One window is a claim.
One bus is how.
Everything the app can do is one of 244 named commands. Your click and the agent’s tool call reach the same one, pass the same check, and land in the same journal.
VectorBrain’s real command palette (Ctrl+K), drawn straight from the registry and searched for “fs.”. The project around it is example data.
The same command, whoever calls it.
Row 61323 is you saving the launch post. Row 61322 is an agent writing the same file with the same command, fs.write. Every call is a row with its exact input, refused ones included, and undo is an ordinary command off a row, so it still works after a restart.
It stops and asks. You approve the exact call.
A delete the agent wants parks as a card holding its exact input. Allow replays that input verbatim, so you approve what happens, not a summary of it. Nothing is held open while it waits, so the card survives a restart.
Clear out the hero drafts we did not use.
A page it reads cannot make it act.
Once a run reads something from outside, such as a web page, it can still read, answer and make something new: a Canvas document, or a new .md, .txt or .csv file under the project’s web/ folder. It may not change what already exists, delete or run anything for the rest of that run. Here the timetable came back and the save over the existing note was refused, with the reason written into the journal.
Put the Saturday crossings in notes/travel.md.
One chat. Nothing to pick before you type.
A playbook, design, code or sheet, loads when you type its slash, when the app sees a sure sign such as a code project, or when the judge reads the request as one, and it stays for the rest of the conversation. It changes what is loaded, never what is allowed, so no request can load its way into more power. Your trust dial decides what asks.
- the run’s ceiling
- the step budget
- the taint rule
- your trust level
- your dollar ceiling
- its own approvals
Each of these is enforced in code at the bus and never asked for in a prompt, because a limit a model is asked to respect is a limit it can be talked out of. Trust level, dollar ceiling and approvals are yours alone: the agent is refused those commands outright.
The runtime, in numbers.
- Commands
- 244 named, typed commands, each with an input schema, an effect level and a one-line summary the person and the model both read.
crates/*/src (CommandSpec) - Front door
- The window has one route into the core: a single dispatch call. Anything it needs belongs on the bus.
ui/src/bus.ts - Effect levels
- read, write, destructive, exec.
ui/src/bus.ts - Provenance
- first party, project, foreign. Only foreign taints a run.
vb-core/src/permission.rs - Journal callers
- “user”, “agent:<run>”, “script:<run>”, “companion:<program>”.
vb-core/src/permission.rs - Your conversations
- One role for every conversation you start: ceiling exec, 150 steps as a backstop. Your trust level decides what of that asks; the spending ceiling is the real bound.
vb-agent/src/role.rs · PERSON_CEILING, PERSON_STEPS - Playbooks
- design, code and sheet. Loaded by slash, by a sure signal, by the model, or by the judge at 0.7 or above. Sticky and append-only, and never a change to what is allowed.
vb-agent/src/role.rs; vb-agent/src/judge.rs · PLAYBOOK_BAR - Helper roles
- Report (read, 14 steps), Librarian (write, 6), Organize Taste (write, 12), Build pages (write, 16), Member (write, 20). Fixed ceilings, and none can stop to ask. Not pickable.
vb-agent/src/role.rs - Trust levels
- Always ask, Normal, God mode. Per conversation, set only by you.
ui/src/levels.ts - Hard caps
- 12 browser tabs, 8 crew members.
vb-cmd-pane/src/lib.rs, vb-agent/src/crew.rs
The details,
for the careful.
Is the VectorBrain agent using the same features I am, or a reduced API?
The same. A capability is defined once, as a command with its input schema, effect level, undo and summary. The palette, a button and the agent’s tool call are three callers of that one definition, so a feature cannot exist for you and not for the agent without someone deciding that on purpose. The whole list
What happens when the agent tries something I did not want?
Your trust level decides what stops, and only you can set it. At Normal, a delete or a program parks as an approval card and does not run until you allow it. A helper runs under a fixed, lower ceiling, and a command above it is not offered at all, so there is nothing to talk it into. What did run can be undone from its journal row.
Can a web page or a document talk the agent into doing something?
It can say anything, but it cannot change what you have. A run that reads foreign content may still read, think, answer and write what it found as something new: a Canvas document, or a new .md, .txt or .csv file under web/, marked as from the web. It may not change anything that already exists, delete or run a program for the rest of that run. Nothing the page says can lift that. How taint works
If I close VectorBrain mid-run, what survives?
The journal, and everything that hangs off it: the rows of what ran, parked approvals with their stored input, and the ability to undo. They are rows in a local database, not state in a process.
Are refused commands journalled?
Yes. Every dispatch lands in the journal, including the ones refused by the taint rule and the ones parked for approval, so “the agent picked the wrong command” is something you can look at rather than suspect.
What does undo cover?
Commands that declare an inverse, such as a file write, whose undo puts the earlier contents back. A message sent to a model provider or a form submitted on the web has no inverse and cannot be undone.
What does God mode switch off?
The waiting. Nothing stops to ask, but the sandbox, the rule that commit and push are yours, and the taint rule still stand. God mode is set per conversation, only by you.
Can I load a playbook halfway through a conversation?
Yes. Type its slash, or let the judge or the model load it when the work turns that way. A load is added to the end of the conversation and stays for the rest of it; nothing is unloaded or rewritten, because changing the start of a request throws away the provider’s cache. It brings know-how and tools, never permission.
One bus.
Nothing off the record.
What you click and what the agent calls are the same commands, checked the same way and written down in the same place.