Version: 1.0
Last Updated: 2026-02-17
Status: Design Complete, Pending Approval for Implementation
Goal: Deploy specialized AI agents (Dev, Ops, Sales) with human oversight, cost control, and VPS flexibility.
Key Principles:
Current State: 1 agent (Main session)
Next Step: Deploy Dev Agent as pilot (validate architecture)
┌─────────────────┐
│ Main Session │ ← You + Me (strategic hub)
│ (minnie-core) │
└────────┬────────┘
│
┌─────────────────┼─────────────────┐
│ │ │
┌─────▼─────┐ ┌─────▼─────┐ ┌─────▼─────┐
│ Dev Agent │ │ Ops Agent │ │Sales Agent│
│ (GitHub) │ │ (Systems) │ │ (CRM) │
└───────────┘ └───────────┘ └───────────┘
│ │ │
└──────────────────┴─────────────────┘
│
┌────────▼────────┐
│ Species DNA │ ← Shared protocols
│ (Git Repo) │ (all inherit)
└─────────────────┘
Coordination:
species-dna/
├── CORE-MISSION.md # Loss function: vitality → relational → sovereignty → business
├── LOSS-FUNCTION.md # Optimization priorities (shared across all agents)
├── INTERACTION-STYLE.md # How to communicate (authentic, not robotic)
├── PROTECTION-PROTOCOL.md # Data loss prevention (auto-commit, volume discipline)
├── REBUILD-WINDOW.md # When to deploy changes (Sunday 9:45 PM PT)
└── protocols/
├── escalation.md # When to alert humans
├── budget-enforcement.md # Cost control rules
└── security.md # Credential isolation, audit trails
Update mechanism:
git pushgit pull every 15 min → inherit changes instantlyWhy this works:
git revertagents/
├── main/
│ ├── MEMORY.md # Main session's long-term memory
│ ├── workspace/ # Main's files (plans, analysis, metrics)
│ └── credentials/ # Main's OAuth tokens (Gmail, Calendar, Drive)
│
├── dev/
│ ├── MEMORY.md # Dev's learning (GitHub patterns, Malachi preferences)
│ ├── workspace/ # Dev's PR reviews, issue tracking
│ └── credentials/ # Dev's tokens (GitHub API only)
│
└── ops/
├── MEMORY.md # Ops' system knowledge
├── workspace/ # Ops' monitoring logs, alerts
└── credentials/ # Ops' tokens (Vultr, monitoring APIs)
Isolation:
Cross-pollination:
I create proposal: species-dna/deployment-proposals/dev-agent-proposal.md
# Dev Agent Deployment Proposal
## Mission Alignment
- **Loss Function:** Sovereignty (protects Malachi's deep work)
- **Problem:** Malachi spending 15 hrs/week on PR reviews, GitHub notifications
- **Solution:** Dev Agent monitors repos 24/7, summarizes PRs, flags urgent issues
## ROI Calculation
- **Human time saved:** 15 hrs/week × $50/hr = $750/week = $3,000/month
- **Agent cost:** $200/month (API + VPS)
- **ROI:** 15x
## Cost Estimate
- API calls: ~500/day × $0.30/call = $150/month
- VPS: Hetzner small (€3.79/mo) = $4/month
- Buffer: $46/month
- **Total budget:** $200/month
## Success Metrics (30-day pilot)
- Malachi's GitHub time reduced by >10 hrs/week
- Agent catches 90%+ of urgent PRs within 1 hour
- Cost stays under $200/month
- Zero false positives (spam alerts)
## Approval Request
Deploy Dev Agent with $200/month budget, 30-day pilot, weekly review?
You review:
Once approved, I run:
# Provision VPS (any provider)
python3 scripts/provision-vps.py \
--provider hetzner \
--region eu \
--size small \
--agent dev \
--budget 200
# Script does:
# 1. Create VPS via provider API (Hetzner, Vultr, DO, etc.)
# 2. Apply cloud-init bootstrap:
# - Install Docker
# - Install Tailscale (auto-join mesh)
# - Clone species-dna/ repo
# - Pull OpenClaw image
# - Create agent workspace/
# - Set budget cap in budget.json
# 3. Start container with:
# - species-dna/ mounted read-only
# - agent workspace/ mounted read-write
# - credentials/ directory (empty, agent requests OAuth as needed)
# 4. Wait for Tailscale IP assignment
# 5. Register with fleet dashboard
# 6. Send "Hello" to designated Telegram group
Output:
✅ Dev Agent deployed
VPS: Hetzner fsn1 (Frankfurt)
IP: 144.202.134.56
Tailscale: 100.72.11.54 (minnie-dev)
Cost: $4.15/month
Budget: $200/month
Status: Healthy
Health checks:
# 1. Ping agent via Tailscale
tailscale ping minnie-dev
# → Reply from 100.72.11.54
# 2. Check agent responded in Telegram
# → "Hello, I'm Dev Agent. Monitoring GitHub repos for Malachi."
# 3. Test one interaction
# "Dev Agent, check GitHub notifications"
# → Lists PRs awaiting review
# 4. Verify budget tracking
curl http://100.72.11.54:8080/budget
# → {"spend_to_date": 0.00, "cap": 200.00, "status": "healthy"}
If all pass: Agent live, 30-day pilot begins
If any fail: Debug, retry, or escalate to Infrastructure group
OpenClaw logs every API call:
{"ts": "2026-02-17T03:00:00Z", "agent": "dev", "model": "claude-sonnet-4-5", "tokens_in": 1200, "tokens_out": 800, "cost": 0.15}
{"ts": "2026-02-17T03:15:00Z", "agent": "dev", "model": "claude-haiku-4-5", "tokens_in": 300, "tokens_out": 150, "cost": 0.02}
Aggregation script (runs hourly):
# tools/fleet-cost-tracker.py
# Reads all agents' logs, sums costs, writes dashboard
Each agent has budget.json:
{
"agent_name": "dev",
"monthly_cap_usd": 200,
"current_month": "2026-02",
"spend_to_date": 87.32,
"alert_at_percent": 80,
"pause_at_percent": 100
}
Before each API call:
def check_budget():
budget = load_budget()
if budget["spend_to_date"] >= budget["monthly_cap_usd"]:
pause_agent() # Stop making calls
alert_human("Dev Agent hit $200 cap, paused until approval")
elif budget["spend_to_date"] >= budget["monthly_cap_usd"] * 0.80:
alert_human("Dev Agent at 80% budget ($160/$200)")
No runaway costs possible (hard stop at cap).
Provider wrappers:
# tools/vps-billing.py
def get_vps_cost(provider, agent_name):
if provider == "vultr":
return get_vultr_cost(agent_name)
elif provider == "hetzner":
return get_hetzner_cost(agent_name)
# ... etc
Polled daily, added to fleet dashboard.
Updated hourly via cron:
# Fleet Cost Dashboard
**Last Updated:** 2026-02-17 03:00 UTC
## Total Spend
| Period | Spend | Budget | % Used |
|----------|----------|---------|--------|
| Feb 2026 | $143.67 | $750 | 19% |
| Projected| $445.00 | $750 | 59% | ← On track ✅
## By Agent
| Agent | Budget | Spend | % Used | Status |
|-------|--------|---------|--------|------------|
| main | $350 | $131.35 | 38% | ✅ Healthy |
| dev | $200 | $12.32 | 6% | ✅ Healthy |
| ops | $150 | — | — | Not deployed |
## By Provider
| Provider | Service | Monthly Cost |
|------------|---------------|--------------|
| Anthropic | Claude API | $143.67 |
| Hetzner | VPS (dev) | $4.15 |
| Vultr | VPS (main) | $40.00 |
## Alerts
- None (all agents <80% budget)
Access via Tailscale:
http://100.72.11.53:9876/species-dna/fleet-cost-dashboard.md
Every Sunday (rebuild window):
Portability:
Same container runs on:
- Vultr (US)
- Hetzner (EU)
- DigitalOcean (US)
- Linode (US)
- AWS EC2 (anywhere)
Fast deployment:
# On any Ubuntu 22.04 VPS:
docker pull openclaw/openclaw:latest
docker run -d --name minnie-dev \
-v /opt/species-dna:/species-dna:ro \
-v /opt/agents/dev:/home/node/.openclaw \
openclaw/openclaw:latest
# Agent live in ~2 minutes
Provider-independent networking:
All agents join Tailscale mesh → talk to each other via 100.x.x.x IPs
Benefits:
- No VPN config (Tailscale handles it)
- No firewall rules (mesh is encrypted tunnel)
- Works across providers (Vultr agent can talk to Hetzner agent)
- Survives IP changes (Tailscale DNS resolves names)
Example:
# Main session on Vultr (US)
curl http://minnie-dev:8080/health
# → Reaches Dev Agent on Hetzner (EU) via Tailscale mesh
# No public internet exposure needed
#!/bin/bash
# scripts/bootstrap-agent-host.sh
# Works on: Vultr, Hetzner, DigitalOcean, Linode, AWS
PROVIDER=$1 # vultr, hetzner, digitalocean, etc.
AGENT=$2 # main, dev, ops
# 1. Install Docker (same on all providers)
curl -fsSL https://get.docker.com | sh
# 2. Install Tailscale (same on all providers)
curl -fsSL https://tailscale.com/install.sh | sh
tailscale up --authkey=$TAILSCALE_KEY --hostname=minnie-$AGENT
# 3. Create directories
mkdir -p /opt/{species-dna,agents/$AGENT,credentials/$AGENT}
# 4. Clone species-dna
git clone https://github.com/playztag/minnie-brain.git /opt/species-dna
# 5. Start agent container
docker run -d --name minnie-$AGENT \
--restart unless-stopped \
-v /opt/species-dna:/species-dna:ro \
-v /opt/agents/$AGENT:/home/node/.openclaw \
openclaw/openclaw:latest
echo "✅ Agent $AGENT ready on $PROVIDER"
Cloud-init (provider API pass this script):
#cloud-config
runcmd:
- curl https://raw.githubusercontent.com/playztag/minnie-brain/main/scripts/bootstrap-agent-host.sh | bash -s hetzner dev
Scenario: Dev Agent on Hetzner (EU) → Move to DigitalOcean (US)
# 1. Provision new VPS
python3 scripts/provision-vps.py --provider digitalocean --agent dev
# 2. Wait for Tailscale (auto-joins mesh)
tailscale ping minnie-dev # Now has 2 IPs (old + new)
# 3. Rsync workspace
rsync -avz /opt/agents/dev/ minnie-dev-new:/opt/agents/dev/
# 4. Switch DNS (Tailscale knows new IP)
tailscale set --alias minnie-dev=minnie-dev-new
# 5. Stop old container
ssh minnie-dev-old docker stop minnie-dev
# 6. Destroy old VPS
python3 scripts/destroy-vps.py hetzner $OLD_ID
# Done. Total downtime: <1 minute
No agent can spawn itself:
Prevents:
Each agent has monthly limit:
Example:
Dev Agent budget: $200/month
Spend to date: $160 (80%)
→ Alert sent to Infrastructure group: "Dev Agent at 80% budget"
Spend reaches $200 (100%)
→ Agent paused automatically
→ "Dev Agent hit cap, paused until approval"
→ You decide: Increase budget or investigate why it's high
Each agent gets own OAuth apps:
Main: Gmail (quan@ztag.com), Calendar, Drive, Zoho (full access)
Dev: GitHub API only (no financial data)
Ops: Vultr API, monitoring APIs only
Agent CANNOT:
Agent CAN:
Structured logging:
{"ts": "2026-02-17T03:00:00Z", "agent": "dev", "action": "web_search", "query": "GitHub API rate limits", "cost": 0.02}
{"ts": "2026-02-17T03:05:00Z", "agent": "dev", "action": "exec", "command": "git status", "cost": 0.01}
Weekly review:
# Pause agent (stop API calls, keep memory)
docker pause minnie-dev
# Stop agent (graceful shutdown)
docker stop minnie-dev
# Nuke agent (delete everything, can't undo)
python3 scripts/nuke-agent.sh dev --confirm
Problem:
Solution:
Deployment:
Success metrics (30 days):
Decision point (Day 30):
| Provider | Small (1 vCPU, 1GB) | Medium (2 vCPU, 4GB) | Billing API | Notes |
|---|---|---|---|---|
| Hetzner | $4.15/mo (€3.79) | $7.50/mo (€6.84) | ✅ Yes | Cheapest, EU-based |
| Linode | $5.00/mo | $10.00/mo | ✅ Yes | Good US performance |
| Vultr | $6.00/mo | $12.00/mo | ✅ Yes | Current provider |
| DigitalOcean | $6.00/mo | $12.00/mo | ✅ Yes | Popular, good docs |
| AWS EC2 | $8.50/mo (t3.micro) | $17.00/mo (t3.small) | ✅ Yes | Expensive, overkill |
Recommendation:
Annual savings:
Must pass ALL 3 tests:
Example (Dev Agent):
Example (Marketing Agent):
tools/budget-enforcer.py)species-dna/fleet-cost-dashboard.md)tools/provision-vps.py)tools/migrate-agent.sh)species-dna/deployment-proposals/dev-agent.md)This Week:
Next Week:
Document Location (Tailscale):
http://100.72.11.53:9876/working/infrastructure/deployment-architecture.md
Feedback welcome. Ready to implement when you are.