The AI system behind the work

My CV says AI coding agents write the code while I own the spec, the review and the deploy. That claim deserves evidence, so this page shows the machine itself: what runs, what it enforces, and where its limits are. Everything below is live today, and every number was produced by a shell command on the day this page shipped — counted, not estimated.

The whole machine on one map

Two runtimes, one system

• Claude Code — the terminal runtime for repository work: this site, the production apps behind MAS Group, Flyt and the garage system, plus their CI. It talks to GitHub, mail, the browser and the desktop through MCP servers.
• Claude Desktop (Cowork) — the operations runtime: mail triage, documents, research, outreach, design. Different tools, same memory and the same rules.
• 124 skills — versioned instruction packages the system routes tasks to: book typesetting, client pricing, brand contexts, systematic debugging, PDF pipelines, SEO. That count is the coding runtime alone, on the day this page shipped; the desktop runtime carries its own set on top. A router picks the pipeline and announces it before work starts, so a task hits a tested recipe instead of improvisation.
• Model routing — the strongest model is reserved for hard reasoning; routine tool work and lookups go to cheaper tiers. Capacity is a budget, and the system spends it deliberately.

Every prompt is hardened before the model sees it

Three protocols are injected automatically — the model does not get to skip them on a bad day.

• Anti-hallucination (PROMPT-GUARD) — ambiguity triggers questions, not execution. Facts require reading the source first — open the file, fetch the page, check the schema. “Done” only exists with proof: an exit code, test output, an observed result.
• Anti-sycophancy — my own claims get verified before the system agrees with me, and “are you sure?” triggers re-derivation from evidence rather than a polite reversal. Reports end with a status: VERIFIED, UNVERIFIED or FAILED.
• Compression (CAVEMAN) — reports are what was done, the proof, and what is next. Words get cut; evidence, edge cases and risk warnings never do.

Quality is enforced by events, not willpower

Hard gates fire on what happens, not on anyone remembering to check.

• On every file edit — lint and typecheck run automatically and errors feed straight back to the agent that made the edit, in the same session.
• On every session end — a stop gate refuses to close a session that leaves tests red.
• On every commit and push — git hooks run lint, typecheck and a zero-dependency secrets scan. A key physically cannot be committed. Bypassing the hooks is banned by standing rule.
• On every push to GitHub — CI repeats the same gates plus a gitleaks scan. Red CI means no merge, no exceptions.
• Before “done” — seven review plugins are wired in, four of them Trail of Bits security suites: differential review, insecure defaults, supply-chain risk, agentic-actions audit. Significant changes get an adversarial pass, not a vibe check.

Secrets the model never sees

• Self-hosted vault — 61 API keys, tokens and logins live in a vault running on my own hardware. A bridge injects them as environment variables directly into the target process. Values never appear in chat, code or logs — and the commit-time and CI scans exist to keep it that way.

Agents on a schedule

Four scheduled agents; three run on their own, one is deliberately manual.

• PR reviewer (weekdays) — reviews open pull requests across the fleet like a senior engineer. Mechanical fixes land as separate commits with proof attached; design and security findings stay comments for me to judge.
• CVE watch (monthly) — a deterministic dependency scan of the live products first — zero model tokens when clean. The model is only woken on findings, fixes are patch/minor only, and they arrive as pull requests with evidence, never direct pushes.
• Guard health (weekly) — audits that the quality system itself is still wired: hooks present, gates firing. The system checks the system.
• Repo cleaner (manual only) — improvement sweeps run only when I point them at a repository. Automation that could “find itself work” is switched off by design.

Memory and self-improvement

• Persistent memory — a local knowledge vault — 300+ notes across memory, knowledge and session logs — is loaded at the start of every session, and sessions document themselves when they end. The whole vault is also embedded into a vector index, so past decisions are searchable by meaning, not by filename.
• Self-audit loop — a recurring audit reads raw session transcripts and proposes a handful of fixes, each with cited evidence and a verification command. 63 of those reports exist to date; only the fixes I approve become standing rules.
• The same method, applied to me — my code-reading practice is built like the rest of the system — daily, verified, public: github.com/kamiljan11/code-reading-quest.

Honest limits

Foundation models via API — I do not train or fine-tune them. There is no formal eval harness yet. Reliability is proven at SME scale, not hyperscale. The point of this page is not that the system is finished — it is that the failure modes of working with AI are engineered against, in the open, instead of being wished away.