All projects
AI Infrastructure · Case Study 01

24 channels. One database. One human gate.

Wiring a model to your accounts is the easy part. Making it cheap enough to run every fifteen minutes, and safe enough to let near a real inbox. That is the whole project.

24 channels arrive 1 store, single writer 1 record per person out
Python · SQLite · launchd 119,065 lines · 228 files 839 commits in 26 days Built solo · 2026

Twenty four places a message can arrive.

Each one is a kernel. Each kernel exposes named verbs. Nothing here is a screenshot of a dashboard. It is the fleet.

iMessage
WhatsApp
Telegram
WeChat 微信
WeCom 企业微信
LinkedIn
Instagram
X
Threads
TikTok
Xiaohongshu 小红书
Reddit
YouTube
Gmail
Google Calendar
Luma
Partiful
JD.com 京东
Taobao 淘宝
千瓜 Qiangua
Seeking Alpha
ATS boards
Dropbox
Framer

Telegram runs two ways: a bot and a personal MTProto session. Gmail carries four OAuth personas.

24
Channels in
263
Automations
0
Tokens per read
41
Security invariants, checked by machine

One calm screen on top of all of it.

Twenty four channels resolve into a single queue: what needs her, in one place, in the order it should be answered. One row per person, not per channel, and the phone is the approval door.

9:41
Needs you
苏明11:12
排期表我这周发你
ME
Mara Ellis13:12
Do you still have the replay link?
DK
Daniel KoFri
Hi Jenny, how are you?
Sarah WhitfieldHunter Boots
✻ Bot
LinkedInWeChatGmailDropbox
Account opened March 2024. Tmall and JD storefronts, three campaigns since. Latest file is the SS26 deck.
Hi Sarah, we opened March 2024. Tmall and JD, three campaigns. Storefront sits with us.
Thu 12 June · LinkedIn
Good to meet you at the Shanghai show.
You too. I'll send the China deck this week.
Mon 21 July · WeChat
quick one, are we still live on JD?
Yes, JD and Tmall both running.
Today · Gmail
Can you send what we've run in China since we opened? The board reviews it tomorrow.
Also, who owns the Tmall storefront on our side?
Message
Send
Arrives

A brand emails. Twenty four channels, one row per person.

Opens

The whole history is there, whichever channel each part of it came in on.

You ask

Ask it about the account in plain words. Nothing typed here can reach the customer.

It reads

Dropbox and all three channels. It answers from what it actually opened, then hands a draft down into the box.

She sends

And it stops there. Nothing leaves until she taps it.

The queue is assembled by verbs, not by a model reading inboxes. Every item that would leave the system stops here and waits for a tap.

A verb is a Python call. It costs zero tokens.

verb (n.) a deterministic function on a kernel. Same input, same output, no model in the path.

99 act
164 read
263 verbs across 27 kernelsgenerated from each kernel's spec

164 of the 263 verbs are reads. Reads are where the token bill accumulates in an agent-shaped system, and reads are exactly what a deterministic call does for free. That is the whole trade. It is also why the loop can run every fifteen minutes instead of once, when you remember to ask.

LAW 01
The law lives in the code that performs the act.

No external watcher, no hook, no policy file. The constraint is compiled into the verb itself and shaped to the specific irreversible action: a structural sendUpdates=none on every calendar write, a Luma write function that simply does not exist, an approval hash check on every send path, a POST_ALLOWED env gate on public posts.

LAW 02
Resolve, don't remember.

No file ever records which machine or host a channel lives on. Every call re-asks the live session, through the authenticated same-origin API, never the rendered DOM, which the docs call a rumour. A written-down location is a photograph of a moving thing.

LAW 03
Nothing sends without a human grant.

Not a setting. Not a default that can be flipped in a config. One shared, fail-closed gate is the only way out of the system: every send hashes its whole payload, spends the grant once, and resolves every ambiguous state to not approved.

LAW 04
Every proven flow becomes a named verb.

A click path that works once in a throwaway script is a violation, not a deliverable, until it is promoted into kernel.py. That rule is why the count is 263 and not a folder of scripts nobody can call twice.

Every channel writes into one store.

messages.db. One SQLite file, single writer. Twenty four inboxes stop being twenty four inboxes at the moment they land in the same table.

Alongside it, accounts.json is an expected-identity registry, not a credential store. It answers "which of her personas should be logged in here," and nothing else.

Forty one invariants. One of them is the wall.

Security here is not a posture, it is a registry. Every rule this system must never break is written down, numbered, and checked by a machine, including nine non-capabilities: things it is forbidden to ever grow.

41
Named invariants
7
Families
9
Non-capabilities
26
Pass floor, committed
A · credentialsB · untrusted contentC · the human grantD · identity & blast radiusE · panicF · auditG · code & execution integrity

The floor is the part that matters. 26 lives in a committed file, and the suite fails if fewer than 26 pass, so loosening the standard means typing a smaller number into version control on purpose. A check that has ever passed may never quietly fail again.

One store. Many readers.

The messenger is one reader sitting on top of the store, not the thing itself. This is where the same store goes. Events, market research, outbound, and the video engine, which renders a cut and then publishes it back out through the same channels and the same gate as every other send.

Adding a system means writing a reader, never a second database. That is the whole reason the store is the product and the inbox is only the first thing built on it.

The hard parts were the consent layer and the token economics.

Everyone can wire a model to a tool. Those two are what stand between a company and pointing an agent at real customer accounts, and they are the two that got built here first.

PythonSQLitelaunchd27 kernels263 verbsOne repoBuilt solo