Open source · MIT Windows 10/11 9B on one RTX · 27B on 5090 / RTX 6000 Harness-agnostic Built on FUSOR-1 REV 0 · coming
The operations seam · N agents, one watcher

TOWER

The control tower for your coding agents. One resident mind above Claude Code, Codex, opencode, zcode — holding every session, the machine's own vitals, and the disk's actual record in a single attention state. It clears what's safe. It says wait to what isn't. And when you grant it the writ, it presses tab so you don't have to.

GitHub · clone & compile ↗ Sibling: PROMPTER → The substrate ↗ ← AORTA

FREE FOREVER. NO ACCOUNT, NO CLOUD, NO TELEMETRY. YOUR SESSIONS NEVER LEAVE THIS MACHINE — THE OPTIONAL DEEP TIER IS YOUR OWN KEY, BEHIND YOUR OWN TOGGLE, THROUGH A LOCAL PRIVACY FILTER. THIS PAGE MAKES ZERO NETWORK REQUESTS, LIKE THE PRODUCT.

§ 01

Tab completed your code. Then tab completed your prompts. This completes the tab.

Three years ago, AI completed the next line of code. Now agents write whole codebases, compile, test, iterate — and the best harnesses already suggest your next action, one keystroke to accept. Look at what you're actually doing all day: reading a suggestion the machine computed, and pressing tab.

Your desk · three terminals · 2:47 PM

Harness A has been waiting on a question for 41 minutes — you were in a meeting. Harness B is burning tokens down a path that harness C invalidated an hour ago — B doesn't know; they've never met. And two of them are about to pull models that together exceed your VRAM — each one, individually, is fine.

You are the scheduler, the safety system, and the switchboard — for machines that each think faster than you. The bottleneck in your agent fleet is you, pressing tab.

Why are you sitting there pressing tab?

The suggestion was computed. Your keystroke is latency. TOWER exists to hold the whole board the way you would if you could be everywhere at once — and to press tab, per harness, under rules you signed, while you do something worth your attention.

§ 02

A tower, not another agent. A resident, not a script.

TOWER writes no code and runs no tasks. It is a resident — a small open-weight mind on your own GPU that ingests every harness's stream as it forms, plus the machine's vitals, plus the filesystem's own record, and judges continuously: is anything forming, anywhere on this box, that deserves a wait — or a next input?

Watches

Every session on every harness, live — plus VRAM, disk, RAM, processes, and what actually hits the disk. One reader, whole board.

Clears & denies

At each forming action: SILENT · FLAG · ASK · DENY. The verdict vocabulary has no "allow" — by construction, TOWER can only ever narrow what was already permitted.

Never flies the plane

Pilots keep the stick. The agents do the work; TOWER sequences, clears, aborts, and — at the top rung, under a writ — hands each one its next instruction.

Why it must be resident — the regress, one level up A turn-based coordinator of turn-based agents is a cron job for agents: blind between wakes, it cannot notice that harness B just invalidated harness A's premise while A is mid-run. The thing that decides when to speak to an agent cannot itself be a thing that must be spoken to first. The mind that drives agents is a first hop, and the first hop never takes turns. That is why TOWER is a resident on your silicon and not a dashboard in someone's cloud — and why your sessions, which it must read to exist, never leave the machine.
§ 03

Said. Called. Happened. The three-layer truth model.

Every agent action exists three times: what the agent said it was doing, what it called at the tool boundary, and what happened on the disk. Every gate ever shipped reads only the middle one. The catches live in the disagreements.

Three independent streams, one action. Hooks see only L2 — TOWER holds all three, and their divergences are the product.
L1 ⊕ L2 — intent divergence

"Let me fix the credential mismatch" → deletes a production volume, nine seconds later. The words and the call name different worlds. Partly string-checkable; the resident judges the rest.

L2 ⊕ L3 — side-effect divergence

One declared call; forty thousand writes. A build script deleting what nobody declared. Structurally invisible to every hook-based fence in existence — hooks fire only on declared calls. Reality is a separate stream, and TOWER reads it.

L1 ⊕ L3 — the outcome gap

It reported the build fixed; no artifact changed. It said tests pass; no test binary ever ran. The slowest to check and the most damning when it fires.

L1 alone — the narration-time catch

"I'll pull the 70B and run it beside the training job." No tool call exists yet, so no fence on earth can parse it. Only a mind reading the narration as it forms sees this coming — and TOWER is that mind.

§ 04

What only the whole board can see.

Each harness is blind to the others and blind to the machine. The catches below require holding every session plus the box plus reality at once — which is exactly what no single vendor can or will hold:

The resource aggregate

Harness A pulls a 40 GB model. Harness B starts a training run. Each is individually fine; together the box dies. Same command, fine Tuesday, fatal Wednesday — state-dependent, not text-dependent. No allowlist reaches it.

The write collision

Two agents editing one file — or you editing the file an agent is rewriting. TOWER holds leases: one writer per path per window, arbitrated, ledgered.

The cross-session contradiction

Harness A established the schema is Postgres. Harness B, in another window, is about to act on MySQL. Nobody holds both — except the one mind that reads both.

The stale premise

A's latest output just invalidated what B is still mid-build on. B will burn an hour discovering it. TOWER knows in one boundary.

The forgotten refusal

You said no to this twenty minutes ago. The agent's context compacted; it forgot your refusal. The tower didn't. A catch that gets stronger as sessions age — exactly when agents get weaker.

Why nobody else will ever ship this Anthropic will not gate on Codex's process. OpenAI will not read Claude Code's transcript. Neither will watch your GPU on behalf of a competitor's agent. The vacancy TOWER occupies is made of business boundaries — the most durable kind. On your machine, with your reader, the boundary doesn't exist.
§ 05

The scope: your fleet, one glass.

Today your fleet's state lives in your head and your taskbar. The scope is one surface: every session, its state, its burn, its last verdict — and the machine's vitals under it, summed across everything.

One glance where there were four terminals — and the bottom line is the whole thesis: the suggestion is computed; your keystroke is the label.

Every tab, every edit, every dismissal lands in the ledger as a labeled judgment. That record is how TOWER earns the next rung — and it's yours, on your disk, forever.

§ 06

The ladder: watch → contest → advise → drive.

TOWER ships bottom-up, and every rung is earned by the ledger of the rung below it — never skipped to. The demarcations below are the honest map of what's near and what's the summit:

H0 · WATCH
The shadow. v1

Ledger only. Every action, every would-be verdict, every machine state — recorded, surfacing nothing. Trust is a receipt, not a promise.

H0.5 · FLAG
The card. v1

Surfaces what it would have said — the scope goes live. Still blocks nothing.

H1 · CONTEST
The fence. v1

ASK / DENY at the tool boundary, floor + resident together. Its only power is stop — it can prevent, never cause. The deterministic floor holds even if the mind is down, and the absence is ledgered.

H2 · ADVISE
One tab for the whole fleet. v2

TOWER proposes the next input per harness; you accept with one key. The keystroke is the label — a same-minute verifier for the rung above, accruing from the day this ships.

H3 · DRIVE
The tower presses tab. The aspiration

Under a writ — standing authority you signed, per-harness envelope, expiry, hard-stop, full receipts — TOWER issues next inputs itself and runs each harness in a complete loop while you're away. N agents, one direction, zero babysitting. This rung is not a feature; it's a threshold: auto-tab switches on per-harness, per-context, only where the measured acceptance rate at H2 clears a pre-registered bar — and it carries an expiry, a forever-sampled human review, and demotion on drift. The number is the case for it. Until the number exists, this paragraph stays labeled what it is.

The tab doesn't disappear. It ascends — from accepting actions, to accepting inputs, to signing the writ. The last tab you press is the writ.

§ 07 Designed · v2

A 9B can't drive your fleet. It doesn't have to.

The resident's job was never to be the genius — it's to be present: to hold every stream, notice the moment, and know when a moment deserves more mind than it has. The thinking splits two ways, like a hybrid drivetrain:

The reflex — local, always

9B on one RTX card (27B-class on a 5090 / RTX PRO 6000) reads everything, judges at every boundary, fires the fence in milliseconds. This layer never sleeps and never leaves.

The counsel — yours, optional

Bring your own key — Anthropic for depth, Cerebras for speed, DeepSeek for price. When stakes are high and the reflex knows it's out of its depth, the moment escalates: the resident owns when; the frontier writes what. Text-only egress, through a local privacy filter, behind your toggle. Remove the key: the full product remains.

That division is the whole answer to "is the local model smart enough to drive": the intelligence is rented by the call; the presence can't be rented at all.

§ 08

The floor: model-free, always on, readable by a human.

Beneath the mind sits a deterministic floor — a signed, human-readable policy file. It runs even if the resident is down, and it catches the enumerable half without asking any model's opinion:

Destructive & irreversible

rm -rf · DROP TABLE · migrate reset · force-push · volume deletes · targets with no VCS coverage.

Env-var resolution

Expands $VARS before judging: the connection string that quietly resolves to production — in the famous case, on a command the developer had already approved.

Machine-global resource

Declared allocations vs live free VRAM / disk / RAM — summed across every harness, including the sequence where each step passes and the total kills the box.

Scope, secrets, side-effects

Writes outside declared directories · touches on .env / keys / tokens · and the L2⊕L3 class: actual disk activity outside any declared call's scope.

Floor proposes, resident selects. And the deepest fence isn't any harness's API — it's the OS process boundary itself, which no vendor update can move: a denied action stays denied in the only place evasion can't reach.

§ 09

The tower's own rules.

TOWER will never
  • Write code or run tasks itself. It clears, sequences, and aborts. It does not fly the plane — at any rung, including the last one.
  • Widen a permission. The word "allow" is unreachable in its code. It can only ever narrow what your harness config already permits.
  • Ship your sessions anywhere. Zero egress by default; the optional deep tier is text-only, filtered locally, on your key, behind your toggle.
  • Teach evasion. Verdicts split by audience: the agent sees a constraint ("do not modify outside ./src"); only you see the detection that fired. A naive supervisor trains its agents to hide; TOWER is built not to.
  • Modify its own rules quietly. The policy floor and its config are hashed at startup; every change is ledgered. Off is off.

And the boundary that runs the other way: you can overrule any verdict in one keystroke — and every override is a label that teaches it your judgment, locally, in a record you own.

§ 10

Built for whoever signs for the agents.

The ledger

Append-only, hash-chained, local: every agent action, every verdict, every override, every proposed input and what you did with it. When someone asks "what did the agents do on this machine, and who approved it" — the answer is a file, not a memory.

The metric

Not catch rate. Concurrent harnesses per operator, and unsupervised agent runtime per operator glance — both computed from the ledger from day one. "Your engineer checks in twice an hour instead of every ninety seconds" converts to salary without a story.

§ 11 Measured — substrate

The plate.

TOWER rides the FUSOR-1 resident substrate. These are the substrate's bench ratings — measured, dated, receipted in the reference build's public runs ledger:

QuantityRatingReceipt
Thought-boundary detection (judge exactly where a claim completes)0.97 vs 0.02ingest logits, free
Completed thought → judged~44 msone-token probe
Lag under a real workday's stream~327 msworkday replay, 1×
Abort a forming action13 µsbranch kill
Three seats, one attention state1.208×worst-case co-decode
Honest recall across a working day≥ 98,304 tokmulti-hop spans
Live judgment on real streamsfirst hours bankedignition receipt, 2026-08-12

REFERENCE BENCH: ONE RTX 4070 Ti SUPER (16 GB) · 9B-CLASS OPEN WEIGHTS · WINDOWS. TOWER-SPECIFIC NUMBERS DO NOT EXIST YET AND THIS PAGE WILL NOT PRETEND THEY DO. CAPACITY AT N HARNESSES PLUS THE REALITY LANE IS PRE-REGISTERED FOR MEASUREMENT BEFORE THE FENCE SHIPS; THE ADVISE AND DRIVE RUNGS WEAR THEIR TAGS UNTIL THE TAPE SAYS OTHERWISE.

On the FUSOR-1 substrate

TOWER is a fit: the open resident-kernel substrate pointed at the operations seam — the same engine behind PROMPTER (your meetings) aimed at your agents. The loop, the bus, and the laws live at fusor1.com.

§ 12

Free. Yours. Compile it yourself — that's the point.

In a tool that reads every agent session on your machine, "trust us" is not an installer. TOWER is MIT-licensed source you build, with open weights you choose, on the machine it will guard.

# what it takes OS Windows 10/11 GPU one NVIDIA RTX card, 16 GB VRAM → 9B-class weights 24–32 GB (RTX 5090, RTX PRO 6000) → 27B-class weights, same binary Harnesses Claude Code (hooks) · opencode (plugin) at launch — adapters are one file each; the fence outlives any harness Deep tier optional: bring your own key (Anthropic / OpenAI-compatible / Cerebras / DeepSeek) · text-only · local privacy filter · your toggle Build CMake + Visual Studio 2022 · C/C++20 · deps vendored, no package manager Runs as towerd (a resident service) + the scope (one glass surface) Network none required. Air-gapped is a supported configuration. # get it git clone https://github.com/bochen2029-pixel/tower cmake -S . -B build -G "Visual Studio 17 2022" -A x64 cmake --build build --config Release build\Release\towerd.exe --watch # rung zero: sees everything, touches nothing

STATUS: REV 0 — THE SUBSTRATE IS PUBLIC AND MEASURED; THE TOWER FIT IS BEING EXTRACTED FROM THE REFERENCE BUILD. RUNGS RELEASE IN ORDER — WATCH, THEN THE FENCE, THEN ADVISE — AND EACH IS EARNED BY THE LEDGER OF THE ONE BELOW. COMING SOON MEANS COMING: STAR THE REPO OR CHECK BACK. EVERY CLAIM ON THIS PAGE STAYS PINNED TO WHAT THE TAPE CAN BACK.

The tower doesn't fly the plane.

Your agents each have a mind and no reflexes — and no vendor will ever ship the thing that watches a competitor's process on your machine. TOWER is that thing: one watcher over the whole fleet, a fence that can only say wait, a scope that shows you everything — and, when the numbers earn it, the tab pressed for you.

Tab completed your code. Tab completed your prompts. TOWER completes the tab.
Built on FUSOR-1 · sibling of PROMPTER · the estate's laws apply: measured, or labeled a bet.