§ AI agents you actually own · v2.0.0 · MIT
Your agents live in someone else’s platform. ‸a folder you own.
Fair Copy runs your AI agents as plain markdown files, in a folder on your machine. Readable in any editor. Hard cost caps checked before every call. Every run on the record. The runtime is disposable; the agents are yours.
Built to run a fleet. Perfect for a fleet of one.
fair copy /ˈfɛə ˌkɒp·i/ n. — the clean, final manuscript against which every other version is checked. Your agents are the fair copy: canonical, readable, versioned. This framework just runs them.
This is the entire agent.
- # IDENTITY.md
- name: Caldwell
- role: Financial research agent
- model: claude-sonnet · cap $4.00/day
- ## Voice
- Direct. Cites sources. Flags
- uncertainty instead of hiding it.
- ## Boundaries
- - Never moves money.
- - Every recommendation lands
- in the journal.
Kill the runtime. The agent doesn’t notice.
Everything stateful lives in the agent’s folder: markdown and JSONL you can open in any text editor. The runtime only executes. Stop it. Move it to another machine. Swap cron for an MCP server or an HTTP service. When it comes back, it’s the same agent, because the files are the same files.
There’s no export button, because there’s nothing to export. No migration, because there’s nowhere to be trapped. The folder is the agent.
tree sha256 9f3c1b…41e2unchanged
There was nothing to lose.
runtimes killed: 0 · agents lost: 0
Never wake up to a bill you didn’t approve.
Every LLM call passes a cost guardrail before it runs, not after it bills. Delegation is tree-capped: a child agent can never spend past what its parent has left, so running an army can’t bankrupt you. Batches reserve their worst case up front. Per-agent caps hold the line. When a call would blow the budget, it’s refused before the money moves, and the refusal goes in the record.
Checked before, not billed after
The guardrail runs ahead of the first token, and again every turn.
Tree-capped delegation
child_cap = MIN(child_remaining, parent_remaining). An army spends one budget.
Worst-case reservations
Parallel helper batches reserve their ceiling before dispatch.
- ## Cost guardrails
- cost_guardrails:
- daily_cap_usd: 4.00
- per_call_cap_usd: 0.50
Nothing happens off the record.
Every run writes a JSONL line with a run_id. Every helper, tool call, and delegation writes its own line, linked to its parent. Provenance rolls up automatically: who called what, what it cost, what came back. Six months from now, you answer “why did the agent do that?” with a grep, not a support ticket.
- {"run_id":"run_9f21","agent":"caldwell","cost_usd":0.031,…}
- {"run_id":"run_a03c","parent_run_id":"run_9f21","type":"tool_call",…}
- {"run_id":"run_a03d","parent_run_id":"run_9f21","type":"delegate",…}
- {"run_id":"run_a03e","parent_run_id":"run_a03d","type":"helper",…}
Layers you can read. Config you can diff.
An agent is composed from layers, and every layer is a file.
Persona
A cascade of identity files. Who the agent is, in prose, under version control.
Tools
A new tool is about ten lines. Registered in markdown, audited like everything else.
Skills
Lazy-loaded by design. The model pays context for knowing a skill exists, not for its whole body.
MCP
Plug in external tool servers with one section in a markdown file.
Memory
Atomic notes plus a wiki, with index-driven recall: load the two notes that matter, not thirty thousand tokens of everything.
Journal
The agent’s own working record, kept in its own folder.
Delegation & helpers
A coordinator hands work to specialists; helpers fan out cheap parallel work. One level deep, on purpose. Auditable beats clever.
All of it is markdown. Edit it in vim, in Obsidian, in Notepad. There is no admin panel, because your file manager already is one.
It gets sharper while you’re away.
Most agents reset to zero every time you close the tab. A Fair Copy agent is built to accumulate: it keeps a memory of you, holds the objectives you set it, and reflects on its own work between runs. The agent you have in three months is not the agent you scaffolded. It’s the one that’s been paying attention.
Goals
Set a standing objective and the agent works toward it across many runs, keeping its own history in a file you can read. Not one prompt: a lasting intent.
Dreams
Between runs, the agent reflects on its own work and memory, and gets sharper on its own. Background passes you never have to trigger. You come back to an agent that spent the quiet hours thinking.
- # Dream pass · 03:12
- Reviewed 14 runs since Monday.
- Merged three notes on the same
- rate-limit bug into one.
- Pinned the client’s fiscal
- calendar to INDEX.md; I kept
- re-deriving it.
- Next: cite filings by accession
- number, not by headline.
Long work, done properly.
Conductor runs durable, resumable playbooks: multi-stage pipelines that survive restarts. Put a human-approval gate between any two stages and the run suspends until you sign off, then picks up exactly where it left off. Conflicting runs queue instead of colliding. It’s the difference between “the script died at step 7” and “the run is waiting on you.”
resumes where it left off
A Mac mini is not the demo. A fleet is not the upgrade.
One agent on the machine under your desk runs the same framework as a thousand agents across an org. Same files, same code paths. You’re not running the toy version; there isn’t one. The engineering it takes to keep a fleet honest is the engineering that keeps your one agent honest.
And if one agent someday becomes ten, or becomes a business: you register different backends, and that is the entire difference. Nothing to rewrite, because there’s nothing to rewrite.
Backends: filesystem. Config: none.
Backends: Postgres, Redis, cloud secrets. Agents: unchanged.
Swap the engine. Keep the agent.
Twenty-two backend protocols stand between your agents and the machinery that runs them. Start on the filesystem with zero configuration; everything works on one machine, out of the box. If you outgrow it, register Postgres, pgvector, Redis, or a cloud store, and change nothing about your agents. Not a line. Not a file.
22 protocols · 0 config to start · 0 agent changes to scale
| № | Protocol | What it governs | Starts as | Scales to |
|---|---|---|---|---|
| 01 | MemoryFilesystem → Postgres + pgvector | What the agent knows and recalls | Filesystem | Postgres + pgvector |
| 02 | LLMAnthropic → OpenAI · Vertex · more | The model behind the agent | Anthropic | OpenAI · Vertex · more |
| 03 | EmbeddingsOpenAI → pgvector | Semantic recall | OpenAI | pgvector |
| 04 | JudgePolicy rules → LLM judge | Quality evaluation of outputs | Policy rules | LLM judge |
| 05 | LogJSONL files → SQLite · Postgres | The run ledger | JSONL files | SQLite · Postgres |
| 06 | LockFilesystem → Redis | Concurrency control | Filesystem | Redis |
| 07 | SecretsFilesystem → GCP Secret Manager | Credentials, out of your files | Filesystem | GCP Secret Manager |
| 08 | QueueFilesystem → your queue store | Work waiting its turn | Filesystem | Your queue store |
| 09 | IdempotencyFilesystem ledger → shared store | Never run the same job twice | Filesystem ledger | Shared store |
| 10 | ConversationFilesystem → Postgres | Multi-turn state | Filesystem | Postgres |
| 11 | IdentityLocal principal → claims-based auth | Who’s calling, fail-closed | Local principal | Claims-based auth |
| 12 | GoalFilesystem → shared store | Long-running objectives | Filesystem | Shared store |
| 13 | OutcomeFilesystem → shared store | Results of dispatched work | Filesystem | Shared store |
| 14 | JournalFilesystem → shared store | The agent’s own record | Filesystem | Shared store |
| 15 | PersonaFilesystem → central store | Identity files, cascaded | Filesystem | Central store |
| 16 | Agent ProfileFilesystem → SQLite | Per-agent configuration | Filesystem | SQLite |
| 17 | Tool RegistryFilesystem → SQLite | What the agent may do | Filesystem | SQLite |
| 18 | CorpusFilesystem → SQLite FTS · pgvector | Reference documents, full-text search | Filesystem | SQLite FTS · pgvector |
| 19 | PolicyFilesystem → central store | Rules of engagement | Filesystem | Central store |
| 20 | MandateFilesystem → central store | Spend authority | Filesystem | Central store |
| 21 | MCP RegistryFilesystem → HTTP registry | External tool servers | Filesystem | HTTP registry |
| 22 | Agent RegistryFilesystem → central store | The fleet roster + governance | Filesystem | Central store |
Every protocol ships with a reference implementation, a conformance test suite, and a locked spec document. Build your own backend against the spec; the framework can’t tell the difference. Not a feature you rent: a contract you hold.
See the whole shelf.
The Fleet Console is one screen for everything you run, whether that’s three agents or three hundred. An attention queue surfaces the agents that actually need you. Cost, quality, and reliability trends, per agent and across the fleet. A health score from 0 to 100 you can put on a wall. And a recommendations engine that reads your own telemetry and tells you where you’re overspending, where quality is slipping, and where governance has gaps. With receipts.
12 agents tracked
3 flagged · as of today
7-day trend
Attention queue
- ⚠ researcher-2 · cost spike · +38% w/w
- ⚠ summarizer-1 · quality dip · -12% w/w
- ⚠ archivist-3 · governance gap · owner unset
REC · move summarizer to a cheaper model. Est. save $41/mo.
Running this for a team, or for clients? That’s what we do at DPIC. →
Lock-in dies at the spec layer.
Fair Copy is an open specification first: fifty-plus locked spec documents that define exactly how agents, memory, provenance, and every backend protocol behave. The Python package is one conforming implementation. Build your own in Rust, in Go, in whatever comes next; your agents won’t care. That’s what “no lock-in” means when you say it all the way down.
50+ locked spec docs · 22 protocol contracts · 1 reference implementation · 0 proprietary formats
Make the fair copy.
Your agents, in your folder, on the record. Two commands from here to your first one.
v2.0.0 stable · MIT license · 22 protocols · 50+ spec docs · 6,000+ tests