One Person, Three Agents, One System

Context

The setup is one person with a full-time day job and three AI agents that are genuinely different tools with different economics:

• Claude does diagnosis, architecture and review — metered by a subscription usage window, so its time is the budget that runs out first.
• Devin does self-contained build work from written directives. Its runs do not consume Claude usage; each run gets its own git worktree and branch and runs non-interactive under an explicit command allow-list.
• A local assistant (Tobor, on OpenClaw with free models) relays on Telegram. It is being narrowed to proven jobs only after it failed at breadth.

And it is two machines, not one: a personal laptop and a work desktop — “the Tower” — coordinating through the same git remote. The work install also runs a live call-center dialer, which is a protected repo no agent may touch.

The problem it solves

A person with a day job cannot babysit agents. Without structure the choice is between agents that idle waiting for him and agents that run unwatched — and unwatched automation needs proof, not trust. Status cannot live in the owner’s head, and an agent that cannot ask a question mid-run cannot be allowed to guess.

The design goal was an unattended loop that reviews finished work and dispatches pre-authorised work while nobody is watching — with the human still holding the only keys that matter.

What I built

The directives are markdown files that live in each repo. Each carries a queue block, and the queue derives every status by reading the files themselves — already version-controlled, already the thing the human edits. There is no second database to drift out of sync.

The human gate is the design, not a setting. Only the human approves dispatches (with delegated exceptions he granted), merges to main (under a standing “safe merge” rule for verified, non-visual work) and marks work Done.

Deterministic checks run before any model review. A review pre-check runs code checks — commits exist, tests pass, no deleted or skipped tests — before any model is asked to look at the work.

Each agent works inside its economics. Per-agent budgets pause Claude-driven work before the usage window runs out, instead of discovering the limit mid-task.

A pulse runs the loop at levels. Liveness every 2 minutes, flow at 3–5, attention at 10, the full pass at 30.

Two machines cannot start the same work. Install routing scopes a directive to one machine, and a claim is checked against the remote. In-progress branches are pushed automatically, so a machine going dark loses no work — the other can take over the branch.

One codebase, installed per machine. Each install’s agentflow.toml decides its accounts, approvers, protected repos and how it notifies — nothing machine-specific lives in the code. On the Tower, the live dialer repo is simply protected.

What it caught

The failures are the reason the guardrails look the way they do.

Many early Devin runs died at their first command that needed a confirmation — non-interactive mode refuses prompts outright. The fix was per-directive “Rules for this run” sections plus command allow-lists, and reading the refused command from Devin’s session log instead of guessing why the run stopped.

On 2026-09-22 a repository’s pre-push test suite, run from an agent’s worktree, inherited git’s hook environment and committed its test fixtures into the real repository — one of them deleting every file. It reached GitHub main through a merge that skipped the hook. Main was restored the same night with a forward commit, no history rewrite, and a directive then made every git-using test run in an isolated environment. The lesson recorded in the project: list a branch’s commits again immediately before any push or merge.

Result

53 pull requests merged by 2026-09-22, four days after the first commit. The test suite stands at 1,356 passed, 0 failed, 0 skipped. Work on RFD_YT_Engine is dispatched through this queue as directives and verified before merge.

The transferable part is not the agent count. It is that a loop you cannot audit is a loop you cannot leave running — the difference between a demo and a system is whether a silent failure looks different from success.

Tech notes

Python. The packages are queue (the directive queue and MCP server), devin (headless Devin supervision), loop (the unattended tick and the agentflow command), board, budget, chat, slack and web. Repo: rfd62794/AgentFlow.