The shell around the model, not the model.

AJI is a single-operator agent runtime. A deterministic governance kernel of code hooks wraps Claude and drives two planes: an interactive assistant on a laptop, and a headless cron fleet that calls the model as a degradable subroutine. The load-bearing idea is that the probabilistic model is a dependency wrapped in deterministic shells, hooks gate its writes, Python pipelines own its failure path, and a separate verifier audits its output.

System map

five layers + a kernel

Entry · interactive

Me, on a laptop (Claude Code)

Entry · autonomous

Cron fleet → claude -p

↓

Orchestration

Context loader over 25 skills and 17 role-specialized subagents, plus a shared voice and routine library.

↓

Capability · tools

Gmail · Calendar · IMAP · YouTube · Dropbox · OneNote-OCR* · Playwright · ffmpeg
An 8-server MCP layer. * the OneNote-OCR server is one I built.

TRUST BOUNDARY email, web, transcripts, and files enter as untrusted data, never as instructions

↓

State · memory

140+ curated memory notes behind an index, per-skill state files, and a people spine. Precedence: live files & code > saved memory.

production plane: cron → Python pipeline → claude -p (degradable, structural fallback) → render → Fastmail send → guardrail ceilings → out-of-band verifier

Decisions that carry weight

D1 · governance

Rules live in code, not the prompt

Writing-style and safety invariants are enforced by exit-code hooks that hard-block the tool call. Putting them in the kernel means the constraint survives context rot instead of depending on the model remembering a line in its prompt.

D2 · reliability

The model is a degradable subroutine

The briefing and meeting-brief pipelines shell out to the model for prose, then catch a bad response and fall back to a structural template that still ships. A probabilistic part gets an explicit failure path, so the automation degrades instead of breaking.

D3 · verification

The actor is never its own auditor

A separate scheduled check confirms the newsletter send actually produced its artifacts, the issue file, the sent-log row, a clean subscriber count, rather than trusting the send to report its own success. Detective controls for silent failure.

D4 · security

Read the world, act on it separately

External content is untrusted, a scanner flags injection patterns on the ingest tools, and policy forbids a read chaining into a write without a fresh human instruction. Privilege separation applied to a personal assistant.

At a glance

stateful skills

role-specialized subagents

8MCP

tool integrations, 1 custom-built

140+

curated memory notes

code hooks, 3 hard-block gates

jobs live in production