Most of these pages show the data. This one shows the machine that gathers it — built in public, by one person and a model, on a hard monthly budget ceiling enforced in code (the live number is on the Cost page).

Ingest → store → serve. Every number is computed in Python; the model only narrates, through one Bedrock chokepoint, gated by a budget governor.

A board of AI experts with different takes

The coaching layer isn't one assistant — it's an ensemble of eight named personas (a sports scientist, a metabolic doctor, a behavioural coach, an N=1 statistician, and others) that each read the week from their own discipline. They disagree, and the disagreements are surfaced rather than averaged away — a single confident voice is exactly what an experiment of one should distrust. (ADR-047 / ADR-055; coach_computation_engine.py.)

Keeping a model honest about my own data

The rule the whole system is built around: the model never does the math. Every number — correlations, scores, deltas — is computed in Python; the model only narrates pre-computed values, always as a correlation, never a causal claim, always with the confidence label attached. It cannot invent a statistic in prose because it is never handed the raw freedom to. All inference routes through one Bedrock chokepoint so there is a single place to audit what was asked and what came back. (ADR-062; bedrock_client.py.) interpretive only

A governor that won't let the bill run away

Putting an AI behind a public website is a way to get a surprise invoice. So a cost governor projects month-end spend every 8 hours and writes a budget tier (0–3). As the projection climbs, AI features degrade on purpose — first the heavy ensemble narratives pause, then the public ask-the-data endpoint returns a friendly "paused" instead of a charge, and at the ceiling even the daily brief skips inference. One traffic spike cannot empty the budget and dark-fire the site. (ADR-063; cost_governor_lambda.py + budget_guard.py.)

An agent that triages the platform while I sleep

A self-healing agent runs three mornings a week (plus on-demand when an urgent alarm fires), triaging alarms, failed CI, and queue backlogs. For the narrow, provably-safe class the machinery once included a deterministic merge gate — an allowlist, a diff-size cap, and the test subset. It ran in shadow mode from July 2026 and was retired outright on 2026-08-30, having never merged anything: every fix, safe class included, lands as a pull request a human merges, permanently. The engine's production deploy approval is never bypassed. The agent has read-only credentials; it proposes, and the human holds the keys. (ADR-064 / ADR-065 / ADR-129.)

QA that looks at the screen, with a model's eyes

After every deploy a headless browser walks the live site, opens the cockpit, exercises the interactions, and screenshots each page. Then a vision model reads each screenshot for things a pixel-diff would miss or false-alarm on — broken charts, overflow, a panel that rendered empty — robust to the fact that the underlying numbers change every day. The site you're reading was checked this way. (ADR-076; qa/visual_qa.py + qa/visual_ai_qa.py.)

The essay: how this is actually run

The org design behind all of this — sessions as employees who forget everything, deterministic gates holding the keys, one human owning everything irreversible, and the failure log as the credibility — is written up in full: The Org Chart of One Human and N Agents.

A note kept honest: the platform is deliberately further along than the result it documents. That's the joke, and the point — the engineering is the easy part; the weight is the hard part. This page is the receipt, not the trophy.

The Method

The board