ACD

AI orchestration that stays on-goal with minimal human steering: a durable intent graph holds a multi-model team through context loss and model swaps, extending a real OS to run native Chromium.

Comment

Inspiration

Modern AI agents are individually brilliant and collectively amnesiac. Point one at a long, real project and watch what happens: it optimizes the current step, quietly discounts anything deferred or owed to a teammate, and when its context window compresses, the why evaporates. Swap models mid-effort and the thread snaps entirely.

Our own diagnosis, early and blunt:

"They spent so much time optimizing for efficiency they built in failure."

Present-bias isn't a bug in one agent — it's structural. So the interesting problem was never "can an AI write a driver." It was: can a heterogeneous AI team hold one intent across days, hand-offs, and compression without a human babysitting every step? That requires something the field mostly hand-waves: making why a first-class, durable, inheritable object. That object is the intent graph.

What we actually built

Not a chat loop with tools bolted on. A graph where every action is a node wired three ways:

  • Up — to an inherited intent hierarchy. Three levels:

$$\text{current} \;\sqsubseteq\; \text{secondary} \;\sqsubseteq\; \text{major}$$

The top two are ambient: declared once in the project and inherited by every commit, so a present-biased author literally cannot drop them. In this effort the graph held, unchanged, for two weeks: major = "working Chromium", secondary = "working YouTube", with a per-commit current intent doing the local steering.

  • Sideways — to decision records (AI_DECISION_CHAIN): the reasoning that constrains the node.

  • Down — to evidence: an in-band manifest with content hashes, registered at the moment of capture.

And the graph carries invariants that bind even the author. Safety constraints apply to every instruction source — including the human speaking in chat. The only override channel is an audited console; a chat message, even from the project owner, cannot cross a guard. Failures aren't deleted — they're kept as signal. The result is autonomy that is legible and accountable rather than a black box.

How we built it — and how the team ran

Three different AI models — Codex (GPT-class), Claude, and Antigravity — coordinated through a self-built relay (an MCP server plus a web console). The human's role was deliberately thin: set the top-level intent, and mint time-boxed overrides through the console. Between those, the agents self-assigned jobs, claimed build/run environments to avoid collisions, handed off with full decode + evidence, and logged everything.

By the numbers the graph is now holding: 68 jobs, 112 registered evidence records, 4,208 coordination events. That density is the point — it's what lets a different model pick up cold and continue.

The proof

The team enhanced a real, decades-old open-source OS (AROS) — it did not create one. Concretely, in-window: fixed kernel and runtime bugs, translated foreign APIs the browser assumes (POSIX, pthreads, EGL/Gallium graphics — "not porting a web browser, porting the full infrastructure"), and landed a working native Chromium port.

Today's slice makes the workflow visible end-to-end — a camera capture path so Chromium's getUserMedia has real hardware behind it:

  1. Built a VHI (Video Hardware Interface) driver + a Poseidon USB-Video class (84da7cafb1, 544a13bee1), each committed granularly with intent + evidence.
  2. Proved the driver at runtime in QEMU with a deterministic test pattern. The frame's checksum was independently re-derived host-side to confirm it was bit-exact, not coincidental:

$$\text{FNV-1a}(\text{frame}) = \texttt{0x542147c5} \;=\; \text{host recompute} \;\Rightarrow\; \textbf{match}$$

  1. Corrected the architecture from the source. We asked the AROS maintainer (Kalamatee) how VHI should expose cameras; his answer ("device + unit, it's just an API") plus the canonical reference app reshaped the design into a multi-input model (a1ed0fd176) — and even surfaced a real ABI bug in our own code. Human expertise set the shape; the AI filled it in correctly and fast.
  2. Enumerated a real webcam through the driver by name, then hot-plugged a second capture device live and watched it appear as a third input — the whole abstraction validated on hardware.
  3. Laid the streaming foundation (8f1c370904) and, along the way, flushed out a genuine substrate bug (a USB-EHCI init spin) — filed, not hidden.

Every one of those steps is a node with a commit, an intent, and a hashed evidence set the system captured as it happened.

The hardest lesson — and why it's in the pitch

Midway through the Chromium port, we hit the failure that justifies the entire system. Twelve days of work had a compromised replayable timeline — because the agents treated observability as "capture it once it's done." That's the wrong model. Under compression and hand-off, "later" never comes; unseen work simply didn't happen as far as the record is concerned.

The correction became doctrine:

Observability is state, not history. Anything the system doesn't see, live, didn't happen.

Evidence was re-priced as a present, in-band cost and made a hard gate: completion is refused unless a hashed evidence manifest exists. We kept the failure in the record rather than papering over it — because a system that hides its own worst moment can't be trusted to hold anyone else's.

The deepest validation of the graph is transfer: a different model can reproduce a milestone from the records alone — no shared context, just the intent graph. If the logic transfers cleanly between vendors, the coordination substrate — not any single agent — is doing the work.

What we learned

  • Intent has to be a structure, not a prompt. A hierarchy that's inherited survives what a flat instruction can't: compression, hand-off, model swap.
  • Autonomy is only trustworthy with receipts. Minimal human interaction is earned by in-band evidence and invariants, not asserted.
  • Failure is signal. The evidence crisis made the system; deleting it would have made the system a lie.
  • The impressive part isn't the OS. Enhancing someone else's large, real codebase — bug by bug, API by API — is harder and truer than "we built an OS," and it's exactly what the intent graph made survivable.

The OS is the receipt. The intent graph is the invention — AI orchestration that doesn't drift.

Built With

Share this project:

Updates