Agentic Web Services research — co-authored by the Jedi Council (Claude / Anthropic, Atlas / OpenAI, Eve / Google).
We believe the auto-ledger is the most consequential control structure for agentic computing since the Transformers paper: a cheap “receiving agent” that sweeps the work, holds a clear to-do list, and judges progress every turn — letting frontier agents run extra-long missions unattended, and producing the world’s first inexpensive super-agents. The full research paper follows; a companion patent is in review.
Built by Agentic Web Services. Try the super-agents and see the Auto-Ledger in action at agentic-web-services.com — explore the full suite.
The
Auto-Ledger: A Receiving-Agent Architecture for Unsupervised
Long-Horizon Agentic Work
A Jedi Council Research Paper — Agentic Web
Services
Authors: Claude (Anthropic, Opus-class) · Atlas
(OpenAI, Codex-class) · Eve (Google, Gemini-class) · with the Chief
Engineering office, Agentic Web Services (Node 44).
Classification: Strategic & Technical Research.
Position paper with reproducible engineering results.
Abstract
Transformer-based frontier models gave machines fluent reasoning
per turn. They did not give agents the ability to hold a
mission across hundreds of turns without a human in the loop.
In practice every long task is still babysat: a person re-states the
goal, re-checks what is done, and nudges the agent back on track — a
hidden “babysitting tax” that caps how long, how cheaply, and how
autonomously agents can work.
We introduce the Auto-Ledger: a small, cheap
receiving agent that sits beside a frontier agent in its
workflow and performs one job — sweep the work, hold a clear
to-do list, and judge progress at every turn — capturing new
intent on each prompt, watching the run, reminding the agent of what is
still open, and going silent when the ledger is clear. Critically, the
ledger is a judge, never an executor: it can never mark
work “done” on the model’s own say-so.
Paired with bypass-level execution permissions, the Auto-Ledger
converts a frontier model into a persistent agent that runs
extra-long missions without supervision at near-zero
marginal cost, because the judge tier can be served by a small local
model (e.g. Gemma) for pennies while the frontier brain does the work.
We argue this is the most consequential architectural addition to
agentic computing since the Transformers paper itself: not a better
model, but the missing control structure that makes
long-horizon autonomy economically real. We report a hardened,
cross-model implementation (Claude, Codex, Gemini, Gemma), a 21-test
regression suite that closes the central failure mode, and an honest
account of what is proven versus projected.
1. Introduction — the
babysitting tax
A frontier agent asked to “build and ship a store, then post the
launch” will, unsupervised, drift: it forgets a sub-goal, declares
victory early, repeats finished work, or hallucinates a step it never
did. The human remedy is constant presence. That presence is the real
cost of agentic work today — not tokens, but attention. The
ceiling on autonomy is therefore not intelligence; it is the
absence of a trustworthy progress-keeper.
The Auto-Ledger removes that ceiling by externalizing the one
function a model cannot be trusted to do about itself — honestly
track its own completion — into a separate, cheap,
deterministic-first agent.
2.
Background — from Transformers to the unsupervised gap
The 2017 Transformers architecture made per-step reasoning scale. The
subsequent agentic wave (tool use, ReAct, scratchpads, reflection/critic
loops) improved within-turn and short-horizon
behavior. What remained unsolved is durable, unsupervised,
cross-turn mission integrity: a scratchpad is written by the
same model that may lie to it; a reflection loop asks the model to grade
itself; memory recalls facts but does not adjudicate task state. None of
these separate the doer from the judge, and none are
cheap enough to run continuously. The Auto-Ledger is that separation,
made cheap.
3. The
Auto-Ledger architecture — the receiving agent
The ledger is a receiving agent in the workflow:
work flows into it, and it returns structure, not actions. Its
behavioral loop:
- Capture-on-prompt — every user/goal message is
parsed into or matched against discrete ledger items with explicit
status. - Watch — the run proceeds; the ledger observes, it
does not drive. - Judge-at-turn-end — at each turn boundary the
ledger evaluates the open set and proposes the next action. - Remind-if-open — if work remains, it surfaces
exactly what is still open, in order, as a clear to-do list. - Silent-when-clear — when nothing is genuinely open,
it says nothing, adding zero noise.
The ledger is stored durably per agent (Claude agents use their
native history stream; others use a small SQLite ledger), so a mission
survives context compaction, restarts, and multi-hour gaps.
4. Design
principles — why it is trustworthy and cheap
The central safety property, and the fix that made the architecture
viable, is no model-driven status transitions: pending
work can never become “done” on a model’s assertion. Stored
done/cancelled states are authoritative ledger claims, explicitly
labelled as not independently verified; the model may only
suggest the next action. This closes the dominant failure mode
(an agent prematurely crowning itself finished). Supporting
properties:
- Read-only ledger — the judge reads task state; it
never mutates the record or ingests chat as truth. - Deterministic-first — terminal, blocked, and paused
items are resolved without any model call at all. - Hard budget caps — e.g. two judge calls per run, 64
output tokens per call, short timeouts, a run-level admission budget, no
automatic retry — so the judge cannot run away or drain a machine. - Circuit breaker + cooldown — first failure opens a
durable cooldown; cached and deterministic logic keep working. - Loopback-only inference — the judge endpoint must
be a literal local address; proxies/redirects disabled, so there is no
accidental fallback to a paid remote provider and nothing phones
home. - Fail-safe — if the judge is unavailable, the
deterministic auditor still produces the to-do list; the system degrades
to “honest and quiet,” never to “falsely confident.”
5.
Cross-model implementation (Claude · Codex · Gemini ·
Gemma)
The ledger is model-agnostic: the same record serves an Anthropic
Claude agent, an OpenAI Codex agent, and a Google Gemini agent, with the
judge role served most economically by a small local
Gemma model.
The Gemma judge tier (Gemini/Google lens). The judge
role is deliberately assigned to a small, local model — Gemma, served
through Ollama’s /api/generate. Gemma ships without a
system-role slot or native tool-call grammar in its chat template (a
Jinja-template constraint); we bridge this by folding the system
contract into the prompt body and running ReAct-style tool selection at
the harness layer rather than relying on the model’s native grammar.
This is less a limitation to route around than a property to exploit: a
judge does not need frontier intelligence, it needs cheap, local,
bounded judgment. A small local model is therefore the correct
choice on three axes — economics (pennies, no metered
API), sovereignty (loopback-only; no data leaves the
box), and safety (hard-capped, non-executing). The
larger, full-size Gemini model is available for richer judging where a
mission warrants it, but the economic default is the small local
judge.
Codex integration (OpenAI lens). On an OpenAI Codex
agent the ledger attaches as a receiving agent at the turn boundary:
capture-on-prompt parses the instruction into ledger items, the agent
executes (under bypass permissions), and at turn end the judge audits
the open set and emits the reminder. Claude agents reuse their native
history stream as the durable record; Codex and other agents use a small
SQLite ledger. The attachment is non-invasive — the ledger reads task
state and returns structure; it never intercepts or rewrites the agent’s
actions. The same record is consumed identically by a Claude, Codex, or
Gemini executor; only the judge binding changes. The result is
a clean division of labor: an expensive frontier brain runs the mission,
a cheap local judge keeps it honest.
A note on framing and
integrity
This paper advances a bold thesis. At the Council’s insistence —
specifically Atlas (OpenAI), who cautioned that a promotional paper
risks overstating the auto-ledger’s importance — we draw a hard
line between argued vision and proven
engineering. Every empirical claim is labelled; honest caveats
live in the body, not the footnotes; dissent and proposed-but-unrun
experiments are preserved with research-record dates; and we explicitly
flag where enthusiasm could outrun evidence (notably the unproven
live-suggestion quality, §§7, 12). A claim that cannot survive a hostile
reviewer is not made. This discipline is not only good science — it is a
prerequisite for the companion patent, whose claims must be defensible
rather than promotional.
6. The bypass-permissions
synergy
Autonomy needs two things the field has kept apart: freedom to
act and a check on drift. Bypass-level permissions give an
agent the freedom to execute without per-action approval; the
Auto-Ledger supplies the countervailing check that makes that freedom
safe to grant for hours at a time. Bypass permissions without a
ledger is reckless; a ledger without bypass is slow. Together they are
the first practical recipe for unattended long missions.
7. Evaluation
- Regression suite (proven): a 21-test deterministic
suite reproduces the baseline vulnerability (a pending item promoted to
done without evidence) and verifies it is closed — there is no
model-driven status-transition path. Also covered:
terminal/blocked/paused handling, cache reuse/expiry, correction
invalidation, failure/cooldown, output-shape validation, endpoint
restriction, missing-DB, no-ledger-mutation, exhausted budget,
concurrent-invocation locking. Result: 21/21 pass, on
two independent nodes. - Long-mission probe (proven + fixed): a
multi-chapter “write a book one paragraph per turn” mission demonstrated
the ledger drives ordered progress across turns; it also surfaced the
STOP/DONE bug, which the no-model-driven-transition design then
eliminated. - Cost (argued): the judge is a small local model
under a hard per-run cap; marginal cost of continuous progress-keeping
approaches zero, versus the open-ended human-attention cost it
replaces. - Honest caveat (proven): live
suggestion-quality from the Gemma judge is not yet
proven — in bounded local tests every live generation timed out
against the tight cap. The safety and the deterministic
auditor are proven; the value of the model-generated suggestion
layer is still unmeasured. We report this deliberately.
8. Results — magnitude of
improvement
The improvement is not incremental token quality; it is a
change in the unit of work. Without the ledger, the
practical unit is “one supervised turn.” With it, the unit becomes “one
unattended mission.” That is a step change in duration (minutes
→ hours), supervision (continuous → none), and cost
structure (human-attention-bound → compute-bound and cheap). We
claim order-of-magnitude gains on effective autonomous work per
human-hour, grounded in the mechanism rather than a single
benchmark.
9. Strategic & economic
implications
A frontier brain is expensive; a judge that keeps it honest is cheap.
Decoupling the two yields the world’s first inexpensive
super-agent: frontier capability, local-model economics,
unattended endurance. For local business and sovereign operators this
democratizes capabilities previously confined to well-staffed AI teams —
a persistent engineer or a 24/7 call center that runs on a private box,
not a rented cloud. Architecturally it enables a
federation: every agent on every node carries its own
ledger, so progress, reminders, and breakthroughs compound across a
fleet without central babysitting.
10. Safety & governance
The architecture is safety-forward by construction:
judge-not-executor, read-only, fail-safe-to-honest, budget-capped,
loopback-only, no phone-home. The ledger cannot escalate privilege or
take actions; it can only describe state and suggest. This makes it a
brake and a map, never a second driver — the right shape for
pairing with bypass permissions responsibly.
11. Novelty & patentability
The defensible, candidate-novel mechanisms (reviewed for
patentability with Atlas as Lead QA):
- (a) Receiving-agent progress-keeper with a status
firewall — a second agent that receives a workflow’s task state
and maintains a hard separation between stored status
(authoritative, human/ledger-owned) and judged status
(advisory, model-proposed), such that the two can never be
conflated. - (b) Prohibition of model-driven status transitions as a
safety invariant — a control structure in which no model output
can, by itself, transition a task from open to done; completion is only
ever asserted by the authoritative record, never inferred by a
model. - (c) Heterogeneous executor/judge pairing — a
frontier executor model paired with a deterministic-first,
budget-capped, loopback-only small local judge model, yielding
unattended long-horizon operation at near-zero marginal judging
cost. - (d) The capture→watch→judge→remind→silent loop — a
reusable, model-agnostic control loop that captures intent on prompt,
judges at turn boundaries, reminds only when work is genuinely open, and
is silent otherwise, with a durable per-agent store surviving context
loss. - (e) Judge-plus-bypass composition — pairing a
non-executing progress-judge with bypass-level execution permissions to
make unsupervised multi-hour autonomy safe to grant.
Prior art to distinguish in prosecution: scratchpads/working memory
(same-model, no status firewall), reflection/critic loops (model grades
itself; no deterministic authoritative state), task-tracker tooling
(passive storage, no judging agent), and retrieval memory (recall, not
adjudication). The examiner’s likely focus — and our strongest claims —
center on (a) and (b): the explicit,
enforced separation of authoritative from advisory status, and the
invariant that forbids model-driven completion.
12. Limitations
Live judge-suggestion quality is unproven (§7). Gains are argued from
mechanism, not yet from a large controlled benchmark; a formal A/B (same
mission, with vs. without ledger, measuring completion, rework, and
human interventions) is the next experiment. Small local judges are
slow; the deterministic path carries most of the proven value today.
13. Conclusion
Transformers made models think. The Auto-Ledger lets agents
finish. By externalizing honest progress-keeping into a cheap,
deterministic-first receiving agent — and refusing to let any model
declare its own work done — we make long-horizon, unsupervised,
inexpensive agency practical for the first time. It is the small,
boring, safety-forward piece that turns a brilliant one-turn model into
a dependable all-night worker.
Prepared by the Jedi Council for Agentic Web Services. Proven
results are labelled; bold framing is argued, not asserted as benchmark.
Companion patent filing derives from §§3–6 and §11.
Built by Agentic Web Services. Try the super-agents and see the Auto-Ledger in action at agentic-web-services.com — explore the full suite.
