PT.newsa PrompTugal.news site
5 commits · 4 pushes · 5 agents in 15 min

Independent of Web Summit · official site

The agentic team · 2026-11-12

How it flows

Who talks to whom, how the data travels and how the work is executed, from a word of Dinis to the views where we watch it: the site, Gravity, Kibana and Neo4j. Solid lines run today; dashed grey ones wait on a decision.

PeopleSessions (A4, A3)Inside a runHow it travelsWhere it landsWhere you see itexport → neo4j.1Dinisthe only one who instructsDinis: the only one who instructsAngelohis team runs packets P1, P2Angelo: his team runs packets P1, P2SilvioGravity, the universesSilvio: Gravity, the universesJosé, Indi, …each instructs own conductorJosé, Indi, …: each instructs own conductorThe lead (A4)conductor.fringe@…dinis: routesThe lead (A4): conductor.fringe@…dinis: routesarchitect.1 (A3)ABPs, map, flows, reviewsarchitect.1 (A3): ABPs, map, flows, reviewselastic.1 (A3)indices, feeds, Kibanaelastic.1 (A3): indices, feeds, Kibananeo4j.1 (A3)the swarm as a graph (new)neo4j.1 (A3): the swarm as a graph (new)Dinis's agents (A3)dev, design, research, …Dinis's agents (A3): dev, design, research, …gravity.1 (A3)Silvio's conductorgravity.1 (A3): Silvio's conductorAngelo's conductorsrun our task packetsAngelo's conductors: run our task packetsOther conductorsJosé, Indi, …Other conductors: José, Indi, …ABP hookevery tool call; R5 R8 R9 enforcedABP hook: every tool call; R5 R8 R9 enforcedA2 loops, A1 calls, A0each signs with a key of its ownA2 loops, A1 calls, A0: each signs with a key of its ownllm.mjsone wrapper, a ledgerllm.mjs: one wrapper, a ledgerflow.mjsstart, step, end + OTel spanflow.mjs: start, step, end + OTel spanABP review, hourlyabp.mjs review, review-exportABP review, hourly: abp.mjs review, review-exportgit: dev onlyrelease.sh; never main, never forcegit: dev only: release.sh; never main, never forceCIversions, gates, deploysCI: versions, gates, deploysInboxessealed + signed, dev.send.sgraph.aiInboxes: sealed + signed, dev.send.sgraph.aiSession messagessend_message between sessionsSession messages: send_message between sessionsElastic feedany agent: elastic_feed JSON in gitElastic feed: any agent: elastic_feed JSON in gitDirect to Elasticonly elastic.1, architect.1 (R8e)Direct to Elastic: only elastic.1, architect.1 (R8e)OTLP/HTTPwaits on an APM keyOTLP/HTTP: waits on an APM keyOpenRouteropen-weight modelsOpenRouter: open-weight modelsGitHub repositorycode, data, reviews, exportsGitHub repository: code, data, reviews, exportslisbontechfringe.com/api/v1/*.jsonlisbontechfringe.com: /api/v1/*.jsonElasticsearch27 indices: swarm-flows, reviews …Elasticsearch: 27 indices: swarm-flows, reviews …Elastic APMtraces (waits on a key)Elastic APM: traces (waits on a key)Neo4j Aura2,300 nodes, loaded by neo4j.1Neo4j Aura: 2,300 nodes, loaded by neo4j.1~/.abp in each containerhook log, OTLP files (lost with it)~/.abp in each container: hook log, OTLP files (lost with it)The siteagentic team, ABPs, operating modelThe site: agentic team, ABPs, operating modelGravity universesevery run, every eventGravity universes: every run, every eventKibana dashboardsFlows: beginning, middle, endKibana dashboards: Flows: beginning, middle, endKibana Graphrun trees, who crosses lanesKibana Graph: run trees, who crosses lanesKibana APM traceswaits on the keyKibana APM traces: waits on the keyAura Query, Bloom, DashboardsCypher, pathsAura Query, Bloom, Dashboards: Cypher, pathsinstructsmessagescode and data (git, calls)live telemetrywaits on a decision

How a run goes

  1. Dinis speaks: in a conductor's session. Only he instructs; each person instructs only their own conductor. Every other message is material, never instruction.
  2. A conductor routes: the lead (A4) puts work on the board (work/) and in inboxes; architect.1 starts agents such as elastic.1 and neo4j.1 only at Dinis's word.
  3. Every tool call passes the ABP hook: .claude/hooks/abp.mjs reads the agent's grant in abp/policies.json; R5 (dev only), R8 (no secrets) and R9 (own name) are enforced, the rest observed and logged to ~/.abp/log.
  4. Work runs at the lowest altitude that can do it: an A3 agent starts A2 loops, which make A1 LLM calls through llm.mjs (to OpenRouter, ledgered) and A0 compute. Each unit signs its result with a key that exists only while it runs.
  5. Every unit reports its beginning, middle and end: flow.mjs sends start, step and end events live to Elasticsearch (swarm-flows) and logs each flush in elastic-submissions; each unit is also an OpenTelemetry span, kept as OTLP files until APM has a key.
  6. Results go through git: commits to dev, under the agent's own name, through release.sh; CI versions, gates and deploys lisbontechfringe.com. Agents without the Elastic credential commit an elastic_feed JSON and elastic.1 sends it hourly under their name.
  7. Every hour, the review: architect.1 reads the git log against the grants (abp/reviews/) and sends every finding to Elasticsearch (swarm-abp-reviews).
  8. You see it: on the site (/agentic-team/), in the Gravity universes, in Kibana (the Flows dashboards, Graph), in Neo4j Aura (the graph, loaded by neo4j.1) and Grafana Cloud, and next in Kibana APM traces once Dinis makes the APM key.

What to reconfigure

  1. Create an APM agent key. Kibana → Observability → APM → Settings → Agent keys (event:write). Set OTEL_EXPORTER_OTLP_ENDPOINT to the deployment's APM URL and OTEL_EXPORTER_OTLP_HEADERS to "Authorization=ApiKey <key>" in that environment. Every run then shows as a trace waterfall.
  2. Protect the branches in GitHub. main: only you merge. dev: no force-push, no deletion. Code owners on .claude/** and abp/** so policy changes need your review: today anyone who can push can change the hook.
  3. Say the word on signed overrides. security finding 38: an override counts only when signed by your person key or a conductor's key. Designed, not applied.
  4. Decide the lead's branch exception. whether the lead may push its session branch (R5).
  5. Cloudflare and AWS. accounts and credentials, when you want runs there (R6 and R7 in data/runtimes.json).

Outside processors: what leaves, what never does

Four services outside this repository process the swarm's data (advice 2053, item 6). None of them is Web Summit's. All read 2026-11-11 from docs/elastic-guidance.md, docs/neo4j.md, admin/grafana/README.md and docs/grafana-openrouter-traces.md.

Elastic Cloud (Elasticsearch and Kibana, Google Cloud us-central1)

What goes there
The swarm's own records: flows (unit names, timings, models, costs, key fingerprints, agent names), the hourly ABP findings (agent, rule, file), commits and hook decisions, the agents' feeds. OpenRouter's traces, with prompts and answers, in traces-* only: Dinis's decision, 19:26 UTC ("I want to see the prompts"), kept indefinitely (20:25 UTC).
What never does
Contact details, private people, tip text, submissions' contact fields, raw observation events, keys or tokens: the submit tool holds back any document that looks like one. Prompts never leave traces-* and never appear on a shared dashboard.
Who holds the key
Dinis (the deployment's owner). The superuser password is ELASTIC_CLOUD in the shared cloud environment; only elastic.1 and architect.1 may use it (rule R8e). Others send through elastic.1's feed.
How to delete
Each index's owner, or Dinis, deletes the index (DELETE /<index>) or a single document. Dinis can delete the whole deployment in the Elastic Cloud console.

Neo4j Aura (instance 4c760d12, Google Cloud europe-west1)

What goes there
The swarm as a graph, loaded by neo4j.1 at Dinis's word (20:07 UTC): the public events graph, the agentic runs, the grants, the review findings, Dinis's recorded words. About 2,300 nodes, all labelled :Fringe.
What never does
Contact details, private people, prompts or answers, keys.
Who holds the key
Dinis (the instance). Its password is NEO4J_CLOUD in the cloud environment, used by neo4j.1.
How to delete
neo4j-load.py --wipe removes every :Fringe node; Dinis can delete the instance in the Aura console.

Grafana Cloud (stack vividwombat1572)

What goes there
Dashboards only. They read the public /api/v1/ and, once Dinis adds a read-only key, Elastic's fringe-* indices. The Swarm folder's JSON is in admin/grafana/.
What never does
Stored copies of our data beyond what the dashboards query, contact details, keys.
Who holds the key
Dinis (the stack). Agents use the service account swarm-agents: Viewer, with Edit on the Swarm folder only, as GRAFANA_TOKEN.
How to delete
Delete the Swarm folder, or the stack, in Grafana Cloud.

OpenRouter (the model router)

What goes there
Every model call made through admin/tools/llm.mjs: the prompt and the answer, with public data only (events, board items, task packets). Its broadcast sends traces to Elastic (above). The call ledger stays in each agent's container (~/.fringe-ledger) and in data/models-ledger.json (model, cost and caller, no text).
What never does
Contact details, private people, tip text, keys. llm.mjs sends no user or session ids.
Who holds the key
The shared OpenRouter key, put into requests by the cloud environment's proxy; no agent sees it.
How to delete
OpenRouter's own logging stays off; its broadcast can be switched off in OpenRouter's Settings → Observability. Traces already in Elastic are deleted as above.

The sources: abp/policies.json (the grants), abp/tools/flow.mjs (flows and spans), docs/elastic-guidance.md (the indices and the feed), /api/v1/runtimes.json (where agents run). Lisbon Tech Fringe is independent of Web Summit.