01
Identity
Every input and output is stamped by the gateway, not self-reported by the process producing it.
actor = human | agent | system
Software Engineer / Forward Deployed AI
Give the agent a question. Keep the authority bounded.
A public-safe interview agent running inside a real Pillbox session. Every input, evidence read, model answer, and token is attributed. The session gets three turns, five minutes, and no shell, network, or write access.
pillbox / §0 · attributed session stream
not started
Start a five-minute interview session.
A per-visitor Durable Object will bind the actor, scopes, budget, ordered event log, and expiration before the first model token is spent.
The interface is the argument
An agent should arrive with controls, not apologies.
The same primitives show up across Pillbox, the Phantom agent, and a live trading system: identity before action, narrow authority, durable receipts, and a lifecycle a human can end.
02
Scope
The model can read the public-safe corpus. Shell, arbitrary network access, and writes do not exist.
allow(profile:read)
03
Attribution
A monotonic sequence turns the interaction into an inspectable session rather than an ungrounded chat transcript.
subscribe --from SEQ
04
Lifecycle
Three turns, a fixed token budget, automatic expiration, and a revoke button bound at session creation.
expires_at = now + 300s
Live architecture
Reasoning and authority stay on different sides of the seam.
The browser never receives a model credential. The Durable Object owns identity, ordered events, limits, and revocation; Workers AI supplies the bounded reasoning step.
Browser / human driver
One ephemeral actor
Starts the session, submits natural-language questions, follows the event cursor, and may revoke at any time.
- token kept out of the URL
- fresh identity per session
- 600-character input cap
Pillbox §0 / Durable Object
The authority boundary
Assigns sequence numbers, stamps actors, retrieves evidence, meters the run, expires the identity, and preserves the receipt.
- SQLite event log
- single-session budget
- explicit revoke path
Workers AI / bounded reasoner
No ambient authority
Receives only the question and selected public-safe evidence. It cannot reach a shell, browse the network, or mutate state.
- held to supplied evidence
- 360-token answer cap
- fails without widening scope
Inspectable proof
The resume is the index. These are the systems.
Three implementations of the same underlying instinct: let an agent act, but make identity, authority, recovery, and evidence part of the architecture.
Pillbox
A local-first agent sandbox with credentials the agent can use but never sees, microVM isolation, and typed session streams that late-join from any sequence.
github.com/vu1n/pillbox ↗Hyperstitch
A non-custodial trading system whose 14-state execution saga recovers from crashes while a default-deny signer makes moving user funds impossible by construction.
rubick.fi ↗brief
Architectural decisions as governance: 4/4 reversals under editable-truth framing, then 0/8 when the coding loop had to file an amendment instead.
github.com/vu1n/brief ↗Agent infrastructure is the recent work. Shipping across boundaries is the through-line.
Phantom, MetaMask, Squarespace, Meta, and a run of public systems spanning agent runtimes, data platforms, and durable execution.