One operator runs this stack, and it carries three jobs: it turns AI output into content a business will sign its name to, it runs automation nobody watches, and it keeps working when a vendor goes dark. Sovereignty is the constraint every choice below answers to. That is why the test is not whether a tool is good, but whether a dependency survives its vendor going offline; the cutoff-survival article applies that test to each one. This page shows the system as a whole, and each part links to the article that tells it in full.
TL;DR
Two agent runtimes kept apart, two further profiles outside both teams, and rules that hold the whole thing in production. The content team runs cloud-only, local inference is reserved for privacy-sensitive work, guards sit at the boundary rather than in the agent, and one human gate stands on every deployment.
The teams and their roles
The stack runs two agent teams on two runtimes, and I keep them apart on purpose. The engineering side is three profiles on Claude Code, each with its own working directory on my laptop. The trio splits a job the way an engineering team does, and separating spec, build, and quality assurance is what keeps one profile from grading its own work.
The content side is one orchestrator over six workers, all on Hermes Agent. Each worker is defined by what it may touch and how it reasons, never by subject matter: a miner, an interviewer, a narrator, a strategist, an auditor, and a curator. The auditor’s seat exists because the review pass, not the first draft, is what makes AI-written copy publishable. The team works in rounds rather than days. One measured round cost $1.066 across 376 API calls and 53 minutes, and the accounting behind that figure is its own article.
Two profiles sit outside both teams. Makoto is a standalone advisor that belongs to no team: it plays several roles on command, never pushes to a repository, and never edits a production file. It also produces the site-level copy that frames both of my sites and hands it over for me to place. Izuna works on the server, on diagnosis and log review, and is not authorized to run setup commands. Deployment stays with me.
My AI agent stack at a glance
The AI Engineering Team
Runtime: Claude Code; Host: MacBook; Model tier: Claude (Claude.ai Pro)
| Agent | Role | Attributes |
|---|---|---|
| Ren | Senior Tech Advisor | Specs, architecture, audits |
| Takumi | Senior Developer | Only builder in the team |
| Tomoe | Senior Tech Documentalist | In charge of the main tech vault |
The Content Factory Team
Runtime: Hermes Agent; Host: MacBook; Model tier: cloud
| Agent | Role | Attributes |
|---|---|---|
| Tsukasa | Orchestrator | Opens and routes rounds on the Kanban board |
| Tansa | Investigator | Evidence mining, external evidence records |
| Katari | Copy-Writer | The article’s one writer |
| Saku | Chief-Editor | Sets the standard, lists the fixes |
| Aratame | Proof-Reader | Report only, the independent claim gate |
| Kura | Linker | Duplication check, internal netlinking, vault structure |
| Kiku | Interviewer | The operator’s answers, over Matrix DM |
The standalone agents
Runtime: Hermes Agent; Host: MacBook; Model tier: mainly cloud
| Agent | Role | Role |
|---|---|---|
| Izuna | SysAdmin Assistant | The sole Hermes Agent on the VPS (using Sovereign cloud) |
| Makoto | Senior versatile advisor | Plays multiple roles on command (using cloud or local ollama) |
The design choices, and why I made each one
Two runtimes, kept apart. The engineering trio sits on Claude Code, the rest on Hermes Agent, and Claude Code carries those three and no other profile in the stack. What stays on the machine and what needs the cloud is the fuller version of that split.
The content team is cloud-only. It has never run on local inference, because my laptop cannot carry its workload. The same model chain is pinned across its seven profiles, and keeping the model’s output deterministic is a discipline of its own.
Local inference is reserved for privacy-sensitive work. Makoto is the only profile that reaches it, on an in-session switch, and that is where the sensitive material goes.
Guards sit at the boundary, not in the agent. I do not ask a model to police itself. Deterministic guards stop a hallucination before it reaches a reader, and they run outside the model rather than inside its instructions.
One human gate on deployment. I am the sole operator on the server, and every deployment and migration passes through me, never an outsider.
What broke, and what changed
A host file reached the messaging gateway. The gateway uploaded any host file whose path appeared in a reply, so a document that should never have left the machine did; I saw it live. Strict mode with an explicit allow-list on every profile closed that door. The private messaging island is where the channel itself is told.
The same episode exposed a second door. The container around the team’s file and shell access was never the whole boundary, and two host-side doors stayed open around it, so the allow-list had to do what the box could not. The box still earns its place: it runs those tools in a network-less container that sees only two mounts, while everything that is neither a file nor a shell stays in the process on the host. The command line is rationed the same way, to the auditor and the curator, on measured search load.
Who runs it
This is one person’s stack. I am its sole operator: I built each part, I run every deployment myself, and I hold the human gate the rest of the system waits on. Who I am, and the work this comes from, is on the career site.
Start from your own stack
The pattern is small enough to copy: two runtimes kept apart, an advisor outside both teams, guards at the boundary, and a human gate that never leaves. If this is the shape of your problem, let’s talk.