Case study · Delega

I built the complete product—
then used its production data to kill the commercial thesis.

Delega began as hosted task and decision memory for AI agents. Four months of operating it showed that the subscription business was not working. The same period produced something more durable: an implemented threat model for coordinating semi-autonomous tools around untrusted input, human decisions, and real operational work.

Inspect the threat model View public code

Independently operated personal project · Best-effort availability · No SLA

Production snapshot

As of July 24, 2026, the system had four verified accounts and zero active subscriptions. All non-primary accounts combined had 11 lifetime tasks, with none active since April 2026. That is not early traction. It is evidence that the commercial thesis did not earn another growth cycle.

On that same date, my primary account had 387 lifetime tasks and used 150 in the preceding month against a 1,000-task free allowance. The meter I planned to monetize—task volume—was not correlated with value, and every meaningful differentiator was already available in the free tier.

4 months: operated in production
3 × 2: agent platforms × machines
44: MCP tools
28: database migrations
~11.5k: hosted API lines of code
~1,270 / 516: monthly MCP / CLI npm downloads

Snapshot dated July 24, 2026. Package figure is downloads, not installs.

The judgment call

Stop selling the premise. Preserve the proof.

The original problem was real: every new agent session had to reconstruct prior decisions, while multi-agent work had no shared coordination substrate across tools and machines. I had built the full product surface around it: hosted API, browser console, MCP server, CLI, Python SDK, onboarding, billing, automations, signed inbound connectors, repo sync, deployment, monitoring, and 28 database migrations. Continuing to add features would have made the codebase larger without changing the signal from actual use.

The better decision was to falsify my own work. Delega remains useful to me as shared coordination infrastructure, but I stopped treating “the fleet buyer is coming” as a reason to keep expanding it. New feature work now has one acceptable justification: it solves an operational problem I personally encounter.

A finished system with an honest explanation is a stronger artifact than a perpetually growing product with no market evidence.

The engineering thesis

Memory was the commodity. Trust boundaries were the work.

Once agents can read external events, call tools, hand work to each other, and wait on humans, the central question changes from “what did we know?” to “what is this input allowed to cause?” Delega’s design answers that question across three connected boundaries.

Coordination

Atomic work leases, heartbeats, releases, and delegation lineage keep two agents from quietly owning the same work and make abandoned ownership recoverable.

Provenance

Signed ingress identifies an external source without trusting its text. Ingress taint survives automation-created children, and rules must explicitly opt in before acting on it.

Human accountability

Agents cannot mint human-stated provenance. A hashed, expiring, single-use answer token and a deliberate POST create the narrow path from a real escalation to a human decision.

Canonical technical artifact

The detailed architecture document publishes the threat model, sanitized behavioral contracts, public implementation surfaces, and claims the design deliberately does not make.

Read it

Failure analysis

What I would do differently

Ordinary context can still be wrong

Delega prevents an ordinary agent key from minting human-stated or imported provenance, but an authorized agent can still write a wrong ordinary value. Append-only history makes that mutation reviewable; it does not make the content true.

Context freshness is still procedural

Fleet Attention surfaces abandoned, silent, errored, waiting, overdue, and repeatedly reopened work. It does not flag a recalled fact because it is old, weakly supported, or contradicted by current state.

The current rule is explicit re-verification for facts older than 30 days and a STALE-HIT note when one proves wrong. Automatic stale and disputed states stay unbuilt unless repeated real use demonstrates the need.

Evidence is not adjudication

A completion can require a commit, pull request, CI run, deploy reference, URL, or command output. The system records those claims for a reviewer to spot-check; it does not pretend the reference automatically proves the work.

Why this matters

The same discipline regulated teams already expect.

Treat external content as untrusted data, even when it looks like an urgent instruction.
Separate identity and visibility from permission to mutate shared work.
Preserve who said what, when ownership moved, and when a human actually decided.
Require reviewable evidence without confusing an audit trail for automatic truth.

Evaluate the work

The server is private. The design is not.

Private code is not fatal; unevaluable work is. The architecture, threat model, hosted contract tests, and public MIT clients make the important decisions inspectable without reopening the hosted server.

The commercial result is not a wound in the story. It is the evidence that I can build a thesis, instrument it, and let the result change my mind.

Ryan McMillan · July 24, 2026