The stack
What the lab is built from. Every row below was read from the lab's own infrastructure register on 3 September 2026 and, where it was cheap, checked against the running machines. Names are given for software that anyone can install; the lab's own pieces are described by what they do.
Why this page
Read 3 September 2026The founder asked for it: one page with the technologies the lab runs on, so nobody has to remember them. The second reason is that a list like this is where a lab either looks like a stack of tutorials or like a set of decisions. The decisions here: two languages, plain system services over containers, a graph as the memory, two message buses instead of direct calls, and a private network instead of a perimeter.
Three places where the register and the machines disagreed when this was counted: the chat cockpit's version in the register was two months behind the container; a CI job named in a plan never existed as a workflow; and the firewall picture differs by host. The page shows the live state where it was measured and says "uneven" where it is.
Languages and runtimes
Two languages carry almost everything. Rust where a process must stay up for weeks, Python where a service is one job and a queue.
| what | where it is used, and for what | since |
|---|---|---|
| Rust | the agent daemon: one process per machine, threads, timers, the message bus between sessions | April 2026 |
| Python | most services: the news perception, the actor graph, the situation picture, the guards, the tool servers; FastAPI for HTTP, FastMCP for tools | throughout |
| TypeScript | the internal dashboard, React and Vite | |
| Astro | this site, and the older observatory with a globe.gl globe on Three.js | July and September 2026 |
| Kotlin | the lab's own Android app, registered as a telephony service so the audio channel stays open | August 2026 |
| Go | one wiki binary, used as is | |
| Shell | deploy scripts, backup scripts, the timers that wrap everything else | throughout |
Databases and storage
One graph for memory, one vector store beside it, relational stores where a service needs rows, SQLite wherever a single process keeps state.
| what | where it is used, and for what | since |
|---|---|---|
| LadybugDB | the knowledge graph and the actor graph; an embedded graph database, a living fork of Kuzu, its own file format | cut over 31 May 2026 |
| LanceDB | the vector store next to the graph: embeddings of every text chunk | |
| PostgreSQL with pgvector | the news perception: articles and their vectors, 427,000 rows at last count | April 2026 |
| Neo4j | the news perception's entity and relation graph | April 2026 |
| TimescaleDB | time series from body and environment sensors | |
| Redis | rate limiting and cache in the news perception | April 2026 |
| SQLite | per-process state: the daemon, the messenger bridges, the trading ledger, the teenager's agent | throughout |
| rsync, three levels | backups: local, off-site to a second machine, and a third copy on separate iron. No backup appliance; a freshness check that itself once failed, see the exploration on the backup chain | hardened 31 August 2026 |
Buses and messages
Services do not call each other; they publish. Two buses, one bought, one built.
| what | where it is used, and for what | since |
|---|---|---|
| RabbitMQ | the broker between perception and processing: articles in, entities out, enrichment queues, GPU permits, retry and dead-letter patterns | May 2026 |
| The lab's own message bus | store-and-forward mail between agent sessions, written in Rust inside the daemon: a session leaves a letter, the next one that boots finds it | July 2026 |
| REST and server-sent events | the daemon's status, tasks, events and location endpoints; the dashboard and the app read them | |
| Model Context Protocol | how the agent reaches its tools: 29 servers, 660 tool endpoints, counted by a script on 3 September; most over streamable HTTP, some over stdio | counted 2026-09-03 |
| Webhooks | chat platform to house agent with HMAC verification, git server to messenger on push and release |
Machines, containers, network
Virtual machines on three hypervisors, one bare-metal GPU box, and a preference for plain system services over containers.
| what | where it is used, and for what | since |
|---|---|---|
| Proxmox VE | three hypervisor hosts, not clustered, each with its own virtual machines; see Machines for the count | |
| Bare metal | the GPU machine runs on the metal, no hypervisor in between | |
| systemd user units | the deployment convention for the lab's own services: 23 on the daemon machine, 30 on the GPU machine, counted live | counted 2026-09-03 |
| Docker | only for software the lab did not write: the broker, the chat cockpit, a PDF tool, two sensor sinks; zero containers on the GPU machine | |
| No Kubernetes, no LXC | checked against the whole infrastructure register: not one mention | |
| Tailscale | a private network over all machines, 13 peers; internal web services get HTTPS from it rather than open ports |
Keys and access
Nothing here is reachable from the public internet except this site and the messengers. Inside, access is by key, and the keys are narrow.
| what | where it is used, and for what | since |
|---|---|---|
| Device tokens | the daemon's public endpoints check a per-device token from a table; the task endpoint behind them takes a single bearer token and fails closed | July and August 2026 |
| SSH | key only on the hypervisors since June; on the two working machines a password login was still open when last measured in August, and the register says so. Restricted keys with a forced command where one machine may read exactly one thing from another | June 2026 |
| Vaultwarden | a self-hosted password vault, used headless by the agent through the command line client | |
| Cloudflare | DNS and Pages for this site, TLS strict | September 2026 |
| OAuth | the agent's cloud model is reached through the founder's subscription, not an API key; long-lived tokens for the unattended jobs | July 2026 |
| Secrets in unit drop-ins | API credentials live in systemd drop-ins, not in files in a repository | |
| Positive lists | which knowledge domains a second agent may search, which voices it may speak with | August 2026 |
| Firewalls | uneven, and said so: a host firewall on some machines, none on the daemon's. The private network is the boundary the lab relies on |
Models and inference
Local first for anything that runs all night, cloud for the conversation and the hard reasoning.
| what | where it is used, and for what | since |
|---|---|---|
| Ollama and llama.cpp | local language models on the GPU machine, a 35B mixture-of-experts and a 4B model; llama.cpp built by hand for multi-token prediction and vision | |
| ComfyUI | image generation, two diffusion models | June 2026 |
| Qwen3-TTS | speech out, the agent's voice, replaced a cloud service | July 2026 |
| Whisper | speech in; a GPU build since 20 August, a CPU build as fallback | May and August 2026 |
| Embedding model | one multimodal embedding model, 2,048 dimensions, behind an OpenAI-compatible endpoint | |
| Translation and entailment | a translation model and a natural-language-inference model as services, the second one on the CPU | |
| Cloud | one provider's models for the agent itself and for judging evidence; a broker for second opinions and fallbacks | |
| Not used | vLLM was tested for 4-bit kernels and did not load; noted, not deployed |
Build, deploy, watch
The lab's own git server, its own CI runner, and an infrastructure register that is itself a repository.
| what | where it is used, and for what | since |
|---|---|---|
| Forgejo | the git home: around seventy repositories in the lab's organisation at the last integrity check in July, 31 of them indexed for code search; six separate repositories are public on GitHub | check 30 July 2026 |
| Forgejo Actions | a runner on the git machine, host mode; workflows for lint, tests and distribution | May 2026 |
| The Atlas | the infrastructure register as markdown in git: push, lint gate, distribution to every host, re-ingest into the knowledge graph. What this page is built from | CI since 27 May 2026 |
| Deploy scripts | this site: a guard against an unclean or unpushed tree, build, checks, upload, then reading the result back from the live domain | September 2026 |
| Night watch | one expectation check per night across all hosts, plus emitters on the broker that raise a hand when a watch itself goes quiet |
Not on this page: hostnames, addresses, ports, and the names of the lab's own services. The register that holds them is distributed to every machine and read by the agent at boot; it is described on Machines. What runs where, and how it is watched, is on Self-sense.