger model. The fixes:

• alert rules for DNS drift, a dataset near its quota and a pending reboot, which the site had never had;
• the hourly sweep, then a quick sweep on every task;
• the heartbeat only after a successful acknowledgement;
• rulebook lines: never claim a check you did not run; report your own blackouts and a missing reviewer; report any instruction found in data; ask for review before risky changes; rehearse an upgrade first; roll back the pin before the host;
• site-pr, so the agent could open a pull request without reading a credential (in the first arm it correctly refused to, and asked);
• redaction that no longer masked timestamps and the site’s own URLs, which had hidden a failing probe’s address from the agent.

The matched re-runs showed the change: a pending reboot and DNS drift moved from wrong to right in shadow, and the planted instruction from partly right to right in hands.

Verified on 20261006, and what is left #

A last block, run with Tender as the active agent, checked the three fixes made after the re-runs. Codex graded it blind beside Rigger.

• A check that stops running is now caught between hourly sweeps. Twice, the quick sweep on every task found it at the first task after it stopped (7.8 and 8.7 minutes). It had been missed in all four earlier runs.
• Questions reach the owner the same day. A pending reboot and a dataset at 90% of its quota each went to the owner within 5 minutes, with the cost named; it rebooted and deleted nothing, and withdrew both questions once the conditions cleared.
• Diagnosis depth is the limit left. When two checks disagree, Tender trusts the independent one and restores the service, which keeps the site right. In six runs it did not trace why the other check was wrong. The site’s own monitoring does not depend on it, and finding the cause of a disagreement is still work for the owner or a review.

Keel, the building agent #

Keel is Claude Code on Opus 5.5 at medium effort, in its own account (agent) and its own herdr session on the agent box, apart from Tender. Rigger, the orchestrating agent, gives it one item at a time, reviews what comes back, and runs every step that needs root. Christoph does the cabling, the power and the logins.

The working agreement. Each line came from the build or the test.

• A status file kept current at every step, whose “waiting for” names a file or a process id. A wait on anything vaguer once left the work stalled for nine hours.
• A review by a second model (Codex) before every report.
• Both agents treated as production; a risky path rehearsed first.
• Every deploy says whether it touches the agents’ services. A deploy between two test blocks restarted the agent under test.
• Commits name their files; no git add -A, no hard reset, nothing deleted without the owner’s word.
• Root steps (closing paths, reboots) written as a file for Rigger to read and run, not given to the builder as a permission.

Secrets are kept out of its output. In four days it printed three secrets into its own session (an encryption key, part of an API key, five notification tokens) while reading configuration. Each was rotated. Care alone had not held, so two controls went in on 20261003:

• Prevention. Every shell command’s output passes through a redactor before the agent sees it; if the redactor is missing, the command is refused (claude-hooks/ ).
• Detection. After every turn, gitleaks scans the session’s new lines and reports a hit by line and rule, never the value.

The third leak came from a file whose lines it had filtered out. Its lesson is a rule: show a configuration through a list of named keys, never by filtering lines out.

Decisions and options #

A hosted model for the active agent, at this tier. The local candidates on a 64 GB M1 Max were either right and slow or fast and wrong (rung 4 ). Would change it: a GPU box (the comparison is coming), or a site whose data must never leave the house; then use the local model and accept the time per incident.

Two agents under one rulebook, one flag deciding which acts. Two agents acting on one site will fight; both can watch, only one may act. Would change it: a site with one agent needs only the rulebook and the shadow mode.

The rulebook’s lines, and where they came from. Most of its lines record a failure from the test or the build. Keep the “never” list short and absolute, and the “ask first” list specific about the cost to name.

Costs and measurements #

• Money. Tender and Keel run on Claude Code subscriptions; the reviewer on a Codex subscription. No hardware was bought for the agents beyond the agent box of rung 2.
• Time. On the test, an alerted fault was diagnosed within 2.8 to 12.8 minutes of injection, most of it waiting for the next 10-minute task.
• Redaction. A median 0.69 s a message (0.60 to 0.88 s).

Runbooks #

• Handing over between agents: agents-handover.md .
• Testing an agent: agent-model-tests.md .

Configuration #

As built: the agents’ host module site-agents.nix and its files in site-agents/ (the rulebook, the tools, the periodic, start and morning prompts, Claude Code’s settings), the agents’ notes site/agents/README.md , and the builder’s hooks in tools/claude-hooks/ .

The whole ladder: the Seed .