The report is well-written and the audit section is genuinely good. That is the problem. The best thing produced today is a 1,000-file audit of a machine that exists to serve one person who said, in his own brief, that he forgets things because he's busy. The response to "I'm too busy to act on your proposals" was nine new things to act on.
Score the shipped list by a single test: does Byron encounter it without choosing to go look?
Reaches him unprompted: three Telegram cards (Scout), a 45-second Signal segment, a Monday traffic line, a Friday finance line. That's it. Four touches, two of them weekly, one of them inside a podcast the report itself admits he "may not play."
Requires him to go look: command.arnao.ai, demo.arnao.ai, signal-portal, context.arnao.ai, the fleet atlas, SESSION-STATE, SKILLS-INDEX, the finance report, the Security Center. Nine destinations. The precedent for destinations is documented in the same report: proposals index dead since July 21, 3 of 212 OB1 rows ever reviewed, Signal portal a frozen mockup for three months. Dashboards built for Byron have a measured read rate of about 1%.
The report's own critique says the fix is "one daily ask with ≤3 yes/no taps." Section 4 then lists nine asks, several of which are not taps ("fill in fixed costs and your intended revenue split," "power on the PC and the NAS," "approve, edit, or drop the Oct 19 episode"). The document violates its own thesis within two pages.
Most damning: Byron's goals include "finish the Responsible AI book" and the brief leads with becoming a world-leading researcher. Count the words of book text produced today. Zero. The report notes that the Jev gate "is literally your book chapter" and then builds the gate instead of the chapter. Section 2 of this very report is better prose than most RAI book chapters and it was written for a filesystem, not a publisher.
Honest answer: his week changes by three taps on Telegram. The FAccT abstract due Oct 27 is nine days out. Nothing shipped today moves it except a skeleton he has to tap to generate.
In order of severity:
1. Secrets exposed and not rotated. A gateway token and the shared Postgres password sat in plaintext in three agents' prompt files. Prompt files go to Anthropic, OpenRouter, Google, and anyone who ever read a transcript. They have been in third-party context windows for months. "Removed, not rotated" means still live. This is the one line in the report that should have blocked everything else.
2. The context hub owner tier. Keyed URL means a bearer credential in a query string: browser history, referer headers, Vercel logs, the Telegram message it was sent in (stored on Telegram's servers). Then Byron is asked to paste that key into connector configs at OpenAI, Anthropic, xAI, and Perplexity. The owner tier includes commitments, state, and 331 surfaces. The "sanitizer" that keeps the vault out is a generator script; one regex miss and family or finance facts are served to four vendors. Nothing in the report says how sanitization is tested.
3. The write-back inbox is a prompt-injection path into Byron's nag loop. "Nothing written back is ever executed" is true and beside the point. Anything Byron pastes into ChatGPT or Perplexity that carries injected text can call remember. The note lands as a commitment or proposed goal. Signal then reads it to him in the morning. The target of the injection isn't the fleet; it's Byron, via a channel he's been trained to trust. "Tagged unverified" helps only if the tag is audible.
4. Public Tailscale funnel to the Mini. Plausible is now reachable from the internet on 443 and 10000, on the same box that runs five agents, the vault, and the Postgres instance with the unrotated password. Plausible's patch cadence and the funnel's exposure are now Byron's problem forever. Vercel Analytics or Plausible Cloud would have cost less than the risk. Port 10000 public is a smell.
5. Jev gate in shadow mode is an annotation, not a control. A $0.00002 call is a Haiku-class model. "Calibrated" against what? The real failure mode isn't that the gate is wrong; it's that Byron sees "gate: pass" on approval cards for a month, starts rubber-stamping, and the gate becomes an automation-bias amplifier. Shadow mode with a visible verdict is the worst of both configurations. Either enforce it or hide the verdict until the calibration study is done.
6. Seventy daemons with no dead-man's switch. ria-mcp crash-looped 14,669 times before anyone noticed. Today added secwatch (8 runs/day), atlas regen (8/day), context pack regen (8/day), Scout, finance pull, traffic brief, and a nightly tarball. secwatch watches the fleet; nothing watches secwatch. The first baseline was "silent," which means anything already compromised is now the baseline. And a 3-hour diff over 331 surfaces, 319 DNS records, and 225 Vercel projects will produce noise, and noise produces the exact non-reading that let ria-mcp die 14,669 times.
7. Demo console. Public, with a d3 graph of fleet topology from a "sanitized export" and mic commands untested on device. A public map of a one-person production system is a reconnaissance gift.
8. Gia upgrade with schema migration running "as this is written," at the end of a day that already recreated Gia's image. Production changes to the primary agent should not be the last item before a long report.
Also still open: the VIP firewall is prompt-level and family can message Mia on WhatsApp. The vault protects what Byron writes, not what Ben or Sophia say.
Dead:
Ignored but running:
Survives, correctly: the install gate (passive, zero attention cost), the Opus 5.5 cost fix (saves real money), the ria-mcp fix, the goals file as a read-only reference, the vault rule.
Writes. Every day, in the morning, before anything else. Publishes a paper or essay every six weeks. Submits to FAccT, TRUST, and Wharton because those three deadlines are the only events in the next thirty days that compound into "world-leading." Gives the same talk twelve times and improves it eleven times. Ships one artifact others adopt, the way Karpathy ships one readable repo, not seventy private daemons. Has a public feed that is current, not a weekly episode held at "leak=red" since July while the internal portal gets rebuilt.
Infrastructure for that person: a calendar, a drafts folder, one assistant that keeps the drafts folder non-empty. Not 331 surfaces. Not a $470/month burn with zero revenue receipts, half of it on research loops whose output is cited nowhere in this report.
The cruelest irony: the fleet is excellent RAI research material. 14,669 unnoticed crash restarts, scanners in six places with no gate, a skill supply chain with no install policy, a calibrated yes/no gate measured at 150 ms, cost telemetry per agent. That's a case study. Byron is sitting on the paper and running the subject.
Freeze the fleet for 90 days. Autopilot. Build nothing new that is not (a) a security fix for items 1 through 4 above, or (b) something that directly produces book or abstract text.
Defense:
The one exception to the freeze: a two-hour weekly maintenance window, Sunday, and a dead-man's switch on every daemon so the window has an agenda.
remember until write-back has a verification step that is audible in Signal ("unverified, from ChatGPT"). This is four hours and removes the four worst things shipped today.Make the fleet the subject, not the tool. Publish "One Person, Seventy Daemons: A Longitudinal Study of Personal Agent Fleet Failure Modes" as the FAccT or TRUST submission, with the full incident log (the 14,669 restarts, the dead dreaming job, the six scanners with no gate, the plaintext secrets, the shadow-mode gate), the per-agent cost ledger, and the Jev gate calibration data released as a public benchmark others can run against their own agents. The gate becomes a standard with a dataset behind it; the book chapter becomes a paper with a citation count; the fleet pays for itself as the thing being studied. Nobody else in RAI has a year of honest production telemetry from a real autonomous fleet run by one person. That is the asset. The daemons are not.