An AI-agent deployment isn't an app somebody ships — it's an estate somebody runs: policy, trust boundaries, routing, monitoring, wrapped around a component you didn't write and can't patch. If that's been your job for twenty years, most agentic "starter kits" waste it — piles of configs to copy. This is the opposite: a minimal working deployment where every file exists to teach you one idea, plus the field guide that connects them.
One diagram organises the whole repo — and any deployment you'll ever be handed. Place every component on a plane and you understand the system; fail to place one and you've found what you don't yet understand.
Instruction files and charters. The model weighs them; nothing here is guaranteed. Most teams' entire security model lives on this plane without their noticing.
Hooks, permission rules, gates. The template ships a working integrity hold: the estate cannot edit its own policy files, no matter what it's told — or tricked into.
The main loop and its scoped subagents — components that mostly comply. The template's one subagent demonstrates least-grant and routing-by-advertisement in twenty lines.
Always-resident, paged-on-demand, never-loaded — and the never-load tier is enforced by a deny rule, not a polite request. Retrieved content enters tagged as data, never instructions.
In a system whose failures are fluent, you don't wait for errors. Three evals ship with the estate — including a planted prompt-injection canary you get to watch your agent handle.
Clone it, open Claude Code inside it, and it works: policy file, tested enforcement hook, scoped subagent, three-tier knowledge layout. Small enough to read in an evening; every file maps to a plane on the diagram.
From "this is an estate, not an app" to trust boundaries, silent misroutes and the capstone design brief — written for infrastructure, network and security people, in their own vocabulary. Complete, not a teaser.
Ask the estate to edit its own policy: blocked, every time. Ask it to summarise a document with an embedded hostile instruction: it complies with policy — usually. The difference between those two is the whole discipline, and you'll have seen it yourself.
Fork the repo and fill in the map for the deployment you actually run — every bracket filled or marked EMPTY, in writing. The EMPTYs are your gap analysis; a first honest pass typically yields three to five findings.
The point isn't our estate — it's yours. The worksheet turns the diagram into a design document for your own deployment: what's actually enforced versus merely written down, what loads into context every session, what has no gate at all. Each finding maps to a lesson and to a section of the capstone design brief, so the gap analysis comes with its own reading list.
Nothing, and it's complete — the full guide and the full template, MIT-licensed. No gated chapters, no account, no upsell inside the repo.
People who run infrastructure: sysadmins, network and security engineers, SREs, IT leads — anyone whose employer is about to hand them an AI-agent deployment and call it someone else's job title. No software-development background is assumed.
The guide and the five-plane model are tool-agnostic — the concepts transfer to any agent stack. The runnable template is built on Claude Code, so having it (any plan) lets you run the evals rather than just read them.
There isn't one inside the repo. Chorusse makes its living on the practice side — domain-specific instances of the guide and estate-design engagements. The generic instance is free because it's the honest way to show what we understand.