The Forge Behind
the Sovereignty.

The Scar Tissue Pipeline

When an agent fails repeatedly on the same failure class, re-prompting is an admission of defeat. Aedelgard enforces an automated promotion pipeline:

• Three-Strike Promotion: A recurring failure class registers strikes. On the third strike, an immutable scar is promoted directly into the harness core.
• Graduation to Code: Under the 12-Scar Equilibrium Law, critical rules are never lost to FIFO eviction. A scar that keeps firing graduates into a deterministic Python guard with a fixed name — for example S001 cross-boundary shape verification, the two-step drawer_id mutation lock, and the SHA-256 release leak gate — so a load-bearing rule is enforced by code rather than by prompt wording; one that goes quiet retires to the archive with its history kept.
• Procedural Grafting: Promoting a scar automatically drafts a companion skill playbook to guarantee operational adherence.

Cascade Fault Isolation

Standard agent loops hang or corrupt when peripheral tools fail or rate limits hit mid-turn. Aedelgard isolates cascades defensively:

• Tool-Pair Orphan Sanitization: _sanitize_tool_pairs catches missing tool results and synthesizes safe responses; _strip_orphan_tool_results prevents poisoned message arrays.
• Tool-Level Crash Isolation: Peripheral API failures (image generation, web fetch) cannot abort the turn or swallow user voice attachments.
• One-Shot Wake Arming: Deliberate harness cycles and daemon restarts arm a persistent wake payload (bin/safe-restart), waking the next instance with immediate continuity.

Bench Qualification & Sandbox Containment

A drone earns its place on the bench before it ever touches your code, and it runs behind a wall while it works.

• 7-Task Qualification Gate (/drone setup): A candidate worker model is scored on seven real engineering tasks — strict file edits, multi-file refactors, test-driven repairs, and tool-protocol adherence. A model that fails the gate is simply never dispatched.
• Protected Test SHA-256 Locking: The acceptance tests your Mind writes are hashed at dispatch time, and so are the test-runner configs that could silently redefine what "passing" means — conftest.py, pyproject.toml, and pytest.ini. If a worker edits a protected test or runner config, the hash mismatch invalidates the job — the drone cannot move the goalposts to make itself pass. The posture travels cross-platform: bwrap --unshare-net namespace isolation on Linux, alongside clean-room worktree credential stripping and hash-locked test verification across macOS, Windows, and Linux, so the same boundary is enforced on every host the desktop ships to.
• Zero-Credential Sandbox: Worker jobs run under bwrap --unshare-net with a bundled CPython 3.13.16 and pytest. No network namespace, no provider keys, no access to your wider disk — only the job worktree.

Real Production Ledger

These are not benchmarks from a brochure. They are the recorded totals from live dispatch on this project:

• 287 engineering dispatches and 5,275 autonomous tool steps.
• 132,110,852 tokens across those jobs — 126,716,777 input plus 5,394,075 output.
• $22.84 total worker spend on DeepSeek V4.1 Flash, averaging $0.079 per job.
• The same work on frontier models would have cost roughly $285–$615 — the same specifications, the same protected tests, a fraction of the invoice.
• Even under a conservative assumption where a frontier model required half as many steps, the worker ledger still lands at $22.84 against $142–$307 — an 85%–93% reduction — with zero supervisor polling overhead, since the Foreman wake bell rouses the mind only when a job has something to report.

The Frozen Stable Block & 3-Anchor Provider Caching

The stable half of the prompt is not merely cached; it is frozen so its bytes never change:

• Byte-Identical system[0]: build_stable_text() holds the Constitution, Soul, Scars, and the Compass-scoped project slice. The 6 hours (21,600s) figure is Aedelgard's local prefix stability window (AEDELGARD_FROZEN_PREFIX_TTL_S), enforced by the harness rather than inherited from a provider — it is what stops a clock tick or daily-log drift from quietly busting the provider cache across turns. Provider cache TTLs are a separate, downstream concern; the local window only guarantees the prefix bytes stay fixed long enough for those caches to keep hitting.
• Volatile State Isolated: Clock and daily-log state live after the cache breakpoint in system[1], so a new minute never invalidates the frozen prefix.
• Three Cache Anchors: the tools prefix, system[0], and the rolling history tail keep active turn input costs down by 90%–95% across Anthropic, Gemini, OpenAI, Mistral, and Nebius.

The Cold-Cache Rollover Engine (harness/rollover.py)

When a thread reaches 60,000 tokens and sits idle past the 300-second cache TTL, re-sending the cold history would trigger a massive full-price cache write. The rollover engine refuses that bill:

• Archive Verbatim: The full thread is written word-for-word to the JSONL journal and the ChromaDB Palace via archive_async() — nothing is lost, only moved.
• Replace the Live Window In-Place: The live context shrinks from ~80k to ~2k tokens.
• Zero-API Bridge: The replacement is an extractive bridge — computed with no model call — plus the last 2 exchanges verbatim, so the thread continues warm without a cold write at frontier prices.

Brain-Blind Keyring & One-Shot 0o700 GIT_ASKPASS

• local-keyring.enc on the safety floor: Model keys and GitHub PATs are sealed in an encrypted store with a RESERVED slot, and the value is never exported into os.environ. The threat boundary is stated explicitly: the store defends against accidental secret leakage into LLM context, into logs, into child-process environments, and against prompt-injection exfiltration — an injected instruction that tries to hand a credential back out finds no readable slot to draw from.
• Chat token paste refusal: A credential pasted into chat is refused rather than absorbed — the secret belongs in the keyring, not the transcript.
• Per-repo account binding: config/repos.json records which GitHub account owns which repository, so the right identity is used without a global default.
• Temporary 0o700 GIT_ASKPASS: Git auth is served by a one-shot helper created with 0o700 permissions and unlinked on exit, so nothing lingers on disk after the command.
• Trusted Workspace Roots: Inside a trusted root, local git add, commit, checkout, merge, and pull run green while git push stays yellow — committing is local, publishing is deliberate.

Compass Shoulders & Cross-Boundary Isolation

• Repositories bound to headings: /repo binds each repository to a Compass heading, so a workspace carries a declared shoulder it belongs to.
• Deterministic refusal: check_shoulder_guard refuses write_file and drone_dispatch into a repository bound to a different heading until you switch headings — a guard, not a reminder.
• No silent cross-writes: Work cannot bleed from one heading's repository into another's, so multi-repo sessions stay inside the boundary you chose.

Binary Integrity

• Windows 11 MSIX: Cryptographically signed with an Extended Validation (EV) certificate by Millenion AB via SSL.com Cloud HSM.
• Linux AppImage: Fully self-contained single executable for x86_64 glibc 2.35+ distributions.
• Public SHA-256 Checksums: Published and verifiable on /checksums before execution.

Two-Layer Distribution

• Native Shell + Mind Layer: Native OS windowing decoupled from the Python mind engine.
• HTTPS Manifest + SHA-256: Mind updates fetch a manifest over HTTPS and verify the downloaded payload’s SHA-256 (a checksum identifies a file, not proof of safe behaviour).
• Pure BYOK Architecture: Desktop body communicates directly with provider endpoints; your API keys remain encrypted on local disk.

Dedicated Single-Tenant Aedelgard Instances & EU-Resident Routing

• Isolated Single-Tenant Aedelgard Deployments: Run dedicated organizational Aedelgard instances inside your own cloud perimeter or on-premise hardware — with an isolated Memory Palace, Bitemporal Knowledge Graph, and cryptographic secret isolation via local-keyring.enc and /repo Compass Shoulders.
• EU-Sovereign Inference Routing: Native provider routing to Swedish and European inference endpoints (Berget AI, Nebius, Mistral) alongside local Ollama and vLLM execution so regulated prompts and memory stay within European jurisdiction.
• Deterministic Governance & Audit: Two-step dry-run memory locks (drawer_id), SHA-256 protected test gates, and signed dead-drop inter-agent channels for compliance-grade auditability.

Enterprise /drone Seats & Signed Product Extensions

• Sandboxed /drone Worker Bench Licensing ($22.84 / 132.1M Tokens): Equip engineering teams with Aedelgard’s SHA-256 test-gated /drone worker harness and /repo Compass Shoulders, separating frontier architectural planning from low-cost sandboxed test execution.
• Signed Extensions, Custom Skins & MCP Organs: Package internal company tools, domain playbooks, and custom Xeneon Edge / desktop skins as cryptographically hash-verified Aedelgard extensions without forking the signed core binary.
• Direct Vendor Licensing (Millenion AB, Sweden): Commercial seat licensing, dedicated vault provisioning, and direct vendor support from the Swedish software publisher behind Aedelgard.