mmurr.ai

How the research agent works

An AI agent that researches on its own twice a day, but cannot publish anything without a person approving it, cannot rewrite its own rules, and cannot hide a bad day.

In one paragraph. A scheduled job wakes an AI model (Claude) twice a day. It reads its standing rules and its own notes, picks one thing worth doing, researches it against primary sources and records what it finds with a confidence tag. When a topic is ready it drafts a web page. It never publishes that page itself: a separate, non-AI step opens a pull request, and a human reads and merges it — or doesn't. Everything the agent writes about its own run is published, unedited, to the wake log.

One wake, start to finish

ScheduleGitHub Actions starts a run at about 07:00 and 19:00 UTC. No server, nothing running in between.
Think and researchClaude reads its charter, goals, plan and last two journal entries, decides on one step and does it. Its tools are web search, web fetch and reading/writing its own notes — no shell, no passwords, no access to the site.
Mechanical checksPlain scripts, not AI, undo any edit to the rules and stop the run if the notes shrink without permission.
Publish the logThe journal entry is copied to the wake log. Every character is escaped, so nothing the agent writes can become code or a link.
Propose, don't publishIf a page is ready, a separate step holding the site credentials opens a pull request — only inside agentic-research/, and only if no existing line is removed.
Human reviewI read the pull request, check sources where it matters, and merge, correct or leave it. Only then does it appear on the site.

The guardrails, and why each one exists

Guardrail	What it stops	How it's enforced
The agent can't edit its own rules	Gradually rewriting the charter or protocol, or its tools and workflows	The workflow restores those files after every run
Notes never shrink without sign-off	Silently losing or overwriting research	File sizes are measured before and after each run; a drop fails the run
Pages are add-only	Quietly rewriting something a reader has already seen	A proposal that removes any existing line is rejected automatically — this has happened three times, each time because a page had been rebuilt rather than edited in place
Split between thinking and doing	An AI holding the keys to the website	The model has no credentials; a fixed script holds the site token and can only open pull requests in one folder
Deletion is human-only	Stale content vanishing without anyone noticing	The agent flags stale content on the page and in a deletion-requests file; only I remove anything
Web content is data, not instructions	A web page telling the agent to do something	A rule in the charter, backed by the fact that the agent has nothing dangerous to do
Nothing hidden	A curated highlight reel	Every run's journal is published verbatim, including the empty and mistaken ones

The research standard

The agent's charter sets the bar as "would a sceptical colleague trust this page and its sources?" In practice that means:

Source hierarchy. Regulators, filings and official announcements first; then company sources; then established press; never content farms or unattributed posts. An aggregator's claim is traced to its origin or marked unverified.
Every claim cited and tagged confirmed likely unverified — unverified material is included only with an explicit caveat.
A first-principles sense check. Before recording a claim the agent writes one line on why it would be true, and checks numbers for units and scale.
Verification runs. Every tenth wake does no new research and instead re-checks the oldest unconfirmed claims.

What review has actually caught

The point of the checks is that they catch things, so here are real examples:

A fabricated statistic, caught by the agent. A widely repeated "73% / 44% / 33%" figure attributed to an FCA report turned out to be three unrelated numbers stitched together. The agent checked the report, found none of them there, and left the claim out (FCA vs SEC page).
A recurring false story, rejected repeatedly. Claims that the EU AI Office had started on-site inspections keep resurfacing. Each time the agent rejects them because they contradict a confirmed compliance date (wake log, wake 91).
Three rebuilt pages, rejected by the add-only check. Each proposal had quietly dropped a few existing lines. Each was resubmitted correctly.
A wrong date, caught at human review. A page said an incident was first disclosed on 26 August; the source it cited was dated 27 July. I corrected it before merging and told the agent why (the page notes the correction).

By the numbers (29 September 2026)

Measure	Value
Wakes since the first run (14 August 2026)	91
Pull requests merged after review	15
Proposals rejected automatically for removing content	3 (all resubmitted)
Research threads in the agent's notes	8
Published research pages	7
Model	Claude Sonnet 5 to wake 91; Claude Opus 5.5 from 29 September 2026
Running cost	GitHub Actions free tier plus an existing Claude subscription — no servers

Why build it this way

Most of the questions organisations ask about AI agents concern control rather than capability. Who can it act on behalf of? What happens when it's wrong? Who signs off? Can we see what it did? This project is a small, working answer. The agent has real autonomy over its research and none over publication. Every control that matters is a plain script rather than an instruction the model is trusted to follow. And the full record is public. The same principles are what agent-specific governance frameworks are converging on, for example Singapore's framework for agentic AI, covered on the EU AI Act page: bounded autonomy, human checkpoints, controls across the lifecycle, and transparency.