How I Built This

A snapshot of the first 47 days — February 15 to April 2, 2026. The numbers on this page are frozen at that date. The project continued after.

Motebit was built in 47 days.

Not a prototype. Not a proof of concept. A 45-package monorepo — ~200,000 lines of TypeScript, 4,600+ tests, eight application surfaces, five open specifications, five published npm packages, and a NIST submission backed by working code.

One person. One AI. 1,204 commits. 1,167 co-authored with Claude.

The git history is public. Every claim on this page is verifiable.

The numbers

Commit one

commit d9a2cf2
Date:   Sun Feb 15 20:26:39 2026 -0800

    Round 1: Full architecture scaffold with types, stubs, and tests

    Monorepo with 12 packages, 5 services, 4 apps, and infrastructure.
    All packages compile under strict TypeScript, 201 unit tests pass.

 96 files changed, 17766 insertions(+)

The first commit was not a git init with a README. It was 96 files and 17,766 lines: 12 packages, 5 services, 4 apps, and 201 passing tests.

The package structure in that commit — sdk, crypto, event-log, core-identity, memory-graph, state-vector, behavior-engine, render-engine, ai-core, privacy-layer, sync-engine — is the same structure that exists today. It was never restructured. 1,204 commits later, the foundation never moved.

The architecture was designed, then instantiated. Not discovered through iteration. The git history is the proof.

Three acts

Act 1: The Architecture (Feb 15–25 — 11 days, 233 commits)

Over 11 days, the skeleton became a body. Crypto was implemented (Ed25519, AES-256-GCM, PBKDF2). Memory got semantic similarity and half-life decay. The state vector got tick-based EMA smoothing. The behavior engine became a pure function from state to cues. The render engine got glass refraction. Five application surfaces came online. The relay grew authentication, task routing, and multi-device sync.

By February 25, the system worked end-to-end: you could create an identity, talk to the agent, watch it think, and sync across devices.

Then: a 6-day gap (March 1–6). Zero commits. The architecture was complete enough to see clearly, and what it revealed was the next layer of the problem. Identity existed. Memory existed. Tools existed. But there was no economy — no way for agents to find each other, prove work, earn trust, or settle money. The gap was where the economic thesis crystallized.

Act 2: The 46-Hour Sprint (Mar 12–13 — 125 commits)

The return was immediate and vertical. The first week back (Mar 7–11) rebuilt the trust model, added DID interoperability, wired behavioral metrics, and shipped cross-device goal delegation. Then came a single 46-hour session that built the entire economic layer.

Hours 1–24 (midnight Mar 12 – midnight): DID interop across all identity boundaries. Memory compounding — reinforcement stability, Hebbian co-retrieval, synthesis lineage. The trust model hardened: Beta-binomial reputation scoring, branded IDs. The execution ledger spec shipped. Market routing with scored selection replaced broadcast. Active inference precision. The self-model summary: the agent narrates its own intelligence trajectory. Changesets, CLA, trademark policy — the legal scaffolding for a public project.

Hour 26 (2:23 AM, Mar 13): the first semiring commit. Trust algebra inlined into the existing package. The routing worked. But it was specific to trust — a concrete implementation, not yet an abstraction.

Hours 27–34 (3–10 AM, Mar 13): Budget wired into the relay delegation path. Receipt verification enforced. Credentials issued on verified delivery. UI shipped across all surfaces. Rate limiting. Fly.io production deploy. v0.3.0 released at 5:33 AM. Cross-internet delegation dogfooded live. Two-motebit delegation E2E: two sovereign agents delegating across the live relay, signed receipts verified independently at every hop.

Hour 40 (4:48 PM, Mar 13):

Add @motebit/semiring: algebraic computation graph for agent network routing

For 40 hours, routing had been built procedurally. Trust scores wired here. Cost calculations there. Each concern handled individually. At hour 40, the abstraction snapped into focus: routing is algebraic.

A generic Semiring<T> interface. Five concrete implementations at the time: Trust, Cost, Latency, Reliability, RegulatoryRisk. Product combinators. Weighted digraph. Generic traversal. (Two more — Bottleneck and Boolean — were added on March 31, proving the abstraction scales. Seven total.)

The next commit, four minutes later, proved the abstraction was right:

Add RegulatoryRiskSemiring: compliance-aware routing in 7 lines

The entire definition:

export const RegulatoryRiskSemiring: Semiring<number> = {
  zero: Infinity,
  one: 0,
  add: (a, b) => Math.min(a, b),
  mul: (a, b) => a + b,
};

Regulatory compliance across jurisdictions. Risk accumulates along delegation chains (additive composition). Parallel alternatives pick the lowest-risk route (min). Zero new algorithms. Swap the semiring, change what "best path" means. The entire routing layer collapsed from procedural wiring into algebra.

Hours 40–42 (4:48–6:27 PM, Mar 13): The semiring wired into production. Regulatory risk routed end-to-end. The trust feedback loop closed — receipts compound the agent graph. Then federation. All five phases in 24 minutes:

1. Persist relay identity across restarts
2. Peering protocol with mutual Ed25519 authentication
3. Federated discovery across peered relays
4. Cross-relay task routing via semiring graph
5. Relay reputation, settlement chains, attestations

Federation routed through the semiring. The abstraction from 40 minutes earlier was already load-bearing.

Hours 43–46 (9–11 PM, Mar 13): Federation hardening. Four critical security issues fixed. Six economy gaps closed. Relay index.ts extracted from 5,780 lines to 4,126. Structured logging with correlation IDs.

Last commit: 10:54 PM. Sleep. 11:21 AM the next morning: "Publish: How We Built This" — the original snapshot of this page, frozen at day 26.

Act 3: The Proof (Mar 14 – Apr 2 — 776 commits)

The project nearly doubled. From 39 packages to 45. From 133K lines to 200K. From 3 specs to 5. From 3,054 tests to 4,600+.

The market spec (motebit/market@1.0) — budget allocation, settlement protocol, fee structure, trust-weighted routing, credential blending.

The credential spec (motebit/credential@1.0) — W3C VC 2.0 issuance, credential weighting, revocation.

Virtual accounts with Stripe — real USD entering and leaving the system. Deposit, settle, withdraw. The first real dollar through the loop.

Guardian attestation — organizational custody via Ed25519 guardian key. Enterprise identity without centralized control.

Protocol bridges — A2A (Google), x402 (Coinbase), AP2, OSSA. One agent identity across every major 2026 agent protocol.

The planner — goal decomposition, plan-level reflection, multi-step delegation to specialist agents.

Federation chaos tests — 14 adversarial scenarios. Circuit breakers, heartbeat hysteresis, forward-path health monitoring.

The NIST submission — a formal comment to NIST's NCCoE concept paper on "Software and AI Agent Identity and Authorization." Every claim backed by implementation. Every implementation backed by tests.

How it worked

The bottleneck in software development has shifted. With AI pair-programming, the constraint is no longer implementation speed — it's architectural coherence. How do you maintain a consistent vision across hundreds of AI-assisted commits?

The answer was a single file.

CLAUDE.md as control surface

The CLAUDE.md in the repository root is not documentation. It's a control surface — a living document that tells the AI what the project is, what patterns to follow, what conventions to enforce, and where the boundaries are.

It declares:

• The thesis. The architectural reasoning behind every decision. Not marketing — the actual logic that should inform implementation.
• The patterns. Adapter boundaries, event sourcing, fail-closed privacy, streaming-first, pure computation. The AI follows these patterns because the control document says to.
• The conventions. Error handling uses { cause: err } for stack preservation. Branded ID types enforce compile-time safety. Secrets go in the OS keyring, never config files. These rules prevent drift across hundreds of commits.
• The state of the world. What's built, what's proven, what's untested. This keeps the AI from reimplementing what exists or assuming what doesn't.

The document grew from a few paragraphs to 8,000+ words. It became the single source of truth that kept 45 packages architecturally coherent across 1,204 commits.

The design documents are load-bearing

The project includes documents that look like philosophy:

• DROPLET.md — derives the visual form from physics
• THE_SOVEREIGN_INTERIOR.md — the identity thesis
• THE_METABOLIC_PRINCIPLE.md — what to build vs. what to absorb

These are not decoration. They are constraints. When the AI suggests a feature, the question is: can this be traced to surface tension? If it can't, it doesn't belong. The documents prevent scope creep and maintain coherence across a codebase too large for any single person to hold in their head.

What I did vs. what Claude did

I did:

• The thesis, the architecture, the design constraints
• The CLAUDE.md control surface
• Every strategic decision — what to build, what to cut, what patterns to use
• The specifications and design documents
• The cryptographic primitives and security model
• The 6-day gap where the economic thesis crystallized

Claude did:

• Implementation code following the architectural patterns
• Test suites including formal axiom verification
• Consistency across 45 packages
• The mechanical work of wiring adapters, types, and protocols
• 1,167 of 1,204 commits

What this means

This is not a story about AI replacing developers. It's a story about what happens when architectural clarity meets implementation speed.

A single person with domain knowledge and a clear thesis can now build what previously required a team and a year. But the thesis is the load-bearing structure. Remove it and you get a large pile of code that doesn't cohere. The AI doesn't know what matters. The human does.

The economics changed. The requirement for taste didn't.

What was proven and what wasn't

The infrastructure was built. The cryptography is correct — Ed25519 via audited @noble libraries, AES-256-GCM, PBKDF2 at 600k iterations. The tests verify mathematical axioms (all seven semiring properties), cryptographic roundtrips, and tamper detection.

Proven by April 2:

• Multi-hop delegation across the internet — CLI → web-search → read-url, with Ed25519 signed receipts at every hop, relay-verified independently, budget settled with platform fee
• Real money through the system — Stripe deposits, task settlement, account balances
• Federation between co-located test relays (all 5 phases, 14 adversarial scenarios)

Not yet proven by April 2:

• External developers completing the full flow without guidance
• Multi-device sync under real network conditions
• The intelligence gradient trending upward over weeks of real usage
• Multi-relay federation across independent operators in production

I am honest about this because the gap between built and proven is where most projects die.

The last commit of the first 47 days

commit 77a94ea
Date:   Thu Apr 2 05:09:13 2026 -0700

    Rename NIST submission draft to final

The architecture from commit one — February 15, 2026, 8:26 PM — is the architecture at commit 1,204. Nothing was restructured. The foundation never moved. Everything that came after was accumulation, not correction.

Try it

npm create motebit@latest my-agent

30 seconds to a signed agent identity. The specifications are Apache-2.0 licensed. The source is available.