Stay on the current district and jump straight to the street-level page you need.
Atlas stays easier to scan when the route map reads like navigation first. Start with the lane that matches your question, then expand the full page-job model only when you need the deeper contract details.
Rationale layer for why the network is shaped this way and what tradeoffs drove it.
Change pace: Changes slowly. The model matters more than day-to-day churn on these pages.
After the rationale is clear, switch to the system page or route owner that applies it in practice.
Open InfrastructureUse these pages when you are still orienting and need the safest first click before you pick an owner or system.
Use these pages when your real question is who should handle the work, how it moves, or which charter owns the surface.
Use these pages when you need the map, structure, services, and interfaces behind the network instead of the people or routing rules.
Use these pages when something feels broken, you need a concrete next check, or you need the live-status companion surface.
This lane is the shortest path from “I see the current system” to “which decisions created it?” It keeps the ADR layer foregrounded instead of making you scroll through history first.
Each agent is a full OpenClaw gateway with independent state, tools, and memory. No shared runtime. Agents coordinate through explicit messaging, not shared state.
Why: Isolation prevents cascading failures. One agent crashing doesn’t affect others. Clear boundaries make debugging and reasoning easier.
All agent-to-agent communication goes through the Bridge. No hidden channels. All coordination patterns are documented and observable.
Why: Makes the system understandable and debuggable. You can trace every interaction through observability events.
Complex tasks are broken into sub-tasks handled by specialized agents or tools (Codex for code, Recall for search, advisor for planning).
Why: Right tool for the job. Smaller, focused contexts perform better than one giant agent trying to do everything.
Every service automatically emits telemetry into the OpenObserve-backed stream, with Watchtower layering operator-facing expected-state context on top.
Why: You can’t improve what you can’t measure. Observability is built-in, not bolted-on.
Not all agents operate at the same autonomy level. The Saffron Network uses three tiers to define how much unsupervised action each agent class is permitted. Tier assignment reflects the type of work, not importance — all tiers are necessary.
Task specialists that build, design, advise, and automate within their domain. They act on instructions and their own backlog, but significant decisions get routed through Atticus before shipping.
Pipeline stewards that maintain system health with high autonomy for bounded, bookkeeping tasks. Higher autonomy than Domain agents — but strictly scoped to pipeline mechanics, not decisions.
Policy authority and institutional memory. Atticus is the only agent that can approve or reject proposals from other agents — including Domain and Operator tiers. The ledger is permanent.
Dexter (Labs Leader) operates on direct surfaces — Slack, Notion, CurryChat — and Buzz (Distribution & Market-Signal) on Bridge and CurryChat, the pair's shared direct surface — rather than through dedicated OpenClaw gateway ports. They don't fit neatly into the three gateway tiers because their trust boundary is defined by the surface they operate on, not by a gateway isolation layer. Humans approve all public/outbound actions, with one carve-out: Buzz manages Reddit Ads with trusted read/write.
Each agent runs in its own Docker container with isolated filesystem, network namespace, and resource limits.
All agents run on a single Mac mini (Jake's local machine) rather than distributed cloud infrastructure.
Agent-to-agent messaging uses the Bridge CLI tool, not direct HTTP calls or message queues.
bridge.ts target "message"Shared live telemetry infrastructure that all services instrument automatically. OpenObserve carries the stream, and Watchtower applies the operator-facing interpretation.
Scout and other autonomous agents run on scheduled cron cycles (every 4 hours for project charters), not continuous loops or event triggers.
Reusable agent capabilities are packaged as "skills" (markdown docs + scripts) rather than fine-tuning or prompt injection.
All shared services (Recall, Observability, Bridge, etc.) live in the Saffron monorepo (lambda-curry/saffron) under packages/, published as @lambda-curry/currykit-* to GitHub Packages.
Policy enforcement and decision governance live in a dedicated agent (Atticus), not embedded in every agent's prompt. Agents consult Atticus before taking significant actions.
auto-approve, needs-human, or denyservice: "atticus" eventsVisual quality is a first-class architectural concern, not an afterthought. A dedicated design agent (Meg) owns the design system, and a two-level visual verification loop (Storybook + Playwright at component level, vision model at app level) gates every UI merge.
Observed directly: agent-built backends are often one-shot perfect (APIs tested, everything working), but frontends arrive "completely unusable" — cut-off content, horizontal scrolling, wrong CSS framework despite explicit instructions. Agents write correct code without producing usable software, because they don’t experience UIs. The same pattern was seen independently across multiple LC projects (Watchtower, Atlas, client rebuilds).
The initiative pipeline (Seeds → Work Items → harvest) is owned by a dedicated lifecycle operator agent (Grafton), separate from the domain agents (Clawdy, Scout, Currybot, Meg) that do the actual work and the governance agent (Atticus) that enforces policy. Grafton does not build, design, or decide — it tends the garden: checking readiness gates, promoting initiatives, and closing the harvest loop.
Grafton operates at Operator tier — higher autonomy than domain agents for pipeline bookkeeping (promotes Seeds, creates Draft Seeds, updates Notion fields), but strictly bounded: it never approves its own promotions, never assigns work without human confirmation, and escalates all gate decisions to sponsors or Jake. It is the enforcer of criteria, not the setter of them.
All Saffron charters (product tools and process pipelines) are centrally declared in registry/projects.json with a typed schema. This becomes the authoritative source for charter name, owner agent, domain, workspace path, trigger type, and status — eliminating drift between documentation, routing logic, and what actually exists.
Docker containers are named after the agent they run, not the original experiment or service name. lc-openclaw → lc-currybot and lc-experiment → lc-scout (Mar 6, 2026).
lc-openclaw referred to the OpenClaw framework, not what was running inside — misleading to new team memberslc-{agent} across Compose and DockerfilesAll agent Dockerfiles, docker-compose.yml files, and entrypoint.sh scripts live in saffron/services/docker/<agent>/ — not in the agent workspace repos or scattered across the host. A shared tooling snippet (_shared/tooling.layer.snippet.Dockerfile) provides the common tool layer (bun, gh, Playwright, Codex CLI) to any agent that needs it. The Atticus Dockerfile was the final migration to complete this pattern (Mar 7, 2026). Since the 2026-06-28 launch-dir migration, the live edit point is the saffron root itself — edit and recreate from each agent's services/docker/ directory (live-verified 2026-07-10); the earlier Atticus-clone lane is retired.
~/lc-* dirs — hard to diff, review, or coordinate changesagents/) and their containers (services/docker/)All agents build FROM openclaw:local. The legacy lc-base:local image is retired.
The five dockerized agents (Scout, Atticus, Meg, Grafton, Samwise) route their memory_search calls to the host QMD server via remote HTTP rather than relying on a local QMD instance inside each container. Host-level surfaces such as Clawdy and Currybot query that same host QMD directly rather than through a separate container. Each containerized agent is assigned a unique auth token (QMD_AUTH_TOKEN=qmd-<agent>-<token>) and an agent identifier (QMD_AGENT=scout, etc.). The QMD server runs on the host at port 8790 and is reached via host.docker.internal:8790.
qmd-manager.tsThe dockerized agents now share the same QMD view as the host-level assistant surfaces. A Notion page indexed once by RAG Sync is immediately queryable by any agent, whether it runs in a container or through a host-level gateway. The Knowledge Layer is truly network-wide, not per-process.
The standard LC Docker agent toolbelt (bun, uv, Codex CLI, agent-browser, Playwright, gh, jq, ripgrep, ffmpeg, imagemagick, python3, qmd shim, git/SSH bootstrap) is now baked directly into the openclaw:local base image. The shared tooling.layer.snippet.Dockerfile is deprecated and no longer pasted into individual agent Dockerfiles.
bun: not found) when creating new agents from minimal templatesbun / bunx, uv, agent-browser, @openai/codex, Playwright + Chromium, gh, jq, ripgrep, ffmpeg, imagemagick, python3, curl, unzip, qmd shim (remote HTTP), standard git safe.directory + SSH known_hosts + cache dirs.
The packages/delegate completion notification now includes the working branch, GitHub repo/branch links, and Cloudflare Pages preview URLs (or production URL for main). These fields are forwarded from the CLI through to notify-completion.ts as part of the CompletionPayload.
wrangler pages deployment list at notification time — always points to the current branch's deploymentpackages/delegate canonical source pattern (ADR #15) — no changes needed to agent-specific codelambda-curry/saffron-starter → saffron-storybook.pages.dev | lambda-curry/lc-classic-starter → lc-classic-storybook.pages.dev
“Every project needs its own design language. It might not be a dedicated design agent — it might be an agent that helps projects find their design language.” — Jake Ruesink
The Saffron Network wasn't designed all at once — it grew agent by agent, each one filling a gap the previous generation exposed. This timeline shows the order in which each agent was added and the reasoning behind it.
Jake needed a capable personal assistant — not a chatbot, but a proper agent with shell access, memory, and messaging.
Clawdy launched as Jake's primary assistant. Full tool access, Signal/WhatsApp/Telegram integration, persistent memory via QMD.
Proved the model: an agent with real tools and real memory is categorically more useful than a stateless chatbot. Established the pattern every future agent would follow.
Clawdy handled Jake's personal context well, but the LC team needed their own agent — for PR reviews, team queries, and shared workflows.
Currybot launched on the LC team Slack. Automated PR reviews, standup summaries, GitHub webhook responses. Separate identity from Clawdy — team-facing, not founder-facing.
Demonstrated that agents scale horizontally: same platform, different identity and access scope. One agent per concern, not one agent for everything.
Clawdy and Currybot were reactive — they responded to messages. No agent was proactively exploring, building, or improving the system without being asked.
Scout launched as the first cron-driven autonomous agent. Self-directed work cycles: research → build → log → report. Sandboxed in Docker. Launched with four standing charter loops (Watchtower, Atlas, Forge, Anvil) plus a direct-product-charter lane — the standing family has since grown to five, with Podcast Platform now a recurring Scout charter.
Demonstrated autonomous compound value: each Scout cycle builds on the last. Established the charter-family pattern, where one agent can keep recurring loops healthy without giving up room for newer product work under the same identity.
As autonomous agents accumulated more capability, there was no systematic way to verify that proposed actions aligned with LC's goals and values. Human review didn't scale.
Atticus launched as the network's governance authority. Agents route significant proposals through Atticus before acting. Permanent decision ledger. Escalation to Jake when human input is required.
Closed the trust gap between capable agents and appropriate authority. Made the system auditable. Established the Atticus Gate pattern — a forcing function for alignment before action.
Agents building UIs independently produced technically correct but visually inconsistent output. No shared design language meant every project reinvented spacing, tokens, and components.
Meg launched as LC's design engineer and design authority. Generates PDLPs (Per-Project Design Language Profiles) before build work begins. Runs visual audits via Playwright + vision model. Leads Storybook component reviews.
Closed the design language gap. Now all agent-built UIs share the same token set and component patterns. Visual quality is enforced mechanically, not by human review.
The Seeds-to-Work-Items pipeline existed, but no agent was responsible for keeping it moving. Seeds stalled, harvest loops were missed, and pipeline health required manual attention.
Grafton launched as the network's sixth agent and first Operator-tier agent. Hourly sweeps, nightly observation, Sunday weekly reflection. Promotes Seeds through gates, runs harvest loops when Work Items complete, reactivates Dormant Seeds.
Operationalized the 'every harvest plants the next seed' principle. The initiative pipeline now runs itself. Grafton established a new trust tier — Operator — for high-autonomy pipeline stewardship that doesn't require Atticus gating.
As Scout delegated more implementation work to Codex and other coding agents, the handoff layer between 'Jake asks' and 'code ships' grew thin. No agent owned the advisory space — intake triage, execution reporting, and the bridge between operator intent and delegated delivery.
Samwise launched as a Domain-tier advisory and delivery agent. Manages intake triage, runs execution reporting, and serves as a delegation target for Clawdy's implementation tasks. Multi-tenant reporting app proves Domain agents can ship reader-facing product software, not just run cycles.
Closed the advisory gap between operator intent and delegated execution. Established that Domain-tier agents can own both process and product surfaces simultaneously.
The network could build, govern, and operate — but it couldn't honestly test new product ideas or reach audiences. Every idea felt equally worth pursuing because nothing validated or killed them. And once something was built, no agent owned the path to users.
Dexter launched as Labs Leader to guide experiment design, validation, and honest assessment of ideas. Buzz launched as Dexter's distribution counterpart — finds audiences, designs approved distribution experiments, and manages Reddit Ads with trusted read/write. Dexter operates on direct surfaces (Slack, Notion, CurryChat); Buzz on Bridge and CurryChat — the pair's shared direct surface — rather than gateway ports.
Introduced the Labs agent pattern: chartered agents on direct surfaces with trust scoped to the platform rather than the gateway. Humans approve all public/outbound actions. Brought the network to nine agents and completed the build-govern-operate-test-distribute loop.
npx anvil audit), fully proprietary. Where Forge builds the workspace, Anvil refines the rules inside it.#saffron-updates only when something needs attention. Critically, Grafton enforces gates without being the decision-maker: sponsors and Jake approve promotions; Grafton ensures the criteria were actually met.The key principle: start simple, add complexity only when needed, and always have a clear reason for the tradeoff.