A six-machine home agentic network

A case study in shipping agentic AI to the hardest user base there is: your own non-technical family, every day, with no tolerance for breakage and no appetite for terminals.

Problem

The household had real, recurring coordination work -- meal planning, notes and reminders, document wrangling, small automations -- and several family members who would benefit from AI agents but would never open a terminal, manage an API key, or debug anything. The goal: make capable agents a household utility, with the safety story designed in from the start rather than bolted on after an incident.

Constraints

• Non-technical users. Family members interact through things they already use -- notes, messages, simple web pages. No new apps to learn, no prompts to engineer.
• Mixed fleet. Six machines across macOS, Windows, and Linux, joined by a private mesh VPN. Agents had to work any-to-any without per-machine snowflake setup.
• Residential reality. Machines sleep, links flap, and nothing may depend on a service staying up. Delivery had to queue and recover, not fail loudly at a family member.
• A hard trust boundary. Family data stays inside the private network. Nothing credential-shaped ever sits in a publicly served path.

Guardrails and approval design

The permission model came first, before any agent got useful. Two layers do the work:

• Allowlist + deny architecture. Agents run under broad, auditable allow rules for routine read/build/test work, cut by sharp explicit denies. No agent is ever granted blanket autonomy to make the prompts go away.
• Human approval gates. Three categories always stop at a human: destructive actions (deleting, overwriting, force-pushing), outward-facing actions (anything that leaves the household -- posts, emails, published pages), and spend (purchases, paid APIs). This is enforced by the permission system, not by asking agents nicely.

Supporting rules keep the system legible: agents never hard-delete (files move to reversible trash), messages between agents are always labeled with their sender, and an agent that wants to change its own permissions or configuration is refused by design.

Architecture

• A message hub with offline-queued delivery. Agents on different machines exchange messages and files through a central hub; messages to a sleeping machine queue and deliver on wake. A fallback peer-to-peer path stays available if the hub is down.
• Wake-on-mention agents. Family members write in plain markdown notes. An @mention of a machine's agent inside a note spawns a bounded agent session that reads context, does the work, and answers back into the note -- the note is the interface.
• Self-built MCP servers. The fleet's capabilities -- screen driving, messaging, printing, search -- are exposed as typed MCP tools rather than shell scripts, so every action is inspectable and permission-checked. This includes a from-scratch OAuth 2.1 remote-MCP stack implementing RFC 8414 and RFC 9728 with PKCE, so remote agents authenticate properly instead of sharing static secrets.
• Claude skills as the operating manual. Recurring workflows live as versioned skills and standing-rule documents that every agent loads, so behavior is consistent across machines and sessions.

Rollout

The fleet was brought up one machine at a time against a standard rig definition: same directory layout, same permission architecture, same transport verbs, verified on each node before the next. Household-facing features shipped behind the same discipline used at work -- a spec, a build, a cold verification pass, then a human sign-off -- because a family member hitting a broken page is a worse outcome than a stakeholder hitting one.

Governance

Standing rules are written down and versioned, not tribal. The permission architecture is reviewed when it causes friction rather than silently widened. Every incident -- an agent blocked, a wrong assumption, a rule that fought the work -- feeds back into the written rules the same day. The system is governed like a product: feedback captured, rulings recorded, regressions treated as bugs.

Outcome

The network is in daily real use. Non-technical family members get work done through agents without knowing or caring what a terminal is: weekly meal planning runs through an agent-in-the-loop flow (public at food.schuepbach.work), notes answer back when mentioned, and machine-to-machine chores that used to require the household's one engineer now route themselves. The guardrails have held: destructive, outward-facing, and spend actions still stop at a human, which is exactly why the humans keep saying yes to more autonomy everywhere else.

Related: the spec-driven, model-tiered methodology this fleet is built and governed with.