A company that runs out of a folder of text files

This note is about IntrinsicOS, the vault Intrinsic Labs runs out of — the system the numbers below are measuring.

Intrinsic Labs is one person with clients, three product bets, and a research program. For two months it has run most operations through a small crew of AI agents working over plain Markdown files in git.

The structure

Everything lives in one folder opened in an ordinary notes app. Each project has a brief, a directory of tasks (one file per task with stable IDs), and a docs folder. The business itself—agreements, finance, decision log—is a project too. No database. No dashboard that isn't generated from those files. The git history is the only journal.

Two files are the human's interface. An inbox where he dumps ideas, call notes, half-thoughts from a phone. A to-do list with only things that need a human—a client to answer, a decision, a preview. He checks things off.

The agents

Five named agents (so the same worker is called the same thing everywhere):

• Superintendent: reads the inbox, routes items, checks project state against recent history, rewrites the to-do list. Nine times a day, six days a week.
• Executor: picks up delegated tasks, runs them in a git worktree on a branch. Up to three run at once, at most one per project.
• Maintenance agent: nightly checkup, watches scheduled jobs, repairs failures, polls CI.
• Arbiter: twice weekly, checks agent instructions against actual code, red-teams changes.
• The Ghost: a model of the founder's own judgment, produced by Tycho; consulted, not yet trusted with decisions.

No hardcoded prompts. Every prompt is a Markdown file in the folder, read fresh each run—edit in the notes app and the next run uses it.

What's enforced in code

Autonomy is a declaration. Each project's brief opens with YAML front matter, and that block is the whole contract between the project and the agents:

---
autonomy: gated
repo: ~/dev/web/liturgos
start: pnpm dev
---

autonomy: is the execution grant. locked — agent drafts, human commits. gated — agent builds to a boundary, queues a decision. open — agent runs to completion. No line means never executes, and only the founder writes it; a guard snapshots every brief before a session spawns and reverts the line if the session touched it, keeping the session's other edits. The grant can be scoped by task tag — autonomy: "gated · open: #docs #tests · locked: #release" — with the most restrictive matching clause winning and a malformed clause failing the whole line closed.

repo: names the workspace the agent may write to (a list for multi-repo projects, first entry primary). A repo mentioned anywhere else in the brief is read-only context; no repo: line means vault-only work; a declared path not cloned on this machine blocks the project rather than degrading silently. start: is the command that brings the project up, and unlike the other two any agent may record it — it is a fact about the world, not a grant. An optional tracker: line points at a backlog that lives elsewhere and is read, never written.

No repository work publishes unreviewed. Every executor session is supposed to end with a review from a fresh session that never saw the author's conversation — 51 of 58 branches in the measured window did. Author fixes what comes back, at most twice. High-severity findings force PR instead of auto-landing.

Nothing outward-facing has an agent path. Production deploys, sends, publishes, purchases need explicit human approval. Narrow exceptions: push a specific branch, open PR, deploy preview, append to decision queue.

Progress

IntrinsicOS is an ongoing experiment in giving agents responsibility for real company work. The next stage follows an outcome from its initial brief through review and delivery, with attention to the quality of the result and the time and corrections it requires from the founder.

The current operating measures provide a starting point: recorded session completion, the share of sessions directed toward clients and products, and a narrow record of choices that proceeded without a veto. We’re working toward measurements that connect this activity to accepted results and reduced founder involvement. The methodology describes what each current measure covers.

The original September 3 execution figure has been withdrawn because its calculation included completions without matching attempt counts. The dated correction below records the change; the current snapshot makes its coverage visible.