Autonomous execution layer/ v0.1 · source private
IronAOL
Agents declared as files, not written as code
Describe an agent — what it knows, which tools it may touch, what memory it may read — in a folder of markdown. Iron compiles it into a process, starts it when work arrives, retires it when the work is done, and writes everything it did to a log nobody can edit.
A folder is the agent
No subclassing, no registration call, no wiring code. Most agent frameworks are one Python process running a loop — fine until one crash takes down everything.
--- # ships with the agent name: librarian description: Finds and summarises documents held in the permanent store. clearance: read memory: episodic: { access: read, scope: own } semantic: { access: readwrite, scope: mesh } --- You are the librarian. You locate documents, quote them accurately, and always cite the document id you took a statement from. If you cannot find something, say so — never fill the gap from general knowledge.
A typo fails the build
Folders are validated into a catalog at build time, not discovered at runtime.
One process per task
Experts spawn as ROS 2 lifecycle nodes and are retired when done, with depth and fan-out limits.
Identity travels, permissions stay
Who an agent is lives in one file; what a deployment grants it lives in another.
Six stations, every time
The same path whether a request takes a second or three days. Each station is a separate process on the bus.
A request arrives and becomes a session. Nothing is interpreted yet.
The router reads the compiled catalog and picks the one expert that should own it.
A process spawns for this task alone, carrying only its own clearances and memory scopes.
MCP servers start in-process on demand. Clearance gate, then target gate — both must pass.
Learning is written to the append-only log; graph, vector and document stores are projections of it.
Each step is fingerprinted and committed, so work resumes exactly where it stopped.
Written down before it happens
Irreversible actions are journaled before they fire and confirmed by independent observation after — so a crash mid-action never leaves the system unsure whether it happened. Delete and purge are denied at the stream; every memory is a projection of this log.
Why it survives its own failures
One crash stays one crash
Every agent is its own OS process with external start, stop and recovery.
Work outlives a reboot
A waiting job is a row in a table, not a thread parked in memory.
An agent cannot widen its reach
One gate asks whether it may hold a tool this powerful; another whether it may point it at this path.
Changes land under review
Commands run in throwaway git worktrees under bubblewrap, approved hunk by hunk.
Illustrative trace · the event kinds are the system’s own
The reference deployment
A newsroom of four desks. A claim is verified when two unrelated sources carry it — and that rule is code, not a model’s judgment.
source_curator
Adds, retires and re-checks feeds so nothing downstream reads something quietly broken.
collector_news
Pulls every feed on a schedule and writes each record to the log before anything interprets it.
analyst
Reconciles entities, flags contradictions, ranks significance — only what code cannot decide.
reporter
Composes bulletins from what survived verification, every statement still carrying its sources.
Read deeper
The whole system, one document
Sixteen sections: transport split, mesh compiler, both permission gates, memory plane, durable jobs, sandbox — and what is not built yet.
Early, working, not stable
v0.1.0, no tagged release, interfaces will change. The source is private; this site is the overview.