A model saying “budget approved” changes nothing. Only a validated, authorised action mutates state. That single rule is why this behaves like a company rather than a very confident chat window, and most of the design below follows from it.
Two separate columns: whether she is hired, and whether she is working right now. Idle employees cost nothing, so headcount is not the cost driver — wake-ups are. Nobody polls and nothing sends heartbeats; an employee wakes on a task assignment, a message needing an answer, a cleared blocker or a timer.
One run is one attempt. A provider call finishing is not the same event as a task being accepted, and collapsing the two is how systems end up reporting work as done because the API returned 200.
They live on a contract row with a version number. Bump the contract and every verification done against the old one stops counting — enforced in the database, not remembered by a person. “The founder changed their mind” becomes a first-class event instead of a silent corruption.
Never from the model. A planner that could name its own reviewer could name itself. Same for who hears about a blocker: an employee that gets stuck asks its manager, and cannot choose a friendlier audience.
One task, two passes. No artifact yet, so the owner implements. An artifact newer than the last review, so the reviewer verifies. An accepted review, so it completes. Creating a review task for every task would need its own review task and never terminate.
agi-cosSELECT … FOR UPDATE SKIP LOCKED, a lease to detect a dead worker, and a monotonic fence so a revived zombie cannot commit over its replacement.2 · ReserveBudget is held before dispatch, against every ceiling that applies — the employee’s, the project’s and the company’s. The tightest one stops the work.3 · WorkThe employee gets a worktree and several turns. It has no shell: it asks to read a file or run a command, and deterministic code decides. Refusals come back as answers, so it learns the boundary.4 · PinCommitting happens on the host, so a real SHA exists whether or not the agent made one. Unpinnable output is not evidence.5 · VerifyA different employee opens the repository at the commit under review — and is refused write access whatever its grants say. A reviewer that can edit what it is judging is not a reviewer.6 · IntegrateAn accepted review merges the branch into the project’s integration ref, so the next task builds on work that landed. Deterministic code merges, never a model. A conflict is recorded for a person, and does not fail the verified work.Two ways to reach a model, and they return different truths about what a task cost. The difference is carried through to the ledger rather than smoothed over.
Exact input, cached-input and output token counts, priced against a published rate card that records which reading produced it. A model with no published rate still runs — its usage is recorded as pending with the tokens kept, for somebody holding the invoice.
Drives Claude Code, Codex or the Gemini CLI headless. Consumption is quota: tokens are recorded, the amount stays empty, and no page adds it to money. There is no price table for a subscription, so plan capacity cannot acquire a currency figure even by accident.
A conversation has to change the company or it did not happen. A meeting ends with decisions, owners and dated tasks — or it records that it could not. A transcript alone is theatre.
Health is not a column anywhere. It is derived from the last check that actually ran, and reads unknown until one has. A status field could be written by anybody and would then be indistinguishable from a measurement.
An agent drafts a client reply; a person approves it. The SLA clock stops when the client actually has it, not when somebody typed it. A support agent cannot send, cannot resolve, and cannot promise a date, a scope or a price.