SEC·I · YMIR · SELF-HOSTED DAEMON

YMIR

Ymir is a self-hosted agentic-AI daemon on a Mac I own and administer: launchd-managed, watchdog-supervised. This page walks the architecture layer by layer.

SEC·II · KERNEL · PROCESS TABLE

KERNEL

The core is an asyncio agent kernel that treats agent work the way an operating system treats processes. Every job gets a row in a process table. A multilevel feedback queue (MLFQ) schedules that table: short interactive work keeps priority, long-running work sinks to the slower queues.

Textbook MLFQ preempts a job when its quantum expires. That rule does not survive this workload. A dispatched agent is a subprocess with no suspend and no resume, so killing it mid-flight throws away its work and the model quota already spent producing it. There is no quantum here and no context switch.

So demotion is accounting rather than preemption. Each level carries a total-runtime allotment, and a job past its level's threshold drops a level:

\[ Q_0: 120\,\mathrm{s} \qquad Q_1: 300\,\mathrm{s} \qquad Q_2: 600\,\mathrm{s} \]

The demoted job keeps its slot and runs until the 600 s ceiling kills it. What changes is future dispatch order and the record of who overstayed, which is what the per-job accounting in each row is for. Queued work is protected separately: every 300 s a boost moves everything in Q1 and Q2 to the tail of Q0, so background work waits at most one boost period behind a stream of interactive jobs.

SEC·III · PLUGINS · PROTOCOL

PLUGINS

Capability lives in plugins. The kernel discovers them at boot; the current scan finds 66. Every plugin implements the same Protocol contract, so the kernel loads, routes, and supervises each one the same way.

An intent router reads each incoming message and hands it to the plugin that claims the intent. Skills inject at dispatch: when a market-brief job runs, the market-brief skill loads into that job alone.

SEC·IV · TRANSPORTS · THREE DOORS

TRANSPORTS

Three transports reach the kernel. iMessage carries the primary line. A web app rides the tailnet. A guest tunnel opens a narrower public surface, and the public door at ymir.ilovemcars.com sits behind Cloudflare Access SSO.

Whatever the door, the path is the same: transport to router, router to gate, gate to plugin, and the reply walks back out.

SEC·V · SECURITY · DENY-BY-DEFAULT

SECURITY

The security model is deny-by-default. A capability gate narrows the toolset per plugin principal before the job runs: the plugin keeps the tools its work needs and loses everything else. One line from the boot log:

capability gate narrowed tools principal=morningbrief dropped=Read,Glob,Grep kept=WebSearch

Actions land in a hash-chained audit log. Each row carries prev_hash and hash, so every row seals the one before it and an edit to any row breaks the chain after it. Tamper-evident by construction.

Around the gates: token auth, spend caps, per-client token buckets on the guest surface, and a guest consent ledger.

SEC·VI · RELIABILITY · SELF-WATCH

RELIABILITY

The daemon watches itself. A watchdog holds the heartbeat and restarts the process when it stops. A healthcheck and a self-monitor run inside as standing checks.

An integrity manifest covers its whole source tree. Drift raises a flag; re-baselining the manifest is a deliberate act.

An iCloud backup job keeps state recoverable off the machine. Provider-health tracking keeps a running read on the upstream providers.

SEC·VII · THE DOOR

THE DOOR

The chat door is at chat.ilovemcars.com, a direct line to the daemon rather than a demo standing in for one. It answers when the daemon is up and it does not when the daemon is down, which is the honest behaviour of a real system rather than a screenshot of one. I build systems like this end to end, and I run what I ship.

daemon offline right now. self-hosted on hardware I own; it comes back when the box does.