SEC·I † YMIR † SELF-HOSTED DAEMON

YMIR

Ymir is a self-hosted agentic-AI daemon on a Mac Studio: launchd-managed, watchdog-supervised, running 24/7. This page walks the architecture layer by layer.

SEC·II † KERNEL † PROCESS TABLE

KERNEL

The core is an asyncio agent kernel that treats agent work the way an operating system treats processes. Every job gets a row in a process table. A multilevel feedback queue (MLFQ) schedules that table: short interactive work keeps priority, long-running work sinks to the slower queues.

Per-job accounting closes the loop: each row records what the job consumed.

SEC·III † PLUGINS † PROTOCOL

PLUGINS

Capability lives in plugins. The kernel discovers them at boot; the current scan finds 60+. Every plugin implements the same Protocol contract, so the kernel loads, routes, and supervises each one the same way.

An intent router reads each incoming message and hands it to the plugin that claims the intent. Skills inject at dispatch: when a market-brief job runs, the market-brief skill loads into that job alone.

SEC·IV † TRANSPORTS † THREE DOORS

TRANSPORTS

Three transports reach the kernel. iMessage carries the primary line. A web app rides the tailnet. A guest tunnel opens a narrower public surface, and the public door at ymir.ilovemcars.com sits behind Cloudflare Access SSO.

Whatever the door, the path is the same: transport to router, router to gate, gate to plugin, and the reply walks back out.

SEC·V † SECURITY † DENY-BY-DEFAULT

SECURITY

The security model is deny-by-default. A capability gate narrows the toolset per plugin principal before the job runs: the plugin keeps the tools its work needs and loses everything else. One line from the boot log:

capability gate narrowed tools principal=morningbrief dropped=Read,Glob,Grep kept=WebSearch

Actions land in a hash-chained audit log. Each row carries prev_hash and hash, so every row seals the one before it and an edit to any row breaks the chain after it. Tamper-evident by construction.

Around the gates: token auth, spend caps, per-client token buckets on the guest surface, and a guest consent ledger.

SEC·VI † RELIABILITY † SELF-WATCH

RELIABILITY

The daemon watches itself. A watchdog holds the heartbeat and restarts the process when it stops. A healthcheck and a self-monitor run inside as standing checks.

An integrity manifest covers its whole source tree. Drift raises a flag; re-baselining the manifest is a deliberate act.

An iCloud backup job keeps state recoverable off the machine. Provider-health tracking keeps a running read on the upstream providers.

SEC·VII † THE DOOR

THE DOOR

Everything on this page is running while I write it. The chat door is open at chat.ilovemcars.com: a live line to the daemon itself. I build systems like this end to end, and I run what I ship.