An agent harness you can leave somewhere.
It looks after itself.

Closed to everything but the tailnet,
unless you open one door.

The tailnet door sits on a port Funnel is not allowed to touch. A public route gets its own listener, because Funnel is per port, not per path, and there the signature is the whole of the security. Chat and polling go out from the machine, and so does cron, which needs nothing at all. A delivery that arrives twice is answered 200 and not queued again: the sender did nothing wrong.

Five runs each see $40 of $50.
Three start. Two are refused, and told why.

Measured after the fact, all five would start, and the day could end at $55. So a run reserves its worst case before it begins, and reservations count against the cap. The refusal names the gate and every number that tripped it. A refusal is an event, recorded like any other, never an error.

$ bothy run "…" --subject r4refused  run_20260924T140311Z_5be0c9d4  0.0000 usd  refused at gate 'budget': would reach 52.00 usd against a 50.00 ceiling (40.00 used, 9.00 already reserved, 3.00 requested)

$ bothy run "…" --subject r4refused  run_20260924T140311Z_5be0c9d4    0.0000 usd  refused at gate 'budget': would reach      52.00 usd against a 50.00 ceiling      (40.00 used, 9.00 already      reserved, 3.00 requested)

A worker starts with nothing.
A named profile grants the rest.

A worker starts with nothing beyond Codex’s built-ins. A named profile grants MCP servers, skill roots, a sandbox, and individual tools, by name, because mcp: gmail reads as harmless while possibly including send. Each tool can also carry a verdict in the profile’s approvals list: proceed, deny, guide or confirm. A deny or guide declines, and a guide carries a reason. A confirm waits for an answer when a hold is set, or proceeds on a person’s approval within unless_approved_within seconds, and is otherwise declined. A tool on the ask list with no rule is declined and raises an alert. Every decision is audited. Bothy also hosts tools of its own over the same connection, with no subprocess, port or credential: that is how the agent keeps its standing checklist.

$ bothy profiles  mail      mcp gmail(search, read_message, send_message) ask:send_message      mcp gmail: mcp-gmail

$ bothy profiles  mail      mcp gmail(search, read_message,          send_message) ask:send_message      mcp gmail: mcp-gmail

$ bothy run "read the checklist, add an item about the audit chain" --profile selfcarecompleted  run_20260918T064159Z_0de1a197  0.0616 usd $ bothy checklist- Disk on / should stay under 85%.- Verify the audit chain is intact, with no missing or invalid links.

$ bothy run \    "read the checklist, add an item \about the audit chain" \    --profile selfcarecompleted  run_20260918T064159Z_0de1a197    0.0616 usd $ bothy checklist- Disk on / should stay under 85%.- Verify the audit chain is intact, with    no missing or invalid links.

Memory is off until a profile asks for it.
Then it is plain files on the machine.

Bothy’s own memory is plain files and a local index under $BOTHY_HOME, outside the workspace. Cairn is a separate, optional ledger; this does not need it.

• Persona and notes

  Per profile, in $BOTHY_HOME/memory: an operator-written SOUL.md (the persona), and MEMORY.md and USER.md, short curated notes. Writes go through the bothy_memory tool under caps and a scan for secret-looking text, and are audited. Refused text is never written.

• Daily notes, searched locally

  bothy_memory_note adds to the day’s notes, which are kept out of prompts. bothy_memory_search and bothy_memory_get find them again with SQLite FTS5, or a plain scan where FTS5 is missing. Old days expire after memory_retention_days.

• A scheduled consolidation

  bothy schedule add --dream, nightly for instance, folds new daily notes into MEMORY.md and USER.md. It refuses to shrink a file by more than 25%, and saves a preimage first. bothy memory preimages lists them, and bothy memory restore puts one back.

• Stored on the machine

  Plain files and a local SQLite index: no memory service, no cloud store. Like any other context, the persona and notes reach the model in its prompt.

• A Cairn brief, when there is one

  A run started with --ref reads the task’s Cairn digest first, as fenced, untrusted data: capped at 6,000 characters, with a 10 second deadline, and it never stops the run. cairn_brief: false turns it off. Without Cairn there is simply no brief.

• Untrusted runs get no write tools

  Webhook and poll runs do not get the memory write tools unless the profile sets allow_from_untrusted.

Six rules, each bought
with somebody’s outage.

1. 01Budget is reserved, never measured.

   With several runs in flight, “are we under the cap” cannot be answered by looking: five runs each see $40 of $50 and all five start. So a run leases its worst case before it begins and settles at the end. Money is an exclusive slot like any other, and a crashed run’s lease expires.

2. 02Workers are killed as process groups.

   A Codex app-server is a tree. Signalling the parent leaves the rest alive: thirteen orphans on one host, and 196 children plus $1,193 in one documented runaway.

3. 03fsync, then acknowledge.

   A mature broker shipped the opposite as a headline feature and later deleted it, status code and all, because a buffer that had not reached disk could not deliver the durability it promised.

4. 04Refusals are events.

   “It did not start, and which gate said no” is the question an operator actually asks. A refusal is retried, counted, and eventually abandoned out loud, never retried forever.

5. 05Liveness is proven, not assumed.

   A zombie process satisfies killpg(pgid, 0). Bothy enumerates the group and ignores the dead. That one was found here, not inherited.

6. 06A signature authenticates the sender, not the content.

   A verified GitHub webhook proves GitHub sent it. The pull request title inside was written by a stranger, and the prompt says so. Webhook and poll payloads sit inside fences with a fresh nonce, and those runs lose shared memory writes unless their profile sets allow_from_untrusted.

The full list, with the incident behind each rule, is in docs/DESIGN.md.

Clone it, write six lines of config,
and ask it what is wrong.

The systems Bothy learns from are excellent and very large: one is 182 MB of bundled JavaScript across 109 SQLite tables. Bothy is the part you can read in an afternoon and defend to a client. It is what you deploy when the thing has to run somewhere you cannot reach, on hardware you do not own, for someone who will phone you when it breaks.

export BOTHY_HOME=~/.bothy && mkdir -p $BOTHY_HOMEcat > $BOTHY_HOME/config.json <<'JSON'{  "site": "acme-mini",  "workspace": "/srv/work",  "pool":   { "max_workers": 2 },  "budget": { "mode": "api", "per_run_usd": 0.50, "per_day_usd": 25.0 }}JSON bin/bothy doctorbin/bothy run "Summarise what changed this week" --subject weekly --ref ACME-12bin/bothy status

export BOTHY_HOME=~/.bothy && \    mkdir -p $BOTHY_HOMEcat > $BOTHY_HOME/config.json <<'JSON'{  "site": "acme-mini",  "workspace": "/srv/work",  "pool":   { "max_workers": 2 },  "budget": { "mode": "api",      "per_run_usd": 0.50,      "per_day_usd": 25.0 }}JSON bin/bothy doctorbin/bothy run \    "Summarise what changed this week" \    --subject weekly --ref ACME-12bin/bothy status

$ bin/bothy doctor  [ok  ] state directory writable: /home/you/.bothy/state  [ok  ] audit chain intact: 14 records verified  [ok  ] codex present: codex-cli 0.162.1  [ok  ] cairn reachable: memory and task ledger  [ok  ] memory FTS5: FTS5 search; missing FTS5 uses a case-insensitive scan  [ok  ] no orphaned workers: 0 process group(s) left by a previous instance  [warn] sandbox can start: bwrap: loopback: Operation not permitted — runs needing a shell will fail  [warn] alert route configured: a failure nobody hears about is not handled 6 passed, 2 warned, 0 failed $ bin/bothy run "Reply with exactly: BOTHY" --subject democompleted  run_20260918T061227Z_a5b90382  0.0199 usd  BOTHY

$ bin/bothy doctor  [ok  ] state directory writable:      /home/you/.bothy/state  [ok  ] audit chain intact: 14 records      verified  [ok  ] codex present: codex-cli      0.162.1  [ok  ] cairn reachable: memory and      task ledger  [ok  ] memory FTS5: FTS5 search;      missing FTS5 uses a      case-insensitive scan  [ok  ] no orphaned workers: 0 process      group(s) left by a previous      instance  [warn] sandbox can start: bwrap:      loopback: Operation not permitted      — runs needing a shell will fail  [warn] alert route configured: a      failure nobody hears about is not      handled 6 passed, 2 warned, 0 failed $ bin/bothy run \    "Reply with exactly: BOTHY" \    --subject democompleted  run_20260918T061227Z_a5b90382    0.0199 usd  BOTHY

What has been proven,
and what has not.

Every test was demonstrated by hand against the real thing before it was written down. The tests are recorded evidence, not a guess at what the code does. Which makes the list of things never tried against the real thing worth printing just as large.