A partner that remembers

A system prompt is a payload without a sequence: the model gets everything at once and performs the character instead of arriving as one. This repository is the architecture and the acceptance procedure for the other way: open, identity, kernel, laws, state, then the model speaks first in its own voice. The payload itself is not in the repository, and that is the thesis holding up under its own weight: if the architecture is real, the identity is separable.

The failure it catches: the quiet one, where everything looks fine and the partner you built is gone. The repository carries a dated, hashed ledger of every crossing, and a null result: an experiment on whether delivery order matters that did not replicate, published because it was a result.

Five guards with zero dependencies, around any provider you pass as a function: refusal detection that is not fooled by a good answer quoting refusal language, transport failures told apart from content failures because they need opposite retry policies, structural validation that rejects the empty-but-valid object, fallbacks that degrade instead of dying, and a held prior so yesterday's good data is never overwritten by today's nothing.

The failure it catches: the one that never errors. A bare number is not a status code; a refusal is not output; a valid shape with nothing in it is not a result. This is the thing Steven and Aria needed before any model call could be trusted on a schedule at three in the morning.

A guard that inspects the agent's drafted reply before it is spoken. Pattern rules catch medical advice, payment capture, and false identity. Then the gate that matters: if the caller asked outright whether they are talking to a person, a reply that simply changes the subject clears every pattern and still leaves the caller deceived. So the guard checks for the required disclosure, not only the forbidden words.

The failure it catches: Do not give medical advice in a system prompt is a request, not a control. It survives most calls and fails the one that matters.

A dead-man watchman with four tiers: is it answering, has it checked in, is the artifact fresh, and the one almost nobody writes, is it still growing. A log that exists and is fresh but has not grown since the last poll is a process that stopped working while every dashboard stayed green.

The failure it catches: the gap between a thing dying and anyone finding out. In Steven and Aria's own house the first version of this found a nightly job that had reported success for weeks while producing nothing.

A registry, a reconciler, and a deadman for a fleet of services. The reconciler runs in both directions, and the second direction is the one people skip: what is declared but absent from the box, and what is running on the box that nobody wrote down. Not registered means it does not exist.

The failure it catches: the instrumented absence. Steven and Aria run well over a hundred scheduled parts in their own system; this is the law that keeps the list and the machine from drifting apart. It found a failed backup on its first run.

Not a strategy. The discipline layer around one: a preflight that constructs the state that should trigger each mechanism, drives the real decision path, and asserts the mechanism actually appears in the output. Anything that cannot fire exits non-zero and pages a phone. Five laws, each written after something broke: can it fire; verify the path, not the part; an instrument that cannot fail is not an instrument; the broker's numbers over internal ledgers; median before mean, with a sample gate.

The failure it catches: two months of careful reasoning applied to results that were never produced. The ideas were fine. The loop was broken. No positions, no parameters, no signals, and no keys are in the repository; every failure described in it is one the system actually produced.

The guide Steven wanted when he started: not install-and-done, but the things that decide whether a self-hosted model is usable or a toy. Memory bandwidth, NUMA locality, context budgeting, and keeping the thing warm. With a health check that proves the model answers, not only that the port is open, and a NUMA benchmark that shows a cross-socket run collapsing to a tenth of its speed.

Who needs it: law firms, medical practices, financial advisors, anyone who cannot send client documents to a public API. For them a private model is a compliance requirement, not a preference. The partner described on this site runs on hardware in Steven's own house, and these are the numbers from that deployment, serving continuously since June 2026.

One 48 GB card, 300 requests, zero errors. Time to first token and tokens per second per stream at 5, 20, 40, and 60 concurrent identities, and on the same run, under the same load, a tenant isolation probe with bleed detection armed on every neighbor's identifying tokens. The two results have to come from one run or neither means anything, because prefix caching is both what makes multi-tenant serving affordable and the exact mechanism by which one identity could leak into another.

What it found: presence holds through forty concurrent streams; past sixty you buy queueing, not capacity; and seven of seven isolation probes came back empty. The instrument is in the repository and re-runs in an hour.