PROOF

Owned operating product · Multi-agent system

AgentDesk

A private system of four specialized agents and five independent portfolio sources: it surfaces what matters, preserves state, and helps the owner decide without transferring authority to the system.

Current status. Version 0.14.1 is running in the private production environment. The release and recovery of all five collectors were verified on 19 September 2026.

Discuss a similar system

Many events. One owner’s attention.

Six mailboxes and five heterogeneous portfolio sources create parallel streams. Without shared policy, state, and diagnostics, important events disappear into noise, source failures blur together, and repeating an action becomes unsafe.

The core AgentDesk agent flow

Core AgentDesk diagram: mail events pass through read-only intake, normalization, and policy before one of four specialized agents prepares context for an owner decision. AI proposes and the human approves; state, authority boundaries, and diagnostics are shared. The version 0.14.1 portfolio path is outside this earlier diagram.Open the full-size diagram — new tabCore AgentDesk diagram: mail events pass through read-only intake, normalization, and policy before one of four specialized agents prepares context for an owner decision. AI proposes and the human approves; state, authority boundaries, and diagnostics are shared. The version 0.14.1 portfolio path is outside this earlier diagram.Open the full-size diagram — new tab
This diagram was frozen for version 0.7.0 and still accurately shows the four-agent core flow. It is an architecture diagram, not a screenshot. The portfolio path added across versions 0.8.0–0.14.1 is documented separately below.

Different event streams. One agent system.

Four specialized agents share a common event lifecycle. The investment path also receives confirmed read-only snapshots from five independent portfolio sources; an independent news stream remains future work.

Operating

Mail and notifications

Mail Triage reviews incoming messages, determines priority, and selects a safe route. It is one input stream, not the system’s sole purpose.

Operating

Commercial opportunities

Freelance Scout performs Limited-Information preselection: OPEN for further review, SKIP for silent retention, and manual review on failure. This is not a decision to accept a job; detailed analysis remains a separate step after owner clarification.

Operating

Personal messages and replies

Personal Message Agent handles email notifications of direct contact. It links replies to existing opportunities only through stable identifiers; unlinked messages are still delivered. Drafting is optional and sending remains manual.

Operating

Investment events and Connected Portfolio

Investment Signal reviews incoming notifications while five isolated read-only collectors publish only confirmed snapshots into one portfolio. There is no order placement, trading, or automated asset management.

Possible expansion

News and information noise

A possible scenario: specialized agents separate relevant news from repetition and noise, collect context around selected topics, and prepare a concise review.

From incoming signal to owner decision

A shared process routes each event to a specialized agent through explicit rules. AI assists semantic review, the Supervisor prepares the result for the owner, and the decision and state are persisted.

  1. Signals

    Mail already received: general notifications, opportunities, direct messages, and investment events.

  2. Read-only intake

    Bounded reading without downloading attachments or opening links.

  3. Policy and routing

    Code normalizes the event, applies rules, and selects a specialized handler.

  4. Specialized agents and AI

    Domain-specific review depends on the scenario. Semantic enrichment is used only where it adds value.

  5. Supervisor

    Prepares the result for the owner. A separate delivery layer chooses a Telegram topic or direct message without changing the business decision.

  6. Owner decision

    Approve, Edit, Skip, or confirmation of an action already completed manually.

  7. Persisted outcome

    Decisions and state are persisted. Mail and proposals are sent manually; a separate component applies authorized mail labels.

A shared foundation, not a collection of bots

Mail Triage, Freelance Scout, Personal Message Agent, and Investment Signal Agent connect through a shared agent registry. Each owns its processing and queue; state, coordination, and owner decisions share a common foundation.

Mail intake

Normalization, classification, attention policy, and safe routing for incoming mail.

Opportunities

The model extracts evidence with quotes and code applies a frozen policy. OPEN does not mean readiness to accept the job; SKIP is retained in history without notification.

Owner approvals

The human receives a bounded action set and retains the final decision.

Operations

Delivery, mail cycles, four agents, and five portfolio collectors feed coherent diagnostics. A missed activated window is visible to both Connected Portfolio and the Watchdog.

Five independent sources, one confirmed portfolio

Freedom Broker KZ, T-Investments, a private Manual CSV, CoinStats, and BCS share Source Adapter Contract v1. A source failure does not replace its last confirmed snapshot or stop the other sources.

Freedom Broker KZ

A read-only API and confirmed broker-native snapshot with no trading authority.

T-Investments

Read-only data; negative cash is retained as a liability while short securities are rejected.

Manual Portfolio

One private CSV contains a complete snapshot and explicit owner-provided USD values; an incomplete file is not published.

CoinStats

GET-only holdings are reconciled with the reported total; crypto retains source-local identity.

BCS

Isolated trade-api-read access, safe token rotation, and strict reconciliation across configured accounts.

Isolated collectors → confirmed canonical snapshots → one USD denominator → deterministic allocation → a privacy-safe Telegram projection.

Absolute values, quantities, account identifiers, and credentials remain inside canonical financial state. Telegram, ordinary logs, and model paths receive only the allowed projection. AgentDesk does not trade.

What the owner receives

These anonymized cards show the system’s output in operating scenarios. Mail and commercial streams provide examples; they do not limit the product to email processing.

#SYSTEM · AgentDesk

The foundation at work

Mail, Scout, Digest, delivery, health, and queues form one operational picture.

Mail
operating
Scout
operating
Delivery
controlled
Queues
no stuck work
  • Current health is derived from the actual operational snapshot.
The system is observed as one operating environment, not a set of unrelated scripts.

#TASK · PRELIMINARY

Commercial opportunity

A notification is compressed into a preliminary assessment, reasons to continue, risks, and missing context.

Assessment
preliminary
Context
task details required
Links
not opened
  • Missing context is not disguised as a confident proposal.
EditAlready repliedSkip
A notification becomes a decision with explicit uncertainty and three owner actions.

#TASK · FINAL

Prepared presale

Once sufficient context is available, the system produces fit, material risks, a recommendation, and a personalized draft.

Fit
final assessment
Recommendation
conditional after risk review
Sending
manual by the owner
  • Assessment remains separate from polished copy: risks stay visible beside the proposal.
EditAlready repliedSkip
From opportunity to prepared response—with manual sending and a persisted status.

#SECURITY · HIGH

An event requires verification

An untrusted message is recognized as important, but verification is directed through the service’s official interface rather than a link in the message.

Priority
high
Verification
official interface
External action
not performed
  • Message content remains untrusted input and cannot change system authority.
Security is part of the workflow: the decision is persisted and no external action is performed.

What matters technically

Each boundary addresses a practical risk: losing a message, repeating an action, prompt injection, false confidence, or excessive authority.

  1. Stable core + optional AI

    Decision
    Normalization, scoring, routing, policy, and presentation belong to code. AI performs bounded semantic work.
    What it provides
    AI failure simplifies the outcome without breaking the core workflow.

  2. Authority bounded by the system

    Decision
    Roles and access are separated and AI tools are denied. The collector is read-only; a separate Mail Marker may add authorized service labels, but cannot send or delete mail.
    What it provides
    A classification error does not automatically become an action in an external service.

  3. State is persisted

    Decision
    Decisions, queues, checkpoints, and delivery lifecycle are stored in SQLite before the next step.
    What it provides
    A restart continues from known state instead of guessing the previous outcome.

  4. Ambiguous failure is not retried blindly

    Decision
    If the network may have accepted a message before disconnecting, delivery enters an explicit uncertain state without an automatic duplicate.
    What it provides
    The system prefers visible manual review over sending the same decision twice.

  5. Mail remains untrusted input

    Decision
    Links are not opened by default, attachments are not downloaded, and AI output passes strict schema validation.
    What it provides
    Incoming text cannot expand a component’s tools, route, or authority.

  6. Human-in-the-loop is part of the product

    Decision
    Missing context, high-cost errors, and final sending explicitly return the decision to the owner.
    What it provides
    Autonomy expands gradually while a working manual path remains available.

AgentDesk 0.14.1: verified release state

The 19 September 2026 release record pins the deployed code, Linux artifact, recovery of five collectors, and coherent diagnostics. It is dated release evidence, not a continuous live health check.

Production 0.14.1 recovered

All 559 local and Linux checks passed. The patch repaired four collector executable modes, the schedule activation boundary, and shared missed-cycle evidence.

All five sources refreshed

After release, one idempotent all-source refresh completed Freedom, T-Investments, Manual, CoinStats, and BCS successfully on the first attempt; the connected snapshot was confirmed.

Health views agree

At the verification point, Mail 6/6 and agent ticks 4/4 were fresh, issues and unfinished deliveries were empty, SQLite integrity was ok, and foreign-key violations were zero.

Authority remains bounded

Mail and proposals are sent manually, and no trading actions exist. Full-Information Mode and an independent news source are not claimed as complete.

Where this approach applies

AgentDesk demonstrates how to combine specialized agents, AI, business policy, read-only integrations, human decisions, and operational diagnostics. The approach applies to presales, CRM, documents, alerts, and controlled data aggregation.

The four cards below are anonymized reconstructions of previously verified messages, not a production 0.14.1 snapshot. The private Telegram environment and financial data are not a public demo. Release facts come from the 19 September 2026 record and do not guarantee continuous availability after that verification point.

Need an agent system for your event streams?

Describe the event sources, domain tasks, owner decision, and cost of error. These inputs define the agents, AI’s role, shared rules, and automation boundaries.

Discuss a similar system