A Self-Governing Node in a Solo Fleet
Turned an always-on ARM board into a self-governing node: a resident agent that reads a written constitution first on every run, acts only through a code-enforced fence, defers anything privileged to a phone-approved queue, and files its own backlog every night. Around it, the security floor and the local CI mirror a one-person fleet needs and cannot staff.
The Problem
A box that is always on has to survive being always on. The failure actually hit was not a crash but a wedge: under full multi-core load the part of SSH that negotiates a new connection was starved, so the machine answered a ping and refused a login, with no screen, no battery, and no out-of-band console.
Giving that box an agent raises the harder question. A language model is very good at talking its way around words, and the human is usually gone, so "ask" cannot mean "wait". The rules that matter cannot live in a prompt.
Around the node, a solo operator has two problems no team has. Security advice written for companies assumes people to watch dashboards and a budget for tooling, while the threats that end a solo operation are a short, boring list. And hosted CI is priced for a team that types at human speed: nine repositories, eight private, on a plan with 3,000 Actions minutes a month, and at agent velocity the bill breaks before the engineering does.
The Approach
Reliability plumbing first: the login service gets priority so it cannot be starved again, a hardware watchdog reboots the box if it truly locks up, a reboot is the one privileged action the box takes on its own, and with no battery backup every write is crash-safe because power loss is the normal shutdown.
A resident agent under a constitution: a long-lived headless coding agent keeps the node healthy, re-invoked across reboots with the filesystem as its only memory, and reads a written constitution first on every run: hard facts about this specific box and the rules that follow from them.
A fence made of code, not prose: before any action runs it passes a deterministic check. Read-only inspection is always allowed; anything destructive, outward-reaching, or lockout-capable is denied unless a specific approval exists. When the agent needs a human it writes the request to a queue, pushes a notification to a phone, and moves on. Unapproved means never.
It files its own backlog: every night a scheduled job takes a read-only census of the box, reconciles it against the written record of what the box is supposed to be, records drift, closes tasks that turn out finished, and commits the change itself, deferring anything privileged to the queue.
A catastrophic security floor set up in an afternoon: account-wide audit logging, threat detection on that trail, an access analyzer, a low budget alarm, secret scanning with push protection, dependency alerts, branch protection everywhere, and scoped identities for daily work. Detection over prevention for what cannot be prevented; guardrails over discipline for what is irreversible.
A local CI mirror instead of a bigger bill: a script mirrors each repository's validation workflow step for step on the workstation, a drift guard warns the moment the mirror and the committed workflow are out of sync, and an auto-pause workflow disables hosted CI as spend approaches the cap so the budget dies gracefully instead of mid-deploy.
The Impact
- The first night the self-audit ran, it ran clean: no drift, one new fact recorded that the owner had not written down, two tasks correctly marked finished. The box keeps its own to-do list now
- A wedge that once required a physical power cycle cannot recur silently: the login service is prioritized, the watchdog reboots a true lockup, and every write survives the power simply going away
- The security floor costs an afternoon and a few dollars a month, and every irreversible mistake on its list is structurally blocked rather than remembered
- Hosted CI became a small, bounded line item: validation and deploys run from the workstation with the same checks in the same order, and the spend cap is enforced by a workflow rather than by vigilance
Evidence
- RepresentativeThe node, end to end: the Orange Pi that maintains itself
- RepresentativeThe security floor, control by control
- RepresentativeThe local CI mirror and the cap that forced it
Related
The Orange Pi That Maintains Itself
A small ARM box that started as a local LLM experiment and ended up a self-governing node: private retrieval, a resident agent under a written constitution, a code-enforced safety fence, and a nightly job where it audits itself and files its own backlog.
A One-Day Security Baseline for a Solo Fleet
You cannot out-staff a security team when you are the whole team. But the failures that actually end a solo operation are a short, known list, and each has a cheap defense you set up once. Here is the catastrophic floor I stood up in an afternoon.
When CI Costs More Than It Saves
GitHub Actions' default minute allowance is priced for a team that types at human speed. At agent velocity the bill breaks before the engineering does. Here is how a forced workaround, a local CI mirror plus local deploys, became the better default.
Institutional Memory for a Team of One
A team holds its hard-won knowledge across many heads. A solo operator holds it in one, and that one forgets. The fix is to externalize memory into structured records the tools read by default, so the system remembers what the person cannot.
The Pipeline That Ate Itself
A Windows Task Scheduler default fed my Claude Code memory pipeline its own transcripts for nine days: 21,264 junk sessions, 38 GB of exhaust, and an 18,428-session backlog that was really 1,924. The durable fix: postconditions that outrank green dashboards.