MetaGen Auto
An AI council you can actually govern.
A human-directed council of 11 AI agents that deliberates on real project work, grounded in live data, and cannot merge its own code on its own authority. A Next.js 16 command hub on Vercel drives a Python AG2 council on Render over an SSE bridge, and every deliberation ends in an executable action that actually changes the system, behind a human-in-the-loop boundary. Serving real traffic since June 2026, held to a 336-gate verification slate.
Governed autonomy beats raw autonomy
Most agent demos chase full autonomy and quietly let the model touch production. MetaGen Auto takes the opposite bet: keep a human in command, make every agent action grounded and reversible, and never let the AI merge its own code.
The operator opens a browser command hub and asks the council what to work on next. All eleven agents respond from distinct analytical angles, each grounded in the live ticket board. Their synthesis ends in a concrete next step that, when taken, files a real ticket through the validated API. Deliberate → converge → act → the board changes.
Two owners, one stable contract
A TypeScript front of house and a Python council back of house, joined by a single streaming contract, so each side can evolve without breaking the other.
Next.js 16 command hub
App Router with a server-side /ag2/[…] bridge proxy and /api/* routes that keep keys off the client. A privileged operator dashboard, ticket board, mission control, artifact gallery, and a multi-panel agent workspace sit behind auth.
Python AG2 council
A star-topology orchestrator built on AG2 0.13.4, now running as a Docker service on Render behind a bridge token. Socrates is the hub and sole human-facing synthesizer, specialist spokes deliberate, and a dedicated adversary steelmans the rejected option before any decision.
SSE bridge
A Server-Sent-Events stream carries council turns, telemetry, and bridge health into the hub in real time, the one interface both owners commit to.
Live data, cited
MongoDB Atlas holds tickets, missions, artifacts, logs, and durable council turns, and a Chroma Cloud corpus provides a cited RAG layer including an attributed book-quote collection. Deliberations reason over the real board, not a fixture.
Eleven agents, one human-facing voice
A star hub-and-spoke council with selective routing and a loyal opposition. Each agent argues from its own lens, and Socrates converges them into a single recommendation.
Glaucon is the loyal opposition: it steelmans the rejected option and names the failure mode before the human gate, then concedes when the case holds.
Hub-and-spoke council with a loyal opposition
Socrates anchors the hub. Four farm leads and five specialist lenses each weigh in from a distinct angle. Glaucon steelmans the rejected option before any human approval. Every deliberation ends at a human gate.
What the council actually does
The platform started as a deliberation engine. It now carries a set of grounded working capabilities, each one routed to deterministic handlers rather than a free-form model reply.
Deliberate, converge, act
A poll ends in an executable directive, not a platitude. Taking it files a real ticket through the validated API, and a repeat poll on an unchanged board converges to the action in one message instead of re-running the full 11-agent fan-out.
Cited work on the open web
Web search returns a synthesized, cited answer rather than raw hits. URL fetch is SSRF-guarded, multi-step research is supported, and the council researches autonomously before recommending an external choice.
A verified book library
Project Gutenberg and Internet Archive texts are cleaned, chunked, and stored as attributed quotes the council retrieves mid-turn. A brief is map-reduced over the whole text, and every quotation is proved verbatim against its source before it is spoken.
Licence-gated artwork
Period imagery is sourced from the Met's Open Access API, and an image is downloaded only when the source states in a machine-readable field that it is public domain. Provenance is copied from the API or left empty, never composed.
Answers from state, not memory
Questions about the project, its phase, and its safeguards answer deterministically from live project state and a curated capability registry rather than the confabulating model path, moving the self-awareness eval from 3.5 to 8.5 out of 10.
Slack as a second console
A live Slack agent notifies and listens over Socket Mode, so the council can be worked with from Slack, with per-channel memory and a proactive scheduler behind a spam and cost guard.
Built test-first, secure by default
- 336-gate verification slate, grown from 71 through iterative hardening. Structural, per-story, and live HTTP contracts are the merge bar, and a behavioral ratchet keeps the crown-jewel checks (loop guard, anti-hallucination, auth journey) locked as behavioral so the count can only grow. An orphan ratchet drove untriggered tests from 23 to 0, so no test can masquerade as coverage.
- An adversarial bug-hunt that tests the seams. A documented live protocol catches what unit tests stub out, like a council-offered action that 404'd because a separate process self-called the app on the wrong dynamic port. Green on every unit test, caught only end to end, then fixed test-first with port auto-discovery.
- Quotations proved, never generated. Code selects a whole sentence from the source text, so a quotation is verbatim by construction, then a separate verifier proves it again and reports the exact character offset. A refusal names the first word that is absent rather than saying "not found". No model, no embeddings, no network.
- Quality made computable. A nine-dimension rubric scores generated review scripts on hook, structure, rhythm, specificity, and brevity with no model in the loop, and each dimension below full marks names what to change. It graded the first draft 57.6 out of 100, and the rewrite scores 96.4 to 100 across every book in the corpus.
- Security on an agentic surface. A deny-by-default auth boundary fronts the whole platform with 3-tier RBAC. A cross-cutting posture gate proves the patch-propose, codebase-search, and auto-git tools are never publicly drivable, and the bridge fails closed if it binds to a network interface without a token.
- Four-layer memory architecture. A CoALA-style design gives the council working, episodic, semantic, and procedural state instead of a single context window, backed by a lessons ledger with transparent recall scoring so a recurring bug surfaces its prior fix.
- Full observability. OpenTelemetry traces and metrics flow to Tempo, Prometheus, and Grafana, and live perf-smoke budgets put latency and payload-size ceilings on the heaviest endpoints so an order-of-magnitude regression fails a gate.
- Measured path to horizontal scale. Every piece of bridge state is inventoried and classified, and four slices (durable peer briefs, a durable event log, change-stream SSE fan-out, and cross-instance coreference recovery) took cross-instance readiness from 0.33 to 1.0.
- Human-in-the-loop at the boundary. The self-improvement engine is propose-only and never auto-merges. Seven locked approval gates route through a human approver, and a changelog entry stays pending until a person flips it. A gated merge path does exist, and it ships disarmed: deny-by-default on scope, blast radius, all-gates-green, verifier, agency tier, and reversibility, reachable only by explicit dispatch, and it auto-reverts if verification fails after landing. The AI authors inside the gates. A human decides whether anything leaves them.
Nothing in the repository could catch a fabricated quotation
Asked whether the council could produce exact quotations to support a script, the honest answer was no, and worse, nothing already built would have noticed.
The closest existing machinery was the claim verifier. Given three inputs, a real line from the source, a fabricated line, and a paraphrase of the same passage, it returned UNVERIFIABLE for all three. It extracts no atoms from a short quotation, so a fabricated quote passed every check that existed. A plain substring test separated the three perfectly.
So the division of labour changed. The model never authors a quotation. Code selects a whole sentence from the source text, which makes it verbatim by construction, and a separate verifier proves it again before it is spoken. Judging which passage is relevant is work a model can help with. Reproducing forty words exactly is not, and asking it to is how a paraphrase becomes a citation.
The first gate written against that verifier caught it immediately. It checks that the reported offsets actually point at the quoted words rather than merely existing, and they did not: folding a single space collapsed it to nothing, so the offset mapper never counted whitespace and every position drifted left. A verifier that says "verified, at character 22" and points somewhere else is worse than one that says nothing at all.
A fabricated quotation attributed to a real book, published under my name, is the worst thing this project could ship. It is also entirely avoidable, because exactness is decidable. The string is in the source or it is not.
Live, governed, and inspectable
MetaGen Auto runs in production at metagenauto.com. It illustrates agent-orchestration design, security-by-default on an agentic surface, a four-layer memory architecture, and evaluation-driven iteration on LLM output quality, a multi-agent system you can actually govern, end to end.