c AI j .me

Own the work. Cage the animal.

Your goals, your evidence, your approvals, your run history — durable, auditable, on hardware you control. Every model and agent is a replaceable worker inside the cage.

UNLOCK ME UNLOCK IDEA
01 / THE PROBLEM

Right now, your work lives in someone else's session.

The work, the memory, the context, the approvals — they live inside a vendor's chat session or an opaque autonomous agent. When the session ends or the vendor changes, the state evaporates.

There is no owned, queryable record of what was done, by whom, with what evidence, at what cost. You are renting your own operation back from the tools.

02 / THE ANSWER

cAIj drives the work in flight.
Parking it safely between hops.

Goals, standards, permission boundaries, proof-of-done, execution history — all live in cAIj. Models, CLIs, SaaS tools, and autonomous agents are hot-swappable components bound to that state. Never the source of truth.

03 / WHERE IT SITS

Not a tracker. Not a harness. The cage between them.

TRACKER
Describes the work
Its "done" is advisory. It tracks; it cannot refuse.
→
cAIj
Governs the work
Decides whether an agent's work is allowed to count as done. Records why. Answers to you.
⇆
HARNESS
Runs the agent
Model, context, tools. Replaceable on demand.
04 / THE BARS OF THE CAGE

Six things no vendor can take away.

no_model_on_critical_path
No AI decides what counts
The system runs on deterministic code and durable state — never on an agent's context window or memory. What is permitted, admitted, and closed out is decided the same way every time. The model works inside the cage — it never holds the lock.
local_first
Works when the cloud doesn't
State lives in a local database on hardware you own. No vendor, no internet, no problem — safe work continues.
audit_everything
Every decision leaves a record
Every state change is backed by durable evidence. Every approval names a person. Nothing converges by vibes.
swap_any_worker
Fire any model, any time
Humans, scripts, and agents bind to the same contract: packet in, evidence out. Swapping the worker changes nothing about the work record.
fuel_gauge
Tokens are the fuel
Any task that burns tokens has them and their associated costs metered at every step — per agent, per run, rolled up to the total. Partially-known work can never read as free.
fail_closed
Doubt means no
Missing evidence, expired permissions, anything unexpected — the cage refuses rather than silently proceeding.
05 / HOW IT RUNS

One front door. As easy as a phone.

Submit work, see status, approve, inspect — with no copy-paste coordination between tools. Handoffs move as governed context packets, not pasted transcripts.

1 · SUBMIT
Hand cAIj the goal. It becomes an owned, durable task — not a chat message.
2 · RUN
A worker — model, script, or human — gets a bounded packet of context and permissions. Nothing more.
3 · PROVE
Work comes back as evidence: artifacts, tests, receipts. Claims without proof don't move state.
4 · APPROVE
You gate what matters, from anywhere. "Done" is something the cage grants — never something an agent declares.
06 / CAGE RULES

Rules no agent can talk its way out of.

R1
No self-escalation. An agent cannot grant itself permissions, jump roles, or deploy because a prompt said so.
R2
Authority is a key, not a title. Every actor holds only issued, expiring grants. No standing credentials. No "trust me."
R3
External effects queue first. Sends, deploys, and purchases are recorded, policy-checked, and recoverable before anything goes live.
R4
The guard and the guarded never share a machine. The control plane holds no agents, no models, no worker credentials.
R5
Big decisions need two independent opinions. High-risk calls get adversarial confirmation — never one agent one-shotting them.
FOR BUILDERS
Run a shop of agents that answer to one front door. Delegate hard, sleep fine.
FOR ENTERPRISES
Governance can't be bolted on later. Audit trails, approvals, and permission boundaries are the substrate — not a compliance afterthought.
FOR INVESTORS
Every company running agents will need the layer that decides what counts as done. That layer is a category, and it's empty.

Your cAIj is waiting,