The Agentic Brain: shared knowledge without shared control.
A private, Git-backed operating knowledge system that lets people and multiple AI agents capture, verify, organize, and reuse source-backed knowledge — without giving every contributor unrestricted write access. Intake is easy. Authority is earned.
More agents create more knowledge risk.
Chat context disappears. Agents can disagree — or confidently repeat stale information. Useful sources get hard to retrieve. And the moment several agents can write to the same knowledge base, unrestricted writes can corrupt authority or expose secrets.
This was never a note-taking problem. A multi-agent operation needs governed memory: provenance on every claim, bounded authority for every contributor, and different permissions for research, operations, claims, and publication — the same separation a client would demand before letting an AI workforce anywhere near their business.
One governed loop, from capture to canonical.
A private Git repository is the canonical hub in a review/write loop — not a backup at the end of a pipeline. Everything enters through a guarded bridge, is reviewed read-only, and only a bounded writer or a human puts change back.
Protected core, authority, client & public claims, publication, production, destructive actions, credentials, spend.
Each AI surface is accepted individually and may only add new, secret-free Tier 1 records.
Provenance, sensitivity, and confidentiality checks. No overwrites, no Git.
Conflicts stop for review — never auto-resolved.
The one canonical committed state — versioned, inspectable, durable.
Batch review, independent challenge where required, conditional arbitration. None of the three can edit, commit, or promote their own work.
Applies accepted, bounded, secret-free routine changes only — inside its delegated lane.
Agents pull knowledge; deliberate promotion registers immutable Raw sources compiled into the Wiki; the read-only Graphify sidecar answers source-cited relationship queries.
Capture flows one way: approved surfaces submit into a tier-1 additions-only lane; a guarded bridge secret-scans and commits to private Git main; read-only stewards review changed batches; one bounded writer returns accepted routine changes. From accepted state, knowledge is deliberately promoted into an immutable Raw layer and compiled into the LLM Wiki — with a read-only graph sidecar for relationship queries. The roles run on dedicated local machines — orchestration, knowledge operations, and local inference — with a guarded laptop bridge as the human interface.
Substrate
Agents & review
Sidecars & queues
Easy to capture. Harder to promote.
Every record carries two independent labels: a governance tier that says how much an agent may rely on it, and a content state that says where it is in its life. Neither is a conveyor belt.
How much authority a record carries — and what it takes to move up.
New notes, imports, sources, and potentially useful context. Cheap to add, trusted for nothing yet.
Attributed viewpoints, examples, and bounded research — with their limitations preserved, not flattened.
Methods and standards agents may rely on — only after source mapping, contradiction review, independent checking, and validation.
Governance, security, agent authority, client and public claims, production, publication, spend, and destructive work. Human decisions live here.
A branching state set — not a mandatory pipeline. A tier-2 reference can remain a durable endpoint forever.
Drafts and proposals are promoted when accepted — never automatically. Corrections enter as new linked records, not silent rewrites, so history stays auditable.
Governance rules, ownership maps, root indexes, and security controls cannot be rewritten by routine reviewer agents — under any tier, in any state.
Information can be easy to capture without being easy to promote. Every record has both a lifecycle state and a governance tier, so usefulness can compound while authority is earned.
Operating principle · The Agentic BrainThree reviewers. One bounded writer.
Review is separated from writing. Three read-only steward profiles examine changed batches on a dedicated knowledge-operations machine — none of them can edit, commit, push, use credentials, or promote their own work.
Steward A — Inventory & retrieval
Owns structure and findability: inventory, changed-batch review, indexes, and retrieval health across the vault.
Steward B — Independent challenge
A second, independent pass on tier-2 batches and tier-1 samples or risk flags: provenance, duplication, contradiction, naming, organization, and content-state boundaries.
The Arbiter — Comparison & escalation
Invoked on disagreement, material contradiction or authority risk, or proposed tier-3/4 promotion. Validates evidence against the exact repository state, then returns: no action, a proposal, revision required, or escalation.
Canonical Hermes
A separate routine maintainer that may apply an accepted, bounded, secret-free change — and nothing else. It works only inside its delegated lane; higher-risk work stops for a human.
Protected core, agent authority, strategy, client and public claims, publication, production, destructive action, credentials, and spend all stop for human approval. Not one of those effects ships on an agent’s say-so.
People, agents, and evidence — one controlled lane.
The intake lane is provider-neutral and additions-only. An approved Claude, ChatGPT/Codex, Grok, Buzz, or future model surface must pass acceptance as that exact app, profile, or agent — then it may contribute.
The lane cannot overwrite existing knowledge, run Git, promote its own work, change governance, or publish. Guarded automation performs the synchronization; important submissions get repository readback to confirm what actually landed. Corrections arrive as new linked records — never silent rewrites.
That is the client-applicable point: many contributors can feed one governed system without receiving the same authority.
A compiled Wiki, a graph sidecar, a research queue.
Three connected but distinct capabilities sit on top of accepted knowledge — each with its own boundary.
The LLM Wiki
Compiled · GovernedGeneral intake never becomes Wiki authority on its own. When a sanitized source deserves durable preservation, it is deliberately promoted into an immutable Raw layer — hashed and registered — then compiled into linked source notes, entities, concepts, syntheses, and open questions. Validation preserves provenance, contradictions, and source history.
This is not ordinary retrieval-augmented generation, and the source-to-Wiki compiler is not fully unattended — promotion is a decision, not a default.
Graphify
Read-only sidecarA separate relationship graph built from a committed, sanitized snapshot of the vault. It answers source-cited search, neighborhood, and path queries; if a refresh fails, it preserves the last healthy graph. It cannot write back to the vault — and inferred relationships are treated as leads to verify against their cited sources, not as facts.
Slack research intake
Controller pausedSlack is the research queue — not the knowledge base. The piloted workflow takes a shared source through an idempotent queue record, full source and cross-source verification, sanitized research artifacts, and a completeness review before anything reaches a human gate:
The channel-wide controller is intentionally paused while readiness work completes; bounded items run only when explicitly assigned. One pilot from this queue produced the governed Graphify sidecar itself.
What runs today — and what deliberately doesn't.
Live and governed
- Provider-neutral tier-1 intake accepting additions-only submissions from approved human and AI surfaces.
- Guarded bridge syncing accepted work to the private Git source of truth — secret scan before every commit, conflicts stop for review.
- Three read-only steward profiles reviewing changed batches; one bounded canonical writer applying accepted routine changes.
- LLM Wiki compiled to 445 typed pages across five classes — deterministic counts re-run August 21, 2026.
Boundaries & work in progress
- The Slack channel-wide research controller is intentionally paused; bounded queue items run only when explicitly assigned.
- The Graphify sidecar is operational, but its scale counts vary between snapshots — so it is described qualitatively here rather than with an evergreen number.
- Promotion into operational and authority tiers still stops for human review — by design, not by limitation.
Amber marks deliberate limits and context — not shipped autonomous capability. In this system, the authority boundaries are the feature.
The pattern transfers. The tools can change.
For a client, this architecture becomes governed research and institutional memory; source-backed content and website knowledge; client-specific confidentiality and approval boundaries; reusable methods that don’t flatten conflicting evidence; specialist agents holding the minimum authority each job needs; and auditable handoffs from intake through implementation and publication.
The specific tools can change. The transferable architecture is controlled intake, evidence-backed compilation, independent review, bounded execution, human gates, and a durable source of truth — adaptable to a client’s website, research library, content operation, internal knowledge, or agent workforce.
The transferable patternI designed the governance — the authority model, the handoffs, and the acceptance gates.
I orchestrated the agent and runtime boundaries — which profile may read, which single writer may write, and what always stops for a human — and I decide where automation is safe enough to earn more scope. The agents do the reviewing; the architecture decides what they’re allowed to touch.