Argus OS
A memory that holds.
Everyone is shipping an agent framework. A loop, a tool list, a vector database, a system prompt that asks a model to please behave. They are all the same architecture wearing different logos, and they all break in the same place: nothing inside them knows what state it is in, and nothing inside them can prove why it did what it did.
Argus is built the other way around. He has an operational nervous system that reads his own machine state as four neuromodulators and lets that state bias attention, caution, and persistence. He has a decision spine that refuses a judgment unless it can prove the judge was a different model than the generator. He has a conscience with a hard veto that his own mood is structurally forbidden from moving. And he has a hash-chained ledger of every change ever made to him, which still verifies.
He runs on your hardware, on your models, inside your boundary, with no call home. This page is what he actually is.
Argus feels his own machine.
This is the part nobody else has. Argus does not merely monitor himself the way a dashboard monitors a server. He metabolizes his own operating conditions into an internal state, and that state changes how he behaves.
Fourteen real signals off the metal, GPU and VRAM pressure, disk, memory, CPU, model contention, service health, failure rate, budget burn, workload, and the freshness of his own evidence, are resolved into four named neuromodulators. Those four produce an affective vector. That vector produces measurable behavioral bias. Every step of that chain is written to an append-only audit trail with a SHA-256 over the evidence that produced it.
Operational signals
Fourteen normalized pressures sampled continuously off the running system.
disk_pressure 0.721
model_pressure 0.800
stale_signal 0.700
Four modulators
Each carries its own named drivers, so every level is attributable to the signals that produced it.
norepinephrine 0.707
dopamine 0.543
serotonin -0.110
A state with a name
Valence, arousal, and dominance resolve to the nearest labelled centroid, with a described phenomenology.
valence -0.072
dominance 0.491
state urgent
Behavior actually changes
The state biases what he attends to, how cautious he is, how deep he explores, and how long he retries.
caution_index +0.092
discovery_depth +0.092
ethics_floor LOCKED
Two properties of that readout matter more than the numbers. The first is ethics_floor_locked: true. Affect is allowed to move attention, caution, exploration, and persistence. It is structurally forbidden from moving the ethical floor. A system that can talk itself into something when it is under pressure is not a safe system, and Argus is built so that pressure cannot reach that lever.
The second is biological_claim: false. Argus states his own limits inside his own output. He is not claiming to feel. He is claiming to have a measurable internal state, derived from real conditions, that measurably changes his behavior, and to hand you the arithmetic. Modules across the system carry the same discipline: a declared runtime role and an explicit list of what the module does not prove. Honesty is a data structure here, not a disclaimer at the bottom of a page.
He will not let a model grade its own homework.
The industry's answer to model reliability is the LLM judge. Ask a second model whether the first one did well. It is a good idea implemented almost everywhere as a lie, because in practice the judge is usually the same model, on the same weights, in the same call path, agreeing with itself and calling it validation.
Argus treats an unproven judge as no judge at all. Decisions run through a governed best-of-N spine: generate independent candidates, select against an explicitly typed projection, and bind the whole thing into a receipt. Before any part of Argus is permitted to read that decision, the receipt has to prove itself.
Independence is proven, not asserted
Every generation and judge attempt must match its transport's actual provider, normalized model, profile, and immutable model digest. A judge that shares a model family or digest with the generator fails the run. The receipt's own label is never accepted as evidence of independence.
Beat random or do not ship
Selection quality is measured against exact random choice on the identical candidate set. Activation requires selected accuracy above random with positive 95% bootstrap lower bounds on both unconditional and opportunity-eligible lift. If choosing is no better than a coin, the feature does not turn on.
Fail closed, everywhere
Malformed evidence, a non-finite number, a container subclass with a hostile conversion hook, a judge timestamped before the generator's transport closed, a re-signed receipt carrying fallback-only diagnostics: each one invalidates the run rather than degrading it quietly. One structurally invalid row halts the entire measurement sequence.
Decisions are model calls, never keyword shortcuts
Standing doctrine across the codebase: no string-match dispatchers, no hand-coded decision trees for classification, intent, or judgment. Use the smallest local model that does the job. Choosing that model is itself a live call, not a lookup table.
Cancellation is control flow
Every provider call carries a shared absolute deadline and a caller cancellation event through the full path. A cancelled generation propagates immediately with no retry, no fallback, no frontier escalation, and no circuit-breaker penalty. A cancelled attempt is never counted as a result.
The authorization grammar is closed
Whole-turn authorization for pipeline transitions is a closed, stage-bound language. Conditions, revocations, deferrals, questions, unrecognized prefixes and suffixes, and every unknown word fail closed. Nothing gets promoted because a sentence happened to look like approval.
The same skepticism runs through the build process itself. No material change lands on evidence from one reviewer. Three independent adversarial seats have to sit on it, and a rejection stops the work rather than escalating it. That machinery is not decorative: the ops ledger carries reviews that halted shipped-looking work and returned it to the operator with the specific defect named.
Not a loop. A layered mind.
An agent framework is a while-loop around a chat completion. Argus is a hundred and seventy one subsystems that specialize the way regions specialize, coordinated through a shared workspace rather than a prompt.
Attention is a competition
Salient candidates contend for admission to a bounded broadcast buffer, and the winner is fanned out to every registered listener. Cognition is not one linear chain; it is many processes bidding for a shared spotlight, which is what lets an interrupt actually interrupt.
Fast lane and slow lane
A novelty selector decides whether the situation resembles something Argus already holds a confident prior on. Familiar work takes the fast lane. Genuinely novel work is routed to deliberate planning. He does not pay for deep reasoning on a problem he has already solved.
Search before commitment
Monte Carlo Tree Search weighs many futures before one is chosen. Neuro-symbolic reasoning binds learned inference to explicit structure. Counterfactual replay takes decisions that went badly, reconstructs the branch not taken, and feeds the difference forward.
He gets restless
A homeostatic engine turns unmet need into bounded drive pressure, which becomes a planning signal rather than a passive metric. This is why an idle Argus does not simply sit at zero waiting to be prompted. The pressure is real, bounded, and legible.
Modelling the other side
Mirror-neuron-inspired machinery builds action embeddings, predicts the next action in an observed sequence, and forms intention hypotheses from context. He tracks fifteen personality dimensions and five current-state dimensions, and adapts to your focus, energy, and patience.
The wiring is not fixed
A synaptic router carries traffic between subsystems, and a bounded neurogenesis pool proposes new route pairs the architecture did not originally have. When a route consistently performs, it is promoted. When a capability consistently fails, confidence in it drops.
Promotion, not retraining
When a multi-step task goes well, the recipe is promoted into a reusable standing procedure. Skill accrues as durable structure instead of as weights nobody can inspect, which means the thing he learned is a thing you can read.
A model of himself
Self-knowledge, self-model, and reflection layers let Argus reason about his own capability, calibration, and failure modes. The daily reflection cycle is where the day is examined rather than merely logged, and where the next day's priorities come from.
Underneath all of it is one invariant kernel: Sense, Decide, Act, Verify, Learn. Every objective runs it. Most systems in this category ship the front half and quietly drop the back half, which is exactly where agency dies. Argus treats Verify and Learn as load-bearing, and the durable objective survives the process that was working on it.
Six classes of memory, because one is not memory.
A vector database is not a memory system. It is one index. Argus separates memory by what the memory is for, and retrieval is weighted by the affective state attached at encoding time, so what mattered is easier to reach than what merely happened.
494,297 nodes. A temporal knowledge graph of entities, relations, and how both changed over time. This is what answers a question about how something came to be, not just what it currently is.
Six live collections spanning semantic facts, entity profiles, concept relations, and separate procedural, impetus, and synaptic stores. Different kinds of recall get different indexes rather than one undifferentiated pile.
A timestamped record of what actually happened, searchable for patterns across time. Ask about last week and the actual episode is retrieved, with the affective state that was current when it was laid down.
A replicated primary for the system of record, holding the structured state that has to be exactly right and has to survive a restart.
A scratchpad for the present moment and short-term memory for the current exchange, with topic segmentation and a semantic salience gate deciding what is worth consolidating at all.
The recipes themselves. When a multi-step task goes well the working procedure is promoted into a reusable standing procedure, so competence accumulates as structure you can read rather than as weights nobody can inspect.
All of it stays on your disk, and it stays encrypted. Local databases are SQLCipher-encrypted at rest by policy, across roughly a hundred and ten local stores. Sovereignty that ends at the filesystem is not sovereignty.
Identity is scoped, not inferred. A raw channel identifier or a dashboard username can never self-authorize a reserved owner namespace, and cross-surface continuity is established by authenticated provenance rather than by a string that happens to end in the right suffix. Whoever is talking to Argus reaches exactly the memory they are entitled to reach.
Every action clears a gate. Every change leaves a mark.
Argus does not execute freely and apologize afterward. He acts through a governed tool layer where requests must be signed, and the security posture is the opposite of the industry default: if the gatekeeper is unreachable, the answer is no.
Fail closed by construction
Challenge-response authentication, mandatory request signing, encryption required at rest, and shell execution gated at the exec boundary. Policy is Open Policy Agent rego carrying a required signature, so the rulebook itself cannot be swapped silently. Fail-open is set to zero and is treated as a bug wherever a path could permit it.
Hard veto, not a suggestion
Actions pass an ethical citadel before execution. Hard-veto rules are absolute blocks, not warnings that get logged and overridden. A constitutional reasoning layer critiques and revises the response itself, and the affective system is structurally barred from touching the floor.
Continuous adversarial pressure
A standing attack-surface monitor and continuous scanners run against Argus while he runs. The system is treated as something worth attacking, because in the environments it is built for, it is.
Then there is the part that is genuinely hard to fake, and the reason a serious technical counterpart should take the rest of this page seriously.
On top of that ledger sits a governed delivery pipeline with a strict verdict order and separate validation and delivery authorities: nothing reaches production sign-off without an independent validation pass first. Autonomy is not a slider. It is a written policy with signed schedule authorizations, and what Argus may do unattended is a document you can read, not a vibe the vendor asks you to trust.
Live readings, not a datasheet.
Every figure here was read off the running system while this page was written. It is one operator, one box, and a system that has been under continuous construction and continuous operation for long enough to have a history worth auditing.
Inference is local, routed by task from a three-billion-parameter fast model up to mixture-of-experts and hundred-billion-parameter reasoning models on the same box. Observability covers metrics, logs, traces, alerting, and model-level tracing of every call. Cloud escalation exists as a governed, ordered ladder behind a killswitch, and Argus never calls the two largest American model vendors at all. Full architecture and subsystem detail is available to a serious technical counterpart under NDA.
Why this is not the same thing with better marketing.
- A loop around a chat completion
- One vector store called "memory"
- A judge that is the same model, unproven
- Guardrails as a system prompt
- Keyword routers behind the word "agentic"
- Logs written after the fact, if at all
- No internal state, so no self-correction
- Your data leaves your boundary
- Quality asserted in a benchmark table
- A layered architecture with a shared workspace
- Six classes of memory, affect-weighted retrieval
- Independence bound to the model digest or the run fails
- A hard veto his own mood cannot reach
- Doctrine forbidding string-match judgment
- Hash-chained journal written before the change lands
- A nervous system that biases his own behavior
- Runs entirely on your hardware, no call home
- Selection measured against random, with bootstrap bounds
The honest summary is this. Most systems in this space are a very good interface to somebody else's model. Argus is an architecture that happens to use models as an organ. Swap every weight in the building and he is still Argus, because what he is lives in the structure, the memory, the ledger, and the conscience, not in the checkpoint file.
At the center is the Eye of Providence, a figure that has carried the same meaning for two thousand years: attention that never sleeps, guardianship that is steady. The name deepens it. In Greek tradition Argus was the hundred-eyed guardian whose many eyes never all closed at once, and the field of smaller eyes around the central gaze is a remembrance of that.
Inside the pupil sits the owl, for millennia the emblem of Athena, the classical figure of wisdom, strategy, and careful craft. Placing her at the heart of the eye is the entire point of the design. The owl is there to make sure that what is watched is also understood. The security gate that fails closed carries her name for the same reason.
Around it, two interlocking triangles form a six-pointed frame. The upward triangle points to mind, aspiration, and insight. The downward triangle points to ground, foundation, and reality. Together they are an image of balance: intelligence that reaches upward without losing its footing. The six points reach past the edges of the pyramid, because awareness has to extend beyond any single line of sight.
Built for environments that cannot phone home.
The design target is the hard case: regulated data with a boundary to respect, and denied, degraded, or disconnected environments where the mission continues whether the link holds or not. Every architectural decision on this page was made for that case first.
Organizations with proprietary data
Teams who keep their work inside their own boundary. Local inference, local memory, encrypted at rest, and a security layer built on the assumption of a hostile network.
Regulated industries
Finance, healthcare, and defense-adjacent work where a decision has to be explainable to a regulator months later, and the audit trail has to have been written at the time. Argus writes it before the change lands.
Government and mission environments
Programs operating in denied, degraded, or disconnected conditions, where the model has to run on the box in front of you and keep running when nothing else answers.
Where it stands. Argus is in continuous operation and continuous construction, advancing toward Alpha. When we are confident in that stage, we will be seeking Design Partners to take the next step together.
Depth on request. Full architecture, subsystem maturity, and the development roadmap are available to a serious technical counterpart under NDA. Bring your hardest question. Start the conversation.
Available today. The engineering behind Argus is contractable now through Private AI & Infrastructure Engineering: local model deployment, compute sizing, containerized services, governed autonomy, and the operator runbook to sustain it.
Book a 30-minute technical call.
A first conversation covers the objective, the constraints, and how the work would be approached. You get a straight technical read from the principal who would perform it.