Baresquare · agent patterns

The shadow worker — an email agent that never sends

An hourly AI agent that reads a client-services inbox, drafts what it would reply — grounded in a curated knowledge base — and posts every draft to Slack for human review. It never sends anything. The team's emoji reactions teach it.

● Pattern in production since June 2026

The loop

1

💻 One door in

The agent lives in its own walled macOS account on an always-on Mac mini. Files reach it only through an admin-controlled path from the owner's machine — no shared folders, no repo it pulls.

2

📥 Hourly inbox parse

A LaunchDaemon wakes every hour — reboot-proof, nobody logged in. A small deterministic script pulls new mail from the agent's own mailbox over IMAP. Zero AI cost.

3

📚 A citable knowledge base

Answers are grounded in a sectioned knowledge facility — specs, precedents, an answer protocol with hard anti-hallucination rules. The agent reads a snapshot; the canonical copy stays with the owner.

4

🤖 AI judges — only when there's mail

Claude (headless CLI) classifies each email — real inquiry, ticket, automated alert, admin — and decides: a cited draft reply, a housekeeping action, or a routing note. A quiet hour costs zero tokens. It never sends.

5

💬 Slack, one post per email

Every verdict lands in a private review channel as its own message — deliberately one-by-one, so each can be emoji-reacted and thread-replied individually.

6

🎛️ Humans react — it learns

The same hourly tick collects reactions and comments, acknowledges in the thread, proposes numbered standing rules, and re-drafts escalated items that hour. Only the owner's 👍 makes a rule permanent.

The feedback grammar — two-second corrections

Correctcounts toward calibration
🟡
Almostadd the edit in a thread reply
Wrongbecomes a candidate rule + an eval case
🔥
Escalatereal client request — corrected draft re-posted
👍
Adopton a rule-proposing ack; owner only

How it's organized

On the agent

  • queue/ fetched mail → pending / judged
  • outbox/ → posted/ verdicts & acks, before/after Slack
  • feedback/ every reaction & comment, verbatim, with provenance
  • RULINGS.md standing rules — read every tick; adoption is owner-gated
  • ledger.jsonl an append-only audit trail of everything
  • facility/ the knowledge-base snapshot the drafts cite

The learning lifecycle

  • Reaction/comment → captured verbatim on the next tick
  • Agent acks in-thread: what it understood, what changes
  • Generalizable corrections → numbered candidate rules
  • Owner 👍 → adopted; rules bind every later draft
  • Weekly: adopted rules migrate into the canonical knowledge base
  • Every ❌ becomes a gold case in the eval bench that gates shipping

The principles that make it safe

🚫Shadow mode: drafts and Slack posts only — the agent never sends email, never modifies the mailbox.
🧱Kernel wall: a Standard macOS account — the blast radius of any mistake is the agent's own home folder.
⚙️Deterministic before intelligent: fetching, posting, bookkeeping are plain scripts; the LLM wakes only for judgment.
Owner-gated learning: corrections become candidates; only an explicit human 👍 adopts them — the agent cannot rewrite its own instructions.
🛑Kill switches: a panic file any admin can touch, plus a durable launchd off-switch.