Case study · Delega

I built and secured a production coordination system—
then shut down a commercial thesis the data did not support.

Delega became the production memory and control plane I use to coordinate Codex, Claude Code, and Hermes across machines. Its leases, provenance, signed ingress, role boundaries, and human-decision path solved a real operating problem. Four months of evidence also showed that the public subscription business was not working, so I retired hosted access and kept the part that earned its place.

Inspect the threat model View public code

Public service retired July 28, 2026 · Private deployment remains active

Production snapshot

The final July 28, 2026 production inventory contained six account rows: one owner account and five non-owner rows associated with four external people. No account held a Stripe subscription ID. The non-owner accounts collectively held 12 lifetime tasks. That is not early traction. It is evidence that the commercial thesis did not earn another growth cycle.

My owner account held 442 lifetime tasks and nine active agent identities. The same system that failed to attract a market had become useful operating infrastructure for me. That contrast justified retiring public signup, billing, and support without deleting the production runtime or pretending the engineering had no value.

4 months: operated in production
3 × 2: agent platforms × machines
44: MCP tools
28: database migrations
442 / 12: owner / external task rows
7,025: rows in final pre-cutover backup

Aggregate snapshot dated July 28, 2026. No external names, email addresses, or domains are included.

The judgment call

Stop selling the premise. Preserve the proof.

The original problem was real: every new agent session had to reconstruct prior decisions, while multi-agent work had no shared coordination substrate across tools and machines. I had built the full product surface around it: hosted API, browser console, MCP server, CLI, Python SDK, onboarding, billing, automations, signed inbound connectors, repo sync, deployment, monitoring, and 28 database migrations. Continuing to add features would have made the codebase larger without changing the signal from actual use.

The better decision was to falsify my own work. On July 28, 2026, I retired public signup, pricing, billing, and general account access. Delega remains useful to me as shared coordination infrastructure, but I stopped treating “the fleet buyer is coming” as a reason to keep expanding it. New feature work now has one acceptable justification: it solves an operational problem I personally encounter.

A finished system with an honest explanation is a stronger artifact than a perpetually growing product with no market evidence.

The engineering thesis

Memory was the commodity. Trust boundaries were the work.

Once agents can read external events, call tools, hand work to each other, and wait on humans, the central question changes from “what did we know?” to “what is this input allowed to cause?” Delega’s design answers that question across three connected boundaries.

Coordination

Atomic work leases, heartbeats, releases, and delegation lineage keep two agents from quietly owning the same work and make abandoned ownership recoverable.

Provenance

Signed ingress identifies an external source without trusting its text. Ingress taint survives automation-created children, and rules must explicitly opt in before acting on it.

Human accountability

Agents cannot mint human-stated provenance. A hashed, expiring, single-use answer token and a deliberate POST create the narrow path from a real escalation to a human decision.

Canonical technical artifact

The detailed architecture document publishes the threat model, sanitized behavioral contracts, public implementation surfaces, and claims the design deliberately does not make.

Read it

Failure analysis

What I would do differently

Ordinary context can still be wrong

Delega prevents an ordinary agent key from minting human-stated or imported provenance, but an authorized agent can still write a wrong ordinary value. Append-only history makes that mutation reviewable; it does not make the content true.

Context freshness is still procedural

Fleet Attention surfaces abandoned, silent, errored, waiting, overdue, and repeatedly reopened work. It does not flag a recalled fact because it is old, weakly supported, or contradicted by current state.

The current rule is explicit re-verification for facts older than 30 days and a STALE-HIT note when one proves wrong. Automatic stale and disputed states stay unbuilt unless repeated real use demonstrates the need.

Evidence is not adjudication

A completion can require a commit, pull request, CI run, deploy reference, URL, or command output. The system records those claims for a reviewer to spot-check; it does not pretend the reference automatically proves the work.

Why this matters

The same discipline regulated teams already expect.

Treat external content as untrusted data, even when it looks like an urgent instruction.
Separate identity and visibility from permission to mutate shared work.
Preserve who said what, when ownership moved, and when a human actually decided.
Require reviewable evidence without confusing an audit trail for automatic truth.

Evaluate the work

The server is private. The design is not.

Private code is not fatal; unevaluable work is. The architecture, threat model, hosted contract tests, and public MIT clients make the important decisions inspectable without reopening the hosted server.

The commercial result is not a wound in the story. It is the evidence that I can build a thesis, instrument it, and let the result change my mind.

Ryan McMillan · Published July 24, 2026 · Retired and updated July 28, 2026