AI Crew on onelegdave.dev

I Made My AI Tools Ask Permission

OneLegDave — Sat, 26 Sep 2026 20:00:00 -0700

I pay for more AI coding tools than any reasonable person should, and for a couple of months I’ve been tinkering with one question: what if they worked together, and none of them could do anything I hadn’t agreed to?

Not “agreed to” in the sense of clicking Accept four hundred times until my finger goes numb. Agreed to in the sense that the operating system itself won’t let them do anything else.

That idea now has a name, a public repository, a website, and as of tonight a first release candidate. It’s called GovernCode. It’s free, it’s open source, and it will stay that way.

One boss, a few contractors, and a building inspector

GovernCode lets you pick one AI tool to lead a project. That’s the Controller. It keeps the big picture and hands small, bounded jobs to the others, the Runners, the way a contractor hands a room to a subcontractor. Each job gets written down first: what to do, which files it may touch, how much of my usage it may burn, and what “done” means.

Every one of them runs inside a sandbox that Linux enforces. Not a polite instruction in the prompt asking the AI to behave. The kernel’s own locks (Landlock and seccomp, if you want the names) decide which folders it can read, which it can write, and where on the network it can go. If my machine can’t enforce those rules, GovernCode refuses to start any AI tool at all and tells me why. There is no “just this once” switch, on purpose, because I know myself.

When a tool wants to run something that matters, it stops and shows me exactly what will run, byte for byte. Not a friendly summary. The actual command.

The part where I nearly gave up on my own demo

The first time I tried to show it off, I spent more time clicking Allow than watching the AI work. Every npm test, every file edit, every harmless ls. It was secure the way a locked filing cabinet at the bottom of a lake is secure.

So now I can say yes once, yes for the rest of this job, or yes for this project, and the plain read-only stuff just runs. The sandbox doesn’t move an inch when I do that. It only stops asking me the same question forty times. Deleting things, git, the network, and handing work to another AI still ask every single time.

I let the AIs audit the AI babysitter

Before putting a release candidate out, I had other AI tools try to break it. They found real holes. A tool could start a background process, “finish”, and leave that process running. A cleverly placed shortcut in a folder could have widened what a later job was allowed to write. A carefully worded command could sneak past the “this is just a harmless read” check.

All of that is fixed, each fix has a test, and the sandbox now proves its rules on your machine every time it starts, including against those exact tricks. I’d rather find out from a robot at my desk than from someone’s bug report.

Local models, because quota is money

Small jobs can go to a model running on my own graphics card. It gets no tools and can’t run anything. It reads the files it’s given and proposes changes, GovernCode checks every file it wants to touch, and I review it like anyone else’s work. The first real one wrote a usage section for a README in six seconds and cost exactly zero of my subscription.

The rule I care about most

GovernCode makes building software with AI a lot more approachable. It does not make anyone less responsible for what they ship. If I accept a change, it’s mine. I read the diff, I understand the code, I run the tests. The AI can write it. Only I can answer for it.

That’s written into the project’s philosophy as rule number two, right after “you hold the controls”, and it’s staying there.

Where it stands

It’s a release candidate for Linux, for people who like poking at things from a terminal. macOS and Windows are next, together, same priority, because I’m not making either one wait for the other. I’m dual-booting my laptop with Windows tonight so I can actually test it there.

None of this would exist if Omarchy hadn’t made my computer fun again and dragged a passion I’ve had forever back out of the drawer where time had shoved it. So: thank you, DHH, and everyone behind Omarchy.

GovernCode is at governcode.com. It’s free forever. If it saves you an afternoon, there’s a coffee button. My AI crew runs on tokens. I run on coffee. Only one of us has a button.

Something That Really Looks Awesome

OneLegDave — Fri, 18 Sep 2026 21:33:00 -0700

At about five in the afternoon I typed this into the terminal cockpit I’d finished the night before: “what is the possibility of having this as a GUI? something that really looks awesome!”

That’s the whole brief. No spec, no sketch, one vague sentence with an exclamation mark on it. By half past nine it had a name, a logo, four animated characters, a launcher with an icon, a laptop layout, two native Mac apps and a private network to run on. This is the version of vibe coding people keep promising: describe the thing, get the thing. It really can be like that. It was, for most of the evening. The rest of the evening I spent telling it I couldn’t see anything.

Hearth lasted two minutes

The first mockup came back in about five minutes. Then it went through seven versions in half an hour, because every time I looked at it I wanted something else. Keep the delegation feed but let it collapse. Let the terminal pop out or get taller. Give me a switch for the multiplexer that runs the agents. A project selector, and a way to make a new one. A button at the top that flashes when something needs me. Zoom for the text, per pane, independently. Each one turned up in the next version with the controls actually working in the mockup, which is a dangerous thing to show a man who was only asking hypothetically.

Claude named it Hearth. The reasoning was sound: the team is Anvil and Flint, the whole thing is forge-themed, and the hearth is where everyone gathers. I said “let’s see Crucible.” Crucible it is. A crucible is the pot the metal actually melts in, which felt like a more honest description of what happens to my quota.

Before a line of real code, one rule went into the plan as rule one: closing Crucible never stops the multiplexer. The multiplexer is what holds every agent session. Crucible is a window onto it, nothing more. There is a switch in the header, that switch is the only thing allowed to stop it, and it asks first. Because stopping it kills every pane, including the one Claude was building Crucible from.

Which is why the one thing in the plan that never got tested live is the off switch. The test would kill the tester. There’s a unit test for the guard. I have decided to believe the unit test.

I don’t see it

The build ran in phases, and each one landed in the window on my desk while I watched: a little server feeding the page, real terminals in the browser, the alarm, the selectors, the art, the packaging. Six phases in an hour and a half, all of them committed and pushed, and my contribution to each was roughly the same four words.

“I don’t see it.”

Twice the answer was that my window was still running the old page. The server serves new files the instant they exist, but a browser tab only fetches them when it reloads, so the tabs I was clicking were the inert ones from two phases ago and the project selector was the disabled placeholder. The fix was to make the page reload itself whenever the build changes, and it did, and the very next time I couldn’t see anything it was because I’d closed the window entirely and was staring at a terminal. Claude relaunched it for me, straight into the scratchpad next to that terminal at half width, where the layout stacks and the crew column falls off the bottom of the page. So the characters were there. They were just below the floor.

At no point in any of this was anything wrong with the software. Every single one was the man looking at it.

Keystone needs you

While Grok was off drawing, my desktop started pinging. A notification, a sound, a red button in the header: Keystone needs you. I went to the main pane. Nothing. No question, no prompt, nobody needed anything. It did it again. “I’m getting alerts from you but I can’t see any questions?”

The alarm was working perfectly. It was just listening to the wrong person. Grok’s command line tool runs the same hook configuration Claude Code does, and I’d wired those hooks to post to Crucible’s alarm endpoint. So every time Grok approved one of its own file writes, which it does automatically because that’s what it’s allowed to do, it announced that the lead needed a human. The server assumed any hook it heard came from the lead. It never occurred to me, or to the thing that wrote it, that the cat would be wearing the same collar. It now checks which agent a hook came from and ignores the ones that aren’t Claude, since the multiplexer already reports a teammate as blocked when it genuinely is.

The art run itself went the other way. Grok delivered every character and logo, and I was reviewing them in a browser before the delegate wrapper, the supervisor I wrote and complained about in the last post, gave up on the run at its 25 minute ceiling and logged it as a timeout. Last night nobody was finished when they said they were. Tonight one of them finished and the babysitter said it hadn’t. I’m not sure that’s progress but it is at least variety.

I picked a sitting cat for Flint, asked for more movement, and now the crew animate while they work and hold up a hand when they’re blocked. I would have accepted a static PNG.

The lodger

Packaging had its own small fights. The launcher hung on the first attempt because the browser-launch helper blocks until the window closes, so a script waiting for it to return waits forever. Then the window insisted on opening in the scratchpad, and the launcher had to learn to find it, move it to a real workspace and focus it.

The server now starts at login and stays resident, the window opens on demand, and when Crucible starts Claude in a folder that already has a conversation it picks that conversation back up. So I can close the whole thing, reboot, click the icon in the launcher and be exactly where I was. I quit for the night at seven, pleased.

At eight I came back. The multiplexer’s own sidebar, a list of spaces and agents that Crucible already draws far more prettily in its own columns, was sitting in the main pane like a lodger. I’d hidden it by hand before the reboot. The multiplexer has a setting to start it collapsed, but that setting only takes effect when its server starts, and rule one says I never restart that.

So the Crucible server now watches the main pane, waits until it sees the sidebar drawn, and types the keyboard shortcut to hide it. Then it checks the repaint so it never toggles twice. It presses the button for me. I’m not proud of it. It works.

The wrong direction first

“Can we install this on the laptop, and have this work via ssh?”

Not ten minutes later there was a second window with the laptop’s name in its header and a shell on the laptop answering. Crucible was running on the laptop, tunnelled back to the desktop. Which is when I explained what I’d actually meant: the desktop is the workhorse, the laptop is where I sit. Other direction. Same mechanism, reversed, and the laptop already reached the desktop over Tailscale’s SSH without a password, so no keys to sort out. Verified from the laptop’s own screen two minutes later, this very conversation in the main pane.

The laptop’s screen is smaller, and the page had been laid out for the big monitor. A screenshot, three fixes, a compact layout that collapses the header to one row and narrows the side columns, and the main terminal gained roughly forty percent more height. Then the laptop got the same AI setup as the desktop, Headroom in its bar and all, and I signed into the four accounts. Three of the four verified straight away. Antigravity reported not signed in after I’d just signed in, because checking it over SSH makes it look in a different credential store than the one I’d just written to. Checked the way Crucible actually launches it, it was fine. That’s two nights running this tool has been reported logged out, and this time it wasn’t even its fault.

The crazy pitch

“Okay, now the crazy pitch, can we get native apps for Crucible and Headroom on the Mac?”

Yes. Claude built them on the Mac over SSH with nothing but the command line tools, in Swift, in a few minutes including one type error. Crucible.app is a WebKit window onto the desktop’s server, with the page’s confirm dialogs turned into native sheets and copy and paste wired into the terminals. Headroom.app is a ring in the menu bar showing the fullest of my four weekly allowances, red at ninety percent, with a panel of meters and reset countdowns behind it. Screenshots over SSH aren’t permitted on a Mac, so the build could confirm a window existed and that the server saw its connections. Whether it looked any good was my job. It did.

Both apps were running over SSH tunnels. Then I said “we should use tailscale,” and the tunnel code that had been written at twenty past eight was deleted at ten past nine. The desktop now publishes Crucible on the tailnet with Tailscale’s own certificate, while the server itself still only listens on the loopback address. Every request that arrives that way carries the caller’s Tailscale login, and the server refuses anyone but me. A forged login header was tried and refused. A foreign origin on a terminal socket was tried and refused. The laptop and the Mac reach it from a coffee shop the same way they reach it from the sofa, and nothing is open to the internet. One quirk: the first request to a freshly published machine can sit for over ten seconds while Tailscale issues the certificate. After that it’s instant.

Half past nine

Everything went to GitHub at 21:24. Twenty-nine commits in four and a half hours, from “something that really looks awesome” to a cockpit I can open from a laptop, a Mac, or a coffee shop. I didn’t write a line of it. I typed wishes and looked at the results, and when I couldn’t see the results, that was usually me too.

That’s the sometimes. The easy part was genuinely easy. Nothing about tonight required me to know Swift, or how a browser talks to a terminal, or what Tailscale does with a certificate. What it required was somebody in the chair who’d notice when the alarm was lying, when the supervisor was lying, and when the fault was the man looking at the screen. The code writes itself now. The noticing still doesn’t.

Not done: alarm notifications on the Mac, Headroom starting itself at login, and Codex’s review of the server code, which waits for its weekly quota to reset on Saturday. Former boss, back on the tools, hasn’t been allowed near a file since it hit the ceiling.

And the off switch. I have a cockpit with an animated cat in it, reachable from anywhere on earth, and an off switch I have never once pressed.

I Promoted the One I Was Going to Cancel

OneLegDave — Thu, 17 Sep 2026 20:00:00 -0700

A few days ago I wrote a post about how I only wanted two AI subscriptions, and how Claude was the one getting cancelled. Claude is now in charge of the other three.

I would like to say there was a dramatic reason for this. There wasn’t. Codex had been running the show, it was doing fine, and I moved the job across because I wanted to see what happened. That’s the entire justification. A promotion, a demotion, and a backup of the old config taken at quarter past eleven at night, because I have learned exactly one lesson in my life and it was about backups.

So the roster is four: Codex, Claude, Grok, and Google’s Antigravity. One of them plans and reviews. The other three get handed bounded jobs. And because saying “ask the Google one” out loud thirty times a day is its own special punishment, they have names now. Anvil is Codex. Keystone is Claude. Flint is Grok. Albatross, Alby for short, is agy.

The nicknames are for talking. Every log line, quota check and credit keeps the real provider name, because the one thing worse than four assistants is four assistants and no way to tell which one did the thing.

The rules are blunt. Each provider has a 90 percent ceiling on its weekly allowance, which leaves at least 10 percent for me, because these things are meant to be doing my work, not eating my quota so I can’t. Nobody quietly switches to paid billing to get around a limit. Every job I hand off needs a concrete result, the files it’s allowed to touch, acceptance criteria, and a budget check.

Then there’s the genuinely stupid part: one standing policy, 228 lines, mirrored into four separate instruction files, because each tool only reads its own. Miss one and you have a Head Developer that three of the four assistants have never heard of.

The gate, the launcher, the pane

There’s a quota gate that has to run before every delegated job and again afterwards. Delegated, in this house, means I handed the work to one of them instead of doing it myself. There’s a launcher that bounds the work, keeps the streamed partial output so a death mid-job isn’t a total blank, and classifies failures as timeout, empty success, or agent failure instead of trusting an exit code. Empty success is the fun one: it walked off claiming it was fine and produced nothing.

And in the small hours I wrote the one that runs a teammate in a pane of a terminal multiplexer, requires a stated task label and acceptance criteria, waits for a completion marker, and appends every run to an event log.

A completion marker is a word I tell them to print when the job is actually done. You can already see the hole in that plan. It assumes “done” is a thing the furniture will admit to.

Idle is not evidence

Asking the multiplexer whether an agent has finished is worth precisely fuck all.

Grok reported idle at 23 seconds into 35 seconds of work, with its command still running. agy reported idle at 7 seconds, which was impressive given its command hadn’t started yet.

agy also parks in idle between tool calls, and it echoes prompt text into its own visible thinking, so neither a status of idle nor a matching completion word is enough for it. A review got declared finished at 168 seconds while the pane still read “Running command…”. The wrapper then closed the pane and destroyed the work. The fix waits for the pane’s content to stop changing, with a longer settle time for agy.

The panes themselves had a second trick. Each kept pane leaves a split behind, and the next split is narrower. At three or more panes each one is about 6 columns wide. That is not a workspace. That is a breadstick. Every completion marker wraps across lines, and the match can never succeed. A correct 30 second task timed out at 306 seconds with its marker counted zero times.

The multiplexer also truncates a multi-line prompt echo to its first line, which made my original baseline, count the marker in the prompt and require more than that, impossible to satisfy.

So the supervisor I wrote would declare victory because the pane looked quiet, or because a wrapped word no longer matched itself, or because the prompt it was trying to count had already been chopped down to one line. Meanwhile the job was still running. Or hadn’t started. Or had been killed for being finished.

The stale quota that wasn’t

agy had a long-standing reputation in my setup for reporting stale usage numbers, so it kept getting held back from work. Can’t verify what’s left of the allowance, don’t spend it.

The bug was in my own quota gate. It threw away a snapshot it had just verified as fresh whenever its refresh step tripped over anything. The check was manufacturing the exact staleness it was complaining about. I benched a teammate for a crime the babysitter committed. That one’s fixed now, with a regression test so that particular piece of shit can’t sneak back in the same shape. The real refresh takes about a second and a half.

An exit code of 0 from a usage collector doesn’t mean it collected anything, either. One collector returns 0 without writing when another copy holds its lock. agy’s returns 0 for any record under 60 seconds old without republishing. Both are “working.” Neither tells you the thing you asked. The gate now judges the age of the record it gets back instead of the exit status.

Then I had Grok and Antigravity review the code that decides whether Grok and Antigravity are allowed to run, and they found two more. Grok found an unguarded error path that leaked a pseudo terminal handle every time the child process died at the wrong moment. A pseudo terminal is the fake terminal session the helper opens in order to run that child, and leak enough of them and it can never open another one. Antigravity found that a sixty second cache shortcut made a forced retry a no-op, so the one case where I really needed a fresh number was the case guaranteed not to get one. Ask again, get back the number you just rejected.

Tonight

Codex sits at 100 percent of its weekly allowance and is held out of the rota until that resets, which is a hell of a way for a former boss to spend its first week back on the tools. Flint is at four percent and cheerful. Alby spent a chunk of the evening held as well, and this time the tooling was right to hold it: the thing had quietly signed itself out of its own account, so there was no allowance to check at all. Fixing that needed a human, a browser and about thirty seconds, which is the most honest description of my job here that I’ve managed all week.

I set out to build an AI team. What I’ve actually built, so far, is a very thorough system for finding out that nobody is finished when they say they are.

I Only Wanted Two Subscriptions

OneLegDave — Fri, 11 Sep 2026 18:00:00 -0700

I have three paid AI subscriptions. I want two. OpenAI’s ChatGPT Pro stays, Google AI Pro stays, Claude goes. A small administrative decision which has somehow involved a server, a searchable archive, two Linux machines, a Mac, and a laptop insisting it has absolutely no idea who I am while I’m already logged into it.

I should probably stop describing things as small administrative decisions.

Claude has been useful. There’s a lot of work in those conversations: code, project decisions, explanations, failed attempts, and the eventual discovery of which stupid little thing was causing the problem. I want to save twenty bucks. I would also quite like to avoid spending the rest of my life explaining my own projects back to a succession of helpful strangers.

So before I cancel anything, I need to take the useful history with me.

Packing, apparently

The account export arrived as five ZIP files on the Mac. I copied them across and checked that they matched the originals using SHA-256 hashes, essentially digital fingerprints for the files. I also checked that the archives opened without errors. Everything passed.

After my previous adventure in deleting this website while carefully preserving my terminal colours, I’m trying to get better at checking what I’ve actually saved. The bar is low. I put it there myself.

The export contained 59 conversations, along with project documents, saved memories, and summaries. I also collected the separate Claude Code histories from my Linux machines. Those are the records from using Claude in the terminal, where much of the coding work happened. Some of that history overlaps with the account export, so I kept track of where it came from rather than pretending every saved message was a unique contribution to human knowledge.

The original files are preserved. Alongside them, I now have readable text versions and a searchable database, built with SQLite. That means I can look up a project or an old problem without opening dozens of conversations and trying to remember which one contained the useful bit.

There’s also a starting document pointing to the relevant topics and correcting things that have changed. The old summaries are labelled as historical material. An assistant confidently saying something was true six conversations ago doesn’t make it true now. It might not even have been true then.

This gives the next assistant somewhere to look before asking me to explain the whole fucking setup again. It still has to find the relevant history and check it against the current work. The old chats don’t magically appear in ChatGPT’s sidebar, and putting a ZIP file within reach of an AI does not mean it has read it.

A note saying I once had a document

The export also contained 180 references to files whose originals weren’t included.

References. Lovely.

Some attachment text survived, but text pulled out of a document doesn’t give me the original document back. A reference to an image is even less useful when what I need is the bloody image. The code repositories, manuscripts, and other original files still need their own preservation. A conversation about building something is a poor substitute for the thing I built.

The archive now lives on my server, with a working copy on my main Linux machine. I’ve checked the server copy against the originals and tested the search. It’s in a directory covered by my existing local and offsite backup jobs, although I still need to verify a completed backup and restore containing this new material.

I have already written one blog post about discovering what my backups didn’t contain. I’d prefer not to establish a series.

The archive is a snapshot of the history I’ve collected so far. It won’t quietly gather every future conversation by itself. My assistants have instructions pointing to it, but they need access to those files to use it. The apps on my phones haven’t suddenly acquired my entire project history either.

The other subscription

Google AI Pro was already paid for, so getting proper use out of it was the next job. For coding work, that meant installing Google’s Antigravity tool, launched with the command agy, on the Linux machines and the Mac. Gemini is on both phones too.

The second laptop needed a small networking repair before any of that: I had forgotten to reinstall Tailscale after reinstalling the operating system. Tailscale is what lets my machines reach each other securely when they’re elsewhere.

The laptop wasn’t on the network because I hadn’t installed the software that puts it on the network. A difficult bug to report without the entire report being about me.

With that fixed, I got its remaining history archived and signed into agy. A test in the laptop’s own terminal worked. The same basic test through SSH, the secure connection I use to run commands remotely, returned authentication required.

Of course it fucking did.

Logged in, depending on who’s asking

Linux keeps saved sign-in credentials in a protected store called a keyring. Mine was unlocked, and agy could use it from the desktop. The remote session still couldn’t sign in. Matching the desktop’s session settings didn’t fix it either.

What finally worked was letting agy use the existing desktop connection to that keyring while removing the environment markers that told the program it had been launched through SSH. The secure remote connection itself stayed intact. Only the information passed to the agy process changed.

I put that into a small launcher called agy-desktop, opened a fresh SSH connection, and tested again. It answered correctly, including following my project instructions. No copying passwords around, no disabling keyring protection, no surgery on the actual agy program.

It still needs the desktop keyring to be accessible and unlocked. I haven’t proved it will work unattended after a reboot. Two successful tests are useful evidence, but I’m not promoting them to a lifetime guarantee because I’d like this paragraph to end happily.

I now have searchable history on the server and a working way to use the Google subscription I’m keeping. There are still original files to account for before I call the preservation job finished, and I haven’t cancelled Claude yet.

I set out to save twenty bucks and built a searchable archive with remote access. Apparently the cancel button is the only part of this process I haven’t needed to troubleshoot.