144K
Lines of code
Trevion
Personal ProjectReplaces 12+ disconnected apps with one private AI brain accessible by voice, web, and desktop — that autonomously develops itself via 24 AI agents.
7
Services
24
AI agents
105
PRs shipped
01
The problem it solves
Personal data lives fragmented across a habit tracker, a budgeting tool, a notes app, a project board, and a voice assistant that talks to none of them. None share context. None can reason across domains — your finance app doesn't know you skipped the gym all month. And every one of them ships your private life to someone else's cloud.
There's a second, quieter problem: a platform ambitious enough to fix this grows past what one person can maintain. At 144K lines of code, a solo codebase normally stalls — features rot, refactors never happen, the backlog outruns the builder. Trevion's answer was to make the codebase build itself, safely.
02
What I built
A self-hosted AI operating system for daily life — habits, finance, goals, projects, and home-network intelligence in one place, reachable from four subdomain-routed web portals, an Electron desktop app, a Windows voice companion, and an Alexa skill with 98 custom intents. Underneath: a FastAPI backend, PostgreSQL and Redis, Celery workers, and a deterministic-first answer layer that resolves most queries without any LLM. On top: an always-on Build Engine that dispatches 24 specialized Claude agents into isolated git worktrees where they plan, code, test, and open pull requests around the clock. I review and merge; nothing ships itself.
FastAPI
Backend
Backend
→
PostgreSQL
+ Redis + Celery
+ Redis + Celery
→
4 Portals ·
Desktop · Alexa
Desktop · Alexa
→
24-Agent
Build Org
Build Org
→
Gated PRs +
Merge Train
Merge Train
→
Human Review
→ Deploy
→ Deploy
03
Key features
- One brain for everything — 410+ REST endpoints, 95 service modules, and 53 database tables across habits, finance, goals, projects, and home-network intelligence.
- A codebase that develops itself — the 24-agent engineering org has shipped 84 tasks across 105 PRs at ~4 commits/day. Humans only review and merge.
- Near-zero AI running cost — a 262-topic knowledge catalog and 30 free live APIs short-circuit most queries before any LLM call, with prompt caching and subscription-CLI routing covering the rest.
- Talks back in under a second — a full-duplex voice pipeline with 50ms energy-VAD blocks, SSE streaming, sentence-level Kokoro TTS, and barge-in that interrupts the assistant mid-sentence.
- Its own CI/CD, built from scratch — an n8n-style DAG engine for pipelines plus a canvas-based agent workflow Lab for composing agent behavior visually.
04
System internals
| Component | What it does |
|---|---|
| backend/ | FastAPI async system-of-record and brain: SQLAlchemy 2 async, Alembic migrations, Redis + Celery workers. SQLite in dev, Postgres in production. |
| frontend/ | Next.js 14 multi-portal UI — apex, admin, lab, and per-user portals routed by subdomain — with an Electron desktop wrapper. |
| agent daemon | Loopback-only control-plane daemon (bearer-token auth) for project scans, git operations, and the from-scratch CI/CD flow engine. Deliberately unreachable from the network. |
| brain | A standalone deterministic chatbot experiment: fixed 3-stage router (deterministic skills → from-scratch PyTorch GPT → n-gram fallback) with BM25 retrieval written from stdlib (k1=1.5, b=0.75, hand-rolled stemmer). Same input, same answer, reproducibly. |
| companion | Windows tray voice bridge: energy VAD over 50ms blocks @ 16 kHz, speech-start detection at 2 consecutive hot blocks, and a 7× energy threshold for barge-in while TTS is speaking. |
| alexa-skill | AWS Lambda transport forwarding the Alexa envelope to the backend — 98 custom intents (107 with built-ins) resolved against the deterministic-first answer layer. |
| build engine | A dispatch loop over a durable task board. Each worker gets a fresh isolated git worktree off the latest base branch, a 30-minute hard timeout, and headless-CLI execution; worktrees are force-removed in a finally block so crashes can't leak state. The engine then verifies the PR actually exists on GitHub rather than trusting the worker's word. |
| merge train | Dry-run by default. Orders PRs dependency-safe (docs/frontend first, backend last), and if any two open PRs touch the same file, the whole cluster HOLDs. Re-runs the area gate before each merge; respects a review ceiling of MAX_OPEN_REVIEW = 5. |
| regression gate | Maps changed paths to an area, runs that area's gate (backend pytest, brain eval keeping 32 skill tests green, frontend typecheck+build+smoke, agent tests). Red gate → automatic revert; green → released to human review. |
05
Tech stack
FrontendNext.js 14 · React 18 · TypeScript · Tailwind CSS · Electron · Framer Motion · React Flow · Zustand · Recharts
BackendFastAPI · Python 3.11 · Pydantic v2 · Celery · WebSockets · SSE · SQLAlchemy 2 async · Alembic
AI / MLClaude API + CLI · Ollama · PyTorch (custom GPT) · from-scratch BM25 · Whisper STT · Kokoro TTS · prompt caching
DatabasePostgreSQL 15 · Redis 7 · SQLite (dev) · 53 tables
InfraDocker (4 Compose stacks) · GitHub Actions · Prometheus · AWS Lambda (Alexa)
06
Impact
105
Agent-driven PRs merged
Real pull requests, opened by agents, verified on GitHub, reviewed by a human
84
Tasks shipped autonomously
~80% of all tracked work in the task system
~4
Commits per day
Sustained automated throughput, 24/7
$0
Marginal LLM cost
Deterministic-first answering + CLI subscription routing
07
Reliability & safety engineering
- Auto-reverting gates: every agent PR runs its area's regression gate before opening; a red gate reverts the change automatically. No human in the loop for the revert — only for the merge.
- Trust but verify: the engine never believes a worker that claims it opened a PR — it checks GitHub. Done/shipped tasks carry proof (commit SHA, PR URL, gate run-id); anything without proof is flagged unverified.
- Blast-radius isolation: workers build in throwaway git worktrees with a 30-minute hard timeout, force-cleaned even on crashes. Paired tasks get per-squad worktrees so parallel work can't collide.
- Throttled to human pace: the review ceiling caps the merge queue at 5 — but deliberately gates the human queue, not agent dispatch, after a 50-PR pile-up taught that lesson the hard way. A hard daily run ceiling and a kill switch bound the whole engine.
- Private by architecture: self-hosted data, a loopback-only control plane with bearer auth, and a voice stack whose STT/TTS never leave the machine.
08
Decisions worth talking about
Why Claude CLI over the API
Shelling out to the local Claude subscription cuts per-token cost to zero. The trade-off is real: the CLI throttles hard, so the engine runs a concurrency semaphore of 2, and a 5-second call can balloon to 2 minutes under load. That constraint shaped the whole architecture — most queries route deterministically and never reach an LLM at all. The model is the last resort, not the first.
No vector database, by design
Retrieval is BM25 written from scratch — pure stdlib, k1=1.5, b=0.75, a hand-rolled stemmer — over a curated corpus, gated by a normalized-score threshold so weak matches decline to answer rather than hallucinate. For a bounded, known-topic domain it's faster, cheaper, and every ranking decision is explainable.
The review cap gates humans, not robots
The first version stopped dispatching agents whenever open PRs hit the ceiling — which meant one slow review week idled the entire org. The fix inverted the invariant: agents keep building; the ceiling only meters what enters the human merge queue, and the merge train drains it dependency-safe with same-file conflict clusters held automatically.
The regression gate that auto-reverts
This one mechanism was the difference between a toy agent loop and something that runs unsupervised overnight. The honest caveat stands: humans still review every PR. The system earns trust incrementally; it doesn't get it for free.