Nax AI
A private AI software firm that runs on one laptop. Seventeen departments, one execution queue, and no cloud spend without a named human. Built for ourselves, not sold.
The constraint
An AI assistant answers one question at a time and forgets. To do real work it has to hold a project, build something, check its own output, and stop when it is about to spend money or touch the outside world. And for the data to stay yours, all of that has to happen on your own machine.
What most people would have built
A chat window over a hosted API, with the model as the product. That makes the model the moat, and the model is the part that gets replaced every six months. It also sends your work to somebody else to run.
Seventeen departments, one set of machinery
Each department is a lens over one execution queue, one audit trail, one chat system and one approval inbox. Never a second copy of anything, which is why two surfaces cannot tell different stories about the same task. Each has a handbook, live measured tools where a down tool names its own fix, and its own chat, tasks and activity.
Chat is the counter, not the product
Slash commands dispatch real work rather than describing it. Code proposes diffs and never commits. Verify runs toolchains inside containers. QA drives a site in a sealed browser. Deck and doc build real office files. Remember teaches the firm something it keeps.
Nothing ships unseen
Every made thing appears in final form before delivery: images full size, clips playing, QA reports readable, deck slides and document pages rendered to images. A local vision model judges each render against its brief, and its verdict is labelled as testimony inside the text, so no surface can pass a model opinion off as a machine check.
Every run is on the record
Tokens, latency, spend authorised, checkpoints taken and gate decisions, all read from the one audit trail. Calls a run cannot honestly claim are counted separately and never folded into its totals.
Governance as an interface
The provider list is an allowlist rather than a filter, so nothing ticked means no cloud call is possible. Auto approve defaults to zero. Every change requires a name. The copy on the page says exactly what the code enforces, and these are inputs to the gates rather than overrides of them.
What it taught us
The model is not the moat. Memory, project ledgers, sandboxes, review discipline and cost governance compound the longer the system runs, and the model behind them is a replaceable part. Building it that way round is the only reason swapping a model is a config change rather than a rewrite.
Five rules the code enforces, not five things the marketing says.
The host never executes work product
Building, testing, previewing and QA all happen inside containers. Checks run with the network off, previews are loopback only, mounts are read only.
Silence is a stop
Anything above the autonomy ceiling pauses at a gate and waits for a named human. Spending, acting on outside systems, starting services. The default spend threshold is zero.
Every write is attributed
Projects, tasks, uploads, memories, approvals, deletions. A named human, or refused.
Honest absence over fake zero
Untracked spend says untracked. An unpriced call is refused. A chain that did not run reports inconclusive, never green. A missing tool names its install command.
One of everything
No second queue, no second chat, no second store of task state. Surfaces reference the shared machinery, so they cannot disagree.