Owned operating product · Multi-agent system
AgentDesk
The founder’s personal working tool gathers incoming events, helps identify what matters and prepares information for a decision. A person reviews the suggestion and decides what happens next.
Current status. Version 0.14.1 is running in the private production environment. The release and recovery of all five collectors were verified on 19 September 2026.
Discuss a similar systemMany events. One owner’s attention.
Six mailboxes and five heterogeneous portfolio sources create parallel streams. Without shared policy, state, and diagnostics, important events disappear into noise, source failures blur together, and repeating an action becomes unsafe.
The core AgentDesk agent flow
- 01
Incoming events
Mail and notifications from six mailboxes
- 02
Read and apply rules
The event is normalized and assigned a permitted route
- 03
Specialized analysis
- Mail triage
- Freelance scout
- Personal messages
- Investment signals
AI helps prepare context and a suggestion
- 04
Owner decision
A person reviews the suggestion and decides what to do
Persisted state · authority boundaries · diagnostics · decision history
Fact → evidence → boundary
Evidence record
Four agents handle distinct incoming events
- Evidence
- Mail triage, freelance scouting, personal messages and investment signals share state and rules. Six mailboxes were checked at the verification point.
- Boundary
- The public case is pinned to release 0.14.1. Later reports are not presented as a new independent check.
Five sources recovered through the normal path
- Evidence
- The release record reports successful first-attempt collection for every source and 559 checks in each of the local and server artifact suites.
- Boundary
- This establishes recovery on the release date, not current health, and discloses no financial data.
A suggestion does not automatically become an action
- Evidence
- Sending mail, accepting work and financial decisions remain with the owner. Portfolio sources are read-only.
- Boundary
- The system does not trade and is not presented as an autonomous executor.
The date belongs to the source record. Reading it is not a new check of the operating system.
Different event streams. One agent system.
Four specialized agents share a common event lifecycle. The investment path also receives confirmed read-only snapshots from five independent portfolio sources; an independent news stream remains future work.
Operating
Mail and notifications
Mail Triage reviews incoming messages, determines priority, and selects a safe route. It is one input stream, not the system’s sole purpose.
Operating
Commercial opportunities
Freelance Scout performs Limited-Information preselection: OPEN for further review, SKIP for silent retention, and manual review on failure. This is not a decision to accept a job; detailed analysis remains a separate step after owner clarification.
Operating
Personal messages and replies
Personal Message Agent handles email notifications of direct contact. It links replies to existing opportunities only through stable identifiers; unlinked messages are still delivered. Drafting is optional and sending remains manual.
Operating
Investment events and Connected Portfolio
Investment Signal reviews incoming notifications while five isolated read-only collectors publish only confirmed snapshots into one portfolio. There is no order placement, trading, or automated asset management.
Possible expansion
News and information noise
A possible scenario: specialized agents separate relevant news from repetition and noise, collect context around selected topics, and prepare a concise review.
From incoming signal to owner decision
A shared process routes each event to a specialized agent through explicit rules. AI assists semantic review, the Supervisor prepares the result for the owner, and the decision and state are persisted.
Signals
Mail already received: general notifications, opportunities, direct messages, and investment events.
Read-only intake
Bounded reading without downloading attachments or opening links.
Policy and routing
Code normalizes the event, applies rules, and selects a specialized handler.
Specialized agents and AI
Domain-specific review depends on the scenario. Semantic enrichment is used only where it adds value.
Supervisor
Prepares the result for the owner. A separate delivery layer chooses a Telegram topic or direct message without changing the business decision.
Owner decision
Approve, Edit, Skip, or confirmation of an action already completed manually.
Persisted outcome
Decisions and state are persisted. Mail and proposals are sent manually; a separate component applies authorized mail labels.
A shared foundation, not a collection of bots
Mail Triage, Freelance Scout, Personal Message Agent, and Investment Signal Agent connect through a shared agent registry. Each owns its processing and queue; state, coordination, and owner decisions share a common foundation.
Mail intake
Normalization, classification, attention policy, and safe routing for incoming mail.
Opportunities
The model extracts evidence with quotes and code applies a frozen policy. OPEN does not mean readiness to accept the job; SKIP is retained in history without notification.
Owner approvals
The human receives a bounded action set and retains the final decision.
Operations
Delivery, mail cycles, four agents, and five portfolio collectors feed coherent diagnostics. A missed activated window is visible to both Connected Portfolio and the Watchdog.
Five independent sources, one confirmed portfolio
In the verified release, five independent collectors read broker, crypto tracker and manual register data through one source adapter contract. A collector failure does not replace its last confirmed snapshot or stop the others.
Brokers · source 1
A read-only API and confirmed broker-native snapshot with no trading authority.
Brokers · source 2
Read-only data; negative cash is retained as a liability while short securities are rejected.
Manual register
One private CSV contains a complete snapshot and explicit owner-provided USD values; an incomplete file is not published.
Crypto tracker
GET-only holdings are reconciled with the reported total; crypto retains source-local identity.
Brokers · source 3
Isolated trade-api-read access, safe token rotation, and strict reconciliation across configured accounts.
Isolated collectors → confirmed canonical snapshots → one USD denominator → deterministic allocation → a privacy-safe Telegram projection.
Absolute values, quantities, account identifiers, and credentials remain inside canonical financial state. Telegram, ordinary logs, and model paths receive only the allowed projection. AgentDesk does not trade.
What the owner receives
These anonymized cards show the system’s output in operating scenarios. Mail and commercial streams provide examples; they do not limit the product to email processing.
#SYSTEM · AgentDesk
The foundation at work
Mail, Scout, Digest, delivery, health, and queues form one operational picture.
- operating
- Scout
- operating
- Delivery
- controlled
- Queues
- no stuck work
- Current health is derived from the actual operational snapshot.
#TASK · PRELIMINARY
Commercial opportunity
A notification is compressed into a preliminary assessment, reasons to continue, risks, and missing context.
- Assessment
- preliminary
- Context
- task details required
- Links
- not opened
- Missing context is not disguised as a confident proposal.
#TASK · FINAL
Prepared presale
Once sufficient context is available, the system produces fit, material risks, a recommendation, and a personalized draft.
- Fit
- final assessment
- Recommendation
- conditional after risk review
- Sending
- manual by the owner
- Assessment remains separate from polished copy: risks stay visible beside the proposal.
#SECURITY · HIGH
An event requires verification
An untrusted message is recognized as important, but verification is directed through the service’s official interface rather than a link in the message.
- Priority
- high
- Verification
- official interface
- External action
- not performed
- Message content remains untrusted input and cannot change system authority.
What matters technically
Each boundary addresses a practical risk: losing a message, repeating an action, prompt injection, false confidence, or excessive authority.
Stable core + optional AI
- Decision
- Normalization, scoring, routing, policy, and presentation belong to code. AI performs bounded semantic work.
- What it provides
- AI failure simplifies the outcome without breaking the core workflow.
Authority bounded by the system
- Decision
- Roles and access are separated and AI tools are denied. The collector is read-only; a separate Mail Marker may add authorized service labels, but cannot send or delete mail.
- What it provides
- A classification error does not automatically become an action in an external service.
State is persisted
- Decision
- Decisions, queues, checkpoints, and delivery lifecycle are stored in SQLite before the next step.
- What it provides
- A restart continues from known state instead of guessing the previous outcome.
Ambiguous failure is not retried blindly
- Decision
- If the network may have accepted a message before disconnecting, delivery enters an explicit uncertain state without an automatic duplicate.
- What it provides
- The system prefers visible manual review over sending the same decision twice.
Mail remains untrusted input
- Decision
- Links are not opened by default, attachments are not downloaded, and AI output passes strict schema validation.
- What it provides
- Incoming text cannot expand a component’s tools, route, or authority.
Human-in-the-loop is part of the product
- Decision
- Missing context, high-cost errors, and final sending explicitly return the decision to the owner.
- What it provides
- Autonomy expands gradually while a working manual path remains available.
AgentDesk 0.14.1: verified release state
The 19 September 2026 release record pins the deployed code, Linux artifact, recovery of five collectors, and coherent diagnostics. It is dated release evidence, not a continuous live health check.
Production 0.14.1 recovered
All 559 local and Linux checks passed. The patch repaired four collector executable modes, the schedule activation boundary, and shared missed-cycle evidence.
All five sources refreshed
After release, one idempotent all-source refresh completed all five collectors for brokers, the crypto tracker and the manual register successfully on the first attempt; the connected snapshot was confirmed.
Health views agree
At the verification point, Mail 6/6 and agent ticks 4/4 were fresh, issues and unfinished deliveries were empty, SQLite integrity was ok, and foreign-key violations were zero.
Authority remains bounded
Mail and proposals are sent manually, and no trading actions exist. Full-Information Mode and an independent news source are not claimed as complete.
Where this approach applies
AgentDesk demonstrates how to combine specialized agents, AI, business policy, read-only integrations, human decisions, and operational diagnostics. The approach applies to presales, CRM, documents, alerts, and controlled data aggregation.
The four cards below are anonymized reconstructions of previously verified messages, not a production 0.14.1 snapshot. The private Telegram environment and financial data are not a public demo. Release facts come from the 19 September 2026 record and do not guarantee continuous availability after that verification point.
Are important messages getting lost?
Tell us where enquiries arrive, how you handle them and what must not be missed. The atelier can help define what a system can do and how to check its work.
Discuss a similar system