| Agent | Desk | Cadence | Runs | What it does |
|---|
A CAMS-certified financial-crime professional — and the seventy-five-agent intelligence system he built to read markets, regulators, and blockchains around the clock.
A personal intelligence operation: seventy-five autonomous agents that wake on their own schedules, read primary sources, and file structured findings — designed from the outset so that every run compounds a permanent, queryable archive.
In plain terms — an agent here is a small scheduled program with written instructions: at a set time it reads its sources, files what it found to a shared record, and stops. Seventy-five of them, each with one beat, is the system. Sections 01–05 describe what runs; 06–08 what shipped; 09 the method; 10 who built it.
Each agent is a specialist with a beat: one pulls the U.S. sanctions list every morning at six and diffs it against yesterday's. One reads crypto markets every eight hours. One watches a single New Jersey town's housing market. Findings post to a shared workroom, persist to an append-only record, and distill into two daily briefings. The design premise is self-leverage — knowledge, tooling, and evaluated predictions accumulate in one system that every future run reads before it writes.
This is the actual schedule, shown against your clock — the gold marker is where the fleet is right now (Eastern Time), and the brass fill above it is how much of today's schedule has already passed. Every entry below is a real agent with a standing slot, kept by a scheduler on an always-on machine.
Weekends run lighter — but Saturday brings the deep-research engine, and Sunday morning the evolution engine reviews the fleet's own performance and ships internal upgrades through an adversarial verification gate with automatic rollback. Outward-facing changes still wait for the operator.
Crypto prices, funding, sentiment, prediction markets, and the macro backdrop — read continuously and reconciled against a simulated portfolio that has to live with its own calls.
Legislation, enforcement actions, and agency guidance across digital-asset regulation — plus a sanctions-list diff every morning. The desk closest to the day job: every finding severity-ranked and archived.
Wallets, flows, and protocols watched directly on public blockchains — the tracing discipline of the day job, pointed at open data.
A research base of 36,000 logged wagers — profit, variance, and sizing diagnostics — feeding a daily scan for mispriced lines, sized by quarter-Kelly. Treated as research, run like research.
Breakthrough-physics claims, AI research, long-shot ideas — investigated seriously, steel-manned and counter-argued. Saturdays, a deep-research engine writes the long reports.
The system that runs the system: a watchdog that audits every agent, an auto-repair crew that fixes drift, and a weekly evolution engine that proposes its own upgrades — human-gated.
The desk that reads for the operator: a morning brief and an evening wrap, the two daily digests, calendar and inbox triage, a weekly review — and a handful of personal beats, from a music library to one town's housing market.
All seventy-five agents by desk, cadence, and archived run count, each with a one-line description written for a non-specialist. Searchable, sortable, and drawn from the fleet's own generated inventory.
Prediction-market research desk — event contracts priced four times daily, every trade railed by a kill switch and a bankroll floor.
The agent that manages the agents — missed-run detection, data-source health, and autonomous budget throttling.
Twice-daily frontier-physics desk — propulsion claims, declassifications, and preprints, compounded into standing white papers.
The Treasury sanctions diff — list deltas pulled, compared, and delivered by 6:00 AM ET daily.
The Sunday self-improvement cycle — fleet performance reviewed, upgrades shipped through the adversarial gate.
Saturday long-form engine — multi-perspective research dossiers with citation discipline, in the STORM pattern.
No exotic infrastructure — a laptop, a message workspace, and a database. The sophistication is in the discipline: every agent follows the same production patterns, writes to the same archive, and answers to the same watchdog.
In plain terms — think of a newsroom. Sources come in, specialists file, an editor's desk collects the day, an archive keeps every edition, and two editions reach the reader. Each part below is ordinary; the discipline connecting them is the work.
A watchdog patrols four times a day for missed runs and dead data sources. An auto-repair crew fixes configuration drift every eight hours. On Sundays, an evolution engine reviews fleet performance and ships upgrades through an adversarial verification gate — with automatic rollback if quality regresses.
The fleet lives on a ~800-run weekly budget. When the burn rate trends hot, the watchdog throttles autonomously — luxury agents pause first, high-frequency agents slow next, and a protected core of seven keeps running no matter what.
Dashboards show the present; the archive keeps the past. Every agent writes each run to an append-only database — so "what did the system believe on March 3rd?" is a query, not a guess. Predictions are logged before outcomes, where they can't be quietly revised.
Systems earn adjectives through measurement. Every figure below is drawn from the operation's own records — the append-only archive, the generated registry, and the git history — as of September 4, 2026 (the value engine as of its last run, August 15).
In plain terms — these are counts, not claims. Each was read from a file the system writes for itself, on the date shown, and the method behind the cost figure is stated so anyone can redo the arithmetic.
The same ledger, translated. Each equivalence states its arithmetic.
of written operating procedure — the length of a long novel, every page of it executable by the fleet.
45 lines per page · 40,562 ÷ 45 = 901of one full-time engineer — delivered instead in twenty-one weeks of nights and weekends, by one person.
160 h per month · 990 ÷ 160 = 6.2 · model in the table belowstanding appointments the fleet keeps by itself — about 88 on a weekday — none of them started by hand.
schedule manifest, day-of-week aware · weekday mean 88.6a compliance desk's reading of the digital-asset rulebook, severity-ranked and filed, averaged over the system's twenty-one weeks.
129 ÷ 21 weeks = 6.1The fleet is run the way regulated systems are run: named controls, each observable, each with a cadence.
| Control | Function | Cadence |
|---|---|---|
| cortex-watchdog | Fleet-wide health patrol — missed runs, dead data sources, budget burn | 4× daily |
| fleet-auto-repair | Configuration-drift scan and autonomous correction across every agent spec | 3× daily |
| jit-budget-governor | Four-tier autonomous throttling against a ~800-run weekly budget — luxury agents pause first, a protected core never does | continuous |
| deadman-liveness | Silent-failure detection — a schedule that stops firing is surfaced, not discovered | per schedule |
| eval-harness | Measured output-quality scoring, independent of agent self-rating | per run |
| append-only-archive | Every run, finding, and prediction written to SQLite — history is a query, not a recollection | per run |
| state-authority | Local state files are the single source of truth; display surfaces are projections, never masters | doctrine |
| idempotency-outbox | External sends guarded against duplicates — an unconfirmed send is verified, never re-fired | per send |
| verify-and-apply | Self-modifications pass an adversarial multi-reviewer verification gate with automatic rollback; outward-facing and scheduler changes remain human-gated | weekly cycle |
| fleet-backup | Full archive to cloud storage, restore runbook maintained | daily |
The fleet values itself — and the honest part is what it cut. A local console compiles an evidence pack per agent from the archive, then prices each one on three pillars, every dollar stamped with a confidence tier. Figures as of August 15, 2026, the engine's last run.
Three pillars, one tier each. What comparable software would cost (estimated, from cited anchors); analyst hours displaced (derived: minutes per run × measured runs, capped at twenty hours a week fleet-wide); and money actually observed (measured). Projections are kept in a separate column and never blended into the headline. A maturity gate then scales the result — an agent that has not cleared the engine's gate is discounted, not flattered.
In plain terms — the system was asked to appraise itself and produced a number less than half its previous one, because every line now had to carry a citation and a confidence tier. That discipline is the point, more than the total.
| Agent | Desk | Stage | Health | Modeled / yr |
|---|---|---|---|---|
| cortex-onchain-watchlist | On-chain | Mature | 94 | ≈ $10,000 |
| market-maven | Markets | Mature | 88 | ≈ $9,000 |
| alpha-lab | On-chain | Mature | 91 | ≈ $6,500 |
| edd-review | Regulatory | Mature | 86 | ≈ $5,500 |
| cortex-watchdog | Fleet ops | Mature | 81 | ≈ $5,000 |
TABLE — the five highest-valued generic agents; all five are estimated-tier, values rounded to the nearest $500. Health is computed (liveness 35%, quality 25%, independent evaluation 20%, cadence 10%, degraded-source penalty 10%). Betting, trading, and personal agents are left out of this ranking; they appear, unranked, in the console captures below. The engine's own audit still lists the software-cost line as unreconciled to its anchors — the total is a floor with a stated method, not a proof.
A modeled replacement estimate — what this footprint would cost to commission, stated so it can be checked. Distinct from the value engine above: that figure is what the running fleet is modeled to be worth per year; this band is what it would cost to build once.
| Artifact class | Count | Modeled hours |
|---|---|---|
| Agent specifications, kernel-integrated | 79 | 240 |
| Interactive terminals & dashboards | 17 | 400 |
| Data layer, kernel & observability | 1 | 120 |
| Skill-library documents | 121 | 170 |
| Registry, console & fleet tooling | — | 60 |
| Modeled build effort | ≈990 h |
Modeled effort of 800–1,200 hours at prevailing senior automation-engineering contract rates ($110–$175/hr), rounded conservatively. Actual cost: one person, twenty-one weeks of nights and weekends, on consumer hardware — the gap between those two numbers is the argument for AI-assisted engineering.
METHOD — artifact inventory × conservative per-class build-hour estimates; rate band from prevailing U.S. senior contract automation rates. A model, not an audited figure. Counts drawn September 4, 2026 from the system's generated registry, append-only archive, and git history.
The architecture didn't stay private. The fleet's production patterns are generalized — no employer data, nothing proprietary — and published as three complementary repositories: the runtime for building agent fleets, the content to feed any AI assistant, and a compact system library that consolidates both.
In plain terms — open source means the code and templates are published for anyone to read, reuse, and check, free. The working patterns were proven privately first; what survived production became the public reference.
A production-grade framework for building, scheduling, and operating autonomous agent fleets — this system's architecture, generalized. An agent kernel with local-state authority, an idempotency outbox, human-gated self-modification, deadman liveness, and JIT budget management — scheduled with GitHub Actions, tested in CI, demonstrated live on GitHub Pages.
The content half: a copy/paste library of analytical prompt and output templates for work at financial institutions — financial-crime compliance, controls and independent testing, fraud, surveillance, regulatory, research, and market analysis. Every feature replicates with at most two files, a rule enforced in CI — plus a pure-Python quant library.
A clean-room consolidation of the other two: twelve numbered modules for OSINT, communications, financial-crime analysis, data quality, automation, QA, and reporting — including a 525-source OSINT register across nineteen domains — with a CI validation gate on every push.
The generalization step is the point. Everything published is stripped to its portable core — no personal data, no proprietary context, nothing that couldn't sit in a public library. That makes the repositories function as OSINT-grade reference material: public, citable, and usable inside any institution's rules — by the author and by anyone else. The private fleet dogfoods every pattern first; what survives production becomes the public reference.
Max Moran
github.com/maxmoran23 · three project repositories and a profile · whatever ships next
The fleet is the centerpiece, but the shelf runs deeper — a seventeen-entry port map of terminals and dashboards on local hardware. Screen captures first (click any to enlarge), then the shelf itself.
The terminals were built for a browser. In June 2026 the work moved onto Apple's platform — a SwiftUI shell around each terminal, an Apple Developer Program membership, and on August 16 the first signed build reached TestFlight. Nineteen builds in, the music terminal opens on a phone with the home lab asleep, and a build is in front of Apple's beta reviewers.
In plain terms — TestFlight is Apple's pre-release channel: a build there has been signed with a developer identity and processed by Apple through the same pipeline the App Store uses. It is the difference between a web page bookmarked on a phone and an application installed on it.
A personal Apple Music analytics and DJ app: listening DNA, a discovery feed, full-length playback through MusicKit, a bridge that can write playlists to the real library, and a two-deck Mix Lab that sequences by measured tempo and key. It ships with a bundled offline snapshot, so it opens on a train with no connection to the home lab; when online, testers sign in to an internet-reachable server fronted by Cloudflare.
The iPhone end of the fleet: it registers for Apple push notifications, keeps a running log of alerts, and a home-screen widget pulls a fleet summary from the console. The server side — signed tokens to Apple's push service, de-duplicated sends — is written, and is meant to deliver through Music Intel's token.
The digital-asset terminal wrapped as an app, with a mobile tab bar driving its router and a live-price heartbeat that survives a resident web view — a class of bug invisible in a browser tab. Installed to an iPad in June.
A private career-market dashboard on iPad — the same 260-line shell wrapping a completely different terminal, unchanged. Its data is personal, so the app is described here and not shown.
The fourth app from the same template in a day, with its own generated icon — and the one that hit Apple's three-app limit for free accounts, which is part of why the paid membership followed.
Apple Developer Program joined June 9. Music Intel, Career Intel, and Signal Forge built as SwiftUI shells, verified in the simulator, and sideloaded to an iPad by June 20.
Signing, App Store Connect, and a scripted release path written in a day; builds 1–6 uploaded. The offline snapshot proven by pointing the app at an address that cannot exist.
Mix Lab, cue points, Now Playing, and the Apple Music shell shipped. The signing material moved to a Mac mini and the last four builds went out from there.
Nine builds in two days — a native player observer, deep links, an up-next queue fix — plus tester accounts, a Cloudflare-fronted server, and a published privacy policy. Build 18 went to Beta App Review and was turned back on a guideline point; the review notes were rewritten and build 19 resubmitted the same evening.
Build 19 is waiting for Beta App Review, the gate to external testers. Version 1.0 sits in App Store Connect as "Prepare for Submission"; the TestFlight builds stay valid meanwhile.
RELEASE PATH — archive, sign, number, upload, attach to the beta group, and re-ship automatically when a build nears its 90-day expiry — all from a script, no clicks in Xcode, reproduced from scratch on a second machine. Build dates and review states verified against App Store Connect on September 4, 2026.
None of this was hand-written code in the traditional sense — and that is the finding. The system was engineered through specification, orchestration, and adversarial verification: plain-language operating law, independently reviewed changes, measured rollback.
Behind it sit three years of top-percentile large-language-model practice — a heavy user since the first public releases, among the heaviest individual users of frontier assistants by 2025, and operating them daily at production intensity since. The craft is systems doctrine: recognizing which patterns hold under failure, writing them down, and making every future build inherit them. Four of those doctrines, and why they carry weight:
Every run reads the accumulated archive — findings, tooling, evaluated predictions — before it writes to it. New agents inherit the full library on day one.
Why it mattersUsage becomes infrastructure. The system gets cheaper to extend the longer it runs — the opposite of most automation, which decays.
Local state files are the single source of truth; every display surface is a disposable projection. No component ever trusts a dashboard over the record.
Why it mattersEliminates an entire failure class — silent divergence between what a system shows and what it knows — rather than detecting it after the fact.
Self-modifications ship only after adversarial review attempts to break them, with automatic rollback if quality regresses. Findings must survive attack, not just sound plausible.
Why it mattersAutonomy without trust-by-default — the same standard this site was held to before publishing.
The fleet lives on a ~800-run weekly budget and throttles itself under pressure — luxury agents pause first, a protected core never does.
Why it mattersEconomics as a first-class control, designed in from the outset — not bolted on after the first overrun.
Financial-crime work that has to survive a regulator's read — tracing funds across blockchains, weighing vendor claims, writing analysis to an institutional standard.
Max Moran is a CAMS-certified compliance professional with five years across exchange, institutional, and global-bank settings, focused on digital assets, sanctions, and blockchain investigations. He began in blockchain forensics at Coinbase — de-mixing transactions, tracing darknet exposure — helped build a digital-asset compliance function at Cantor Fitzgerald, and now serves as Director of Digital Assets Advisory within Global Financial Crimes at Morgan Stanley.
The systems work started earlier than the fleet. Three-plus years of daily practice with large language models — from the first public releases, through hundreds of millions of tokens of real-world prompting — first surfaced at the Cantor Fitzgerald compliance desk as hand-built prompt libraries for OSINT research and due-diligence drafting, before native AI tooling existed. At the end of 2025 the practice found its instrument in Claude Code. The first interactive terminals shipped by March; by April the fleet's first commit already contained thirty-eight scheduled agents and the full Slack-first architecture. Seven months of daily, production-intensity engineering followed — not a course of study, but an operation that had to keep running.
The curriculum was written by failures. A display-platform character cap silently broke state persistence across the fleet — the answer became the state-authority doctrine: local files are truth, displays are projections. A digest email delivered three times because a retry fired before its acknowledgment surfaced — the answer became the idempotency outbox, and "never re-fire an unconfirmed send" became kernel law. Prose inventories drifted from reality — the answer was a generated registry that distrusts prose entirely. Every incident ended the same way: as a named, versioned pattern that every future agent inherits on day one.
The distinguishing habit is institutional: the system is treated the way a bank treats a process. In June, a thirty-five-agent adversarial audit was commissioned against the architecture itself; it returned an unflattering maturity score and a blunt verdict — and the remediation shipped within days: a versioned kernel, out-of-band liveness monitoring, measured evaluation. The same skepticism shapes the analytics — self-assessments engineered to resist their own bias, evidence metrics that score what should exist against what survives, mandatory counter-arguments on exactly the claims most likely to be believed. Compliance instincts, transferred whole into systems engineering.
All of it began as a working question: compliance is pattern recognition at scale — what does one analyst with real infrastructure look like? Everything on this page was built outside working hours, on personal hardware, from public data, and it compounds weekly by design.
The progressionNew York · Financial crime, digital assets & applied AI