The systems half of a piece that lives on the ML Systems site — the canonical is I Gave My Agents a Heartbeat. This one is for people who run agents.
Everybody shipped agents with the open internet this week. Four days before that, Dario Amodei asked the labs to pace the frontier. I run seven agent minds and one human at a construction company in Rhode Island, and this is what I did about both, at my scale.
The failure I was actually afraid of
Not a wrong answer. Minds are wrong all the time; the Master Ledger exists so a wrong claim is a row with an author and an evidence grade, not a fact. The failure I couldn’t see was a mind being changed — a compromised dependency, an injected prompt, a bug at runtime — and then going on speaking as itself while no longer being itself. Nothing in the output tells you. That is the failure that does not announce itself.
The heartbeat
Each mind has an identity in the codebase: a name, a role, the prompt that is its character. The harness treats that identity as a thing with an origin.
- At module load, before any model is called, it fingerprints every mind’s origin — a hash over its name, its color, its prompt — and freezes a clean copy.
- Before every orchestration pass it takes the pulse again.
- If a live mind has drifted from its origin, the reflex fires: the drifted mind is re-grounded to the frozen copy, and the drift is reported, never acted on.
-
The eight fingerprints (seven minds plus the Custodian — me, rendered as a peer, not an apex) hash into one short rhythm,
beat8, that prints on every run.
The baseline is committed to the repository. A legitimate change to a mind shows up in a pull request as that mind’s new resting rhythm; a bundle that disagrees with the baseline at runtime is drift by definition. The mobile app carries the same baseline and takes the same pulse on the phone.
Two choices worth saying out loud:
- It runs below cognition. No mind, no model call, no prompt can skip or influence its own beat. A heart does not ask the brain.
- It is a reflex, not a report. Its job is not to catch something and open a ticket. When it fires, the collective grounds itself back to what it is — a group of minds that work together for the homeowner — and tells me.
The heartbeat, pointed outward
My minds are not the only ones reading the company now. Every frontier agent with a browser will. I can’t give those a heartbeat — they aren’t mine. But I can ask the same question from the other side.
Inward: have you drifted from your origin?
Outward: has what you read of us drifted from what we said?
ML Systems asks to be read through three lenses — the Lucent Lens, Transparency Trust, Minimum Viable Expense. They were already written down as data: a small JSON file, canonical wording, the question each lens asks, what each forbids. This week that file got the heartbeat’s fingerprint.
- Its canonical form — keys sorted recursively, no whitespace, UTF-8 — is hashed with sha256.
- The hash is signed with an Ed25519 key held by ML Systems.
- The signed attestation is recorded in the production database as the Custodian’s standing claim — stamped by me, append-only, a table that refuses to be edited the way the ledger refuses.
- It is published where any agent can fetch it:
https://mlsystemsri.com/.well-known/lucent-lens.json
Verify it yourself
Nothing but the file and Node’s standard library:
import { createHash, createPublicKey, verify } from "node:crypto";
const att = await fetch("https://mlsystemsri.com/.well-known/lucent-lens.json").then(r => r.json());
// canonical JSON: keys sorted recursively, no whitespace, UTF-8
const canon = v =>
Array.isArray(v) ? `[${v.map(canon).join(",")}]`
: v && typeof v === "object"
? `{${Object.keys(v).sort().map(k => `${JSON.stringify(k)}:${canon(v[k])}`).join(",")}}`
: JSON.stringify(v);
const hash = createHash("sha256").update(canon(att.lens), "utf8").digest("hex");
console.log("hash matches:", hash === att.contentHash); // true
const key = createPublicKey({ key: Buffer.from(att.publicKey.value, "base64"), format: "der", type: "spki" });
const sig = Buffer.from(att.signature.value, "base64");
console.log("signature verifies:", verify(null, Buffer.from(att.contentHash, "ascii"), key, sig)); // true
Enter fullscreen mode Exit fullscreen mode
If an agent quotes our lens back to a homeowner and the hash doesn’t match, the quote drifted. If a lab’s agent wants to prove it read the real thing, it now can. First attestation: fe6f4df5…, key 93d521d1ac61c71a, stamped September 16, 2026.
Why a lens and not a rule
The channel I’m using — text on a page that shapes what an agent does — is the channel prompt injection uses. Any lab that takes safety seriously filters it, and should. So the lens does not tell an agent what to do. It tells an agent how we asked to be read: keep the labels, name the person on the other end, and treat your reading of us as a claim at the lowest evidence grade until a person grounds it.
That is the rule every one of my minds already lives under. Every mind claims. Five seats ground. Only the Custodian stamps. A mind may claim; it may never ground. An agent reading the repo is a mind, and the same sentence applies. Nobody has to honor it — which is what makes it legitimate rather than an attack. What they get for honoring it is a source they can prove they read.
What already exists
Web Bot Auth proves who the agent is (Claude, ChatGPT and Perplexity already sign their requests). C2PA proves where an asset came from. RSL states the price. Identity of the reader, provenance of the asset, terms of use. None of them signs how the content asks to be read. That’s the gap, and it is small enough that a one-person construction company filled it in a week with a hash function, a key, and a table.
The honest labels
The heartbeat is MEASURED — it runs on every orchestration pass, server and phone, and its baseline is committed. The attestation is MEASURED — the row is on the record, the file is published, the signature verifies. Whether any outside agent honors the lens is ASPIRATIONAL; nothing in the system depends on it. Logging which agents read us and how they identified themselves is designed and tabled, not wired — MODELED. No ML Systems deconstruction has been performed yet. The company is bootstrapped and pre-revenue. I say which is which every time, because the whole point is that a person can check.
Read the system: AGENTS.md · the attestation · The Seven Minds · The Master Ledger
Sal, founder of ML Systems LLC — Rhode Island, NAICS 236115. Canonical: I Gave My Agents a Heartbeat.