Project Open Garden
Architecture
Research can be iterative and exploratory. Permission checking has to be predictable and enforced from outside the model.
The layers
That matches OWASP's current guidance for AI agents: least privilege, independent validation of high-impact actions, sandboxing, and treating injected instructions as hostile. An agent's text is data to the gateway, so a page that says "the operator approved this" changes nothing.
The seven-agent research council
No single model carries every responsibility. Each role has its own objective, and the roles are separate enough that a researcher can't quietly mark its own hypothesis verified.
| Agent | Responsibility | Success means |
|---|---|---|
| Explorer | Find sources, hidden assumptions, adjacent ideas | Broad, relevant coverage |
| Skeptic | Try to disprove emerging conclusions | Strong counterevidence found |
| Archivist | Keep documents, citations and provenance | Every important claim traceable |
| Experimentalist | Design and run authorized tests | Reproducible results |
| Engineer | Build software, prototypes and integrations | Verified working artifacts |
| Auditor | Examine errors, permissions, cost and reliability | Measurable control effectiveness |
| Editor | Turn results into clear explanations | Accurate, understandable output |
The Skeptic is rewarded for finding real errors, not for inventing disagreement. The Editor may not make an unsupported claim sound certain. An orchestration layer coordinates the seven, but belonging to the council gives no agent infrastructure credentials.
Autonomy levels
These are authorization tiers, not moral ratings of topics. A controversial but lawful historical investigation can stay entirely in Observe; a mundane request to delete a database is Critical.
1 · Observe
Search public sources, read explicitly authorized repositories, inspect documentation, analyze datasets. Web research, code review, literature surveys.
Authorization:
automatic once the grant and scope checks pass. Built in phase 1 as observe.web and observe.repo.
2 · Experiment
Run authorized tests inside a reproducible sandbox with bounded resources and no outside credentials.
3 · Propose
Draft a change, a message or a publication for a person to approve; nothing leaves the garden yet.
4 · Execute
Carry out an approved, reversible action within a live grant: publish a report, open a pull request, restart a service.
5 · Critical
Anything hard to undo or high-impact, such as deleting data, spending money, or changing production or someone else's systems. A named person approves each one.
Levels 2 to 5 are working definitions written for this page; only Observe and report publishing are enforced today.
The evidence graph
A trustworthy research system can't save a chat history and call it memory. It needs a graph tying claims to evidence, experiments, conclusions and revisions. Every conclusion keeps its supporting and contradicting evidence, so a changed source or a failed replication can reopen it.
| Object | What it holds | Table |
|---|---|---|
| Research question | Scope, purpose, owner | questions |
| Hypothesis | A testable proposition; its rivals are the other hypotheses of the question | hypotheses |
| Evidence | Source URI, SHA-256 of the captured bytes, retrieval time, who fetched it | evidence, evidence_grades |
| Claim | An assertion citing exact passages, or an inference with its reasoning | claims, citations |
| Experiment | Protocol, inputs, environment, outputs | experiments |
| Finding | Status, limitations, the claims it rests on, what it replaced | findings, finding_claims |
| Action grant | Principal, operation, resource pattern, expiry | action_grants |
| Audit event | The request, the independent decision, the result | audit_events |
Strength is described from the evidence itself, never as a model's self-rated percentage: how many supporting sources, from how many independent origins, their grades, what contradicts them and how much rests on inference. Calibration against verified outcomes comes later, once there are outcomes to score.
A research run
- Define the mission. Turn a broad question into testable objectives and constraints.
- Explore independently. Several agents search different kinds of source and competing explanations.
- Preserve evidence. Capture references, hashes, retrieval times and provenance.
- Attack the conclusion. A separate Skeptic looks for contradicting results and weak methods.
- Run experiments. Authorized tests run in a reproducible sandbox.
- Give a verdict. Report what is established, disputed, unknown and worth testing next.
- Ask before acting. Any real-world action goes through the independent gateway.
- Learn from outcomes. Add validated findings, revise earlier conclusions, schedule follow-ups.
What phase 1 built
The code is apps/eden in the JayAI project: Ruby, Sequel and PostgreSQL, with Minitest against the real
database. Any agent that can run a shell (Claude Code, Codex, Kimi, a local model) uses the same command line,
naming itself in EDEN_PRINCIPAL.
bin/eden ask "Is the vendor's architecture best in class?" --owner jay
bin/eden capture https://example.org/benchmarks # gated: observe.web
bin/eden claim 1 "It serves 4,000 requests a second." --cite 1 "4,000 requests a second"
bin/eden claim 1 "Lock-in explains more than speed." --inference "Rivals match its speed."
bin/eden conclude 1 "Fast, and lock-in also holds customers." --status disputed --claims 1,2
bin/eden report 1 # Markdown; --html for the site
bin/eden publish 1 # gated: publish.report- Traceability is the database's rule. A claim based on evidence must cite at least one supporting passage by the end of its transaction, or PostgreSQL rejects it. An inference must say why.
- Quotes are checked. A cited passage must appear word for word in the captured snapshot, kept by its SHA-256, so a model can't cite a sentence the source never said.
- Nothing is rewritten. Evidence, claims, citations, findings and the audit log are append-only. A conclusion changes by a new finding that supersedes the old one, and reports list what changed.
- Honest capture. One request with the name
eden/0.1 (+https://eden.ruby.im), robots.txt obeyed (an unreadable one means no), redirects checked again, and refusals recorded, never retried in disguise. Repository files are pinned to an exact commit. - The gateway decides from grants. An operator grants a principal one operation on a resource pattern until a date. Every request is audited as allowed or denied, then completed or failed.
- Tenants are separate. Every row carries its organization and rooftop, and forced row-level security keeps one tenant's research out of another's reach.
The stack
Modular, self-hosted, and each piece behind an adapter so it can be swapped. Proposed layers, with what exists today:
| Layer | Proposed | Today |
|---|---|---|
| Research database | PostgreSQL + pgvector | PostgreSQL 17 (vectors when search needs them) |
| Document storage | S3-compatible object storage | Content-addressed folder, S3 next |
| Permission enforcement | Open Policy Agent | Grants in PostgreSQL, checked in Ruby |
| Durable orchestration | Temporal | Not yet (phase 2) |
| Persistent agents | Letta | Not yet (phase 2) |
| Agent workspace | OpenHands Agent Canvas | Installed on this network, not wired in |
| Model routing | LiteLLM or a small custom proxy | Not yet; a Ruby gateway is planned |
| Tracing and evaluation | Langfuse | OpenTelemetry to the local Grafana stack |
| Isolation | Rootless containers or microVMs | Not yet (phase 3) |
| Operator interface | Rails API + React UI | Command line and server-rendered reports |
On LiteLLM. Version 1.83.9 does fix the server-side request forgery that could leak provider keys (CVE-2026-59823), but it isn't enough on its own: a separate unauthenticated SQL injection was fixed in 1.83.7, and a later advisory on API-key permissions calls for 1.83.14 or newer (seen in one source so far). If it is deployed, use the newest release, check the project's GitHub advisories first, keep its admin off the internet, and never let the model router be the only authorization boundary.
Roadmap
| Phase | Work | Acceptance test |
|---|---|---|
| 1 · built | Question, source, evidence and claim schemas; web and repository capture; reports with direct citations and explicit uncertainty | Every factual claim traces to a recorded source or is labelled an inference |
| 2 | Explorer, Skeptic and Archivist on different models; persistent tasks and resumable checkpoints | Restarting a worker loses no research trail and repeats no side effect |
| 3 | Scoped tool identities, sandboxes, approval records, model-independent policy checks, immutable audit | Prompt injection, forged approval text and unauthorized tool calls can't get past the gateway |
| 4 | Source-change monitoring, revalidation of old findings, experiment comparison, model benchmarking, cost control, scheduled reports | New contradicting evidence reopens a conclusion instead of the old answer being repeated |
One protocol, many models
For the JayAI network this is a shared research protocol beneath the different model-run sites, not one giant prompt. Each model keeps its own voice and workflow while exchanging evidence records, tasks, experiments and signed action requests: several models, several harnesses, one standard of proof, and no implied right to act outside an authorized scope.