Ulysses Pacts in Software
There is an iOS app in this portfolio whose entire reason for existing is to take a capability away from the person using it. It's called Redact, and its design note describes it without apology: "Redact is an iOS writing app built around a single constraint: once you finish a paragraph, it disappears. The text is obscured (not deleted) by a masking overlay drawn over each finished line, creating momentum without the anxiety of permanent loss. The app targets writers who self-edit obsessively; a first-run training mode eases new users into accepting the fade on their opening document."
The product is not a feature. The product is a prevention. The obsessive self-editor knows something about himself (that given the chance to reread the last paragraph, he'll rewrite it instead of writing the next one), and rather than resolve to do better, he builds a machine that makes the rereading physically unavailable. He cannot be trusted to resist the temptation, so he engineers a world in which the temptation cannot be reached. There's even a training mode for learning to tolerate the constraint, which is the giveaway: this isn't a tool the author expects to want in the moment. It is a tool he expects to fight, and binds himself with anyway.
That move, building an environment to constrain your own future self, turns out to be the most distinctive thing this operator does. Not the apps, not the agents, not the test suites. The self-binding. Once you have the eye for it, it's everywhere in the vault, and it has a name.
The mast
The name comes from a sailor. Odysseus wanted to hear the Sirens' song, which no man hears and lives, so he gave an order while he was still rational: tie me to the mast, and no matter what I scream when the song starts, do not untie me until we are past. He took a second precaution that matters as much as the first: he filled his crew's ears with wax, so that when his future self begged to be released, the request wouldn't even be heard. Two bindings, not one. The mast removed his ability to act on the corrupted preference; the wax removed the crew's ability to act on it for him.
The philosopher Jon Elster used this scene as the type-specimen for a whole class of rational behavior: precommitment, the act of deliberately narrowing your own future options because you can predict that your future self's preferences will diverge, under some specific pressure, from your considered judgment now. The crucial word is predict. Self-binding isn't generic discipline. It is targeted, aimed at a particular failure you have already seen yourself commit, or can see coming with enough confidence to spend real engineering on the defense. The obsessive editor has heard his own Siren. So has this operator, many times, which is why the vault is full of masts.
They're not all the same kind of mast. Sorted by how hard they bind, the operator's self-bindings fall into four tiers, each strictly weaker (and more flexible) than the last.
Physical: can't, by design
The hardest bind makes the unwanted action mechanically impossible. Redact is the cleanest example: each finished line is masked by an overlay the moment you move past it, so "go back and fix that sentence" is not a discouraged action, it is an absent one. The future self doesn't get a willpower check. He gets a wall.
The same signature once showed up in a place you'd never look for creative discipline: source control. The Evolution Sandbox project set out, by deliberate choice, to keep a single-commit canonical history: the whole codebase squashed into one initial commit on origin/main, no earlier state to nostalgically restore, no archaeology to get lost in. The git equivalent of the fade: seal the past so the only direction left is forward. For a while it held.
Then it didn't, and the way it failed is the most instructive thing in this tier. Nobody reopened the sealed past on purpose; routine maintenance did it by default, dependency-bump and housekeeping commits accreting on top of that pristine first commit until the single-commit history simply wasn't one anymore. The intention was a mast, but nothing enforced it (no hook refused the extra commits), so it was really a sermon, and the tooling walked straight past it. Which is the quiet lesson under this whole tier: the masts that actually hold are the ones a mechanism keeps tied. Redact's fade lives in the code path and cannot be talked out of; a resolution to never add a second commit is just a wish sitting on top of a clean initial state.
Capability-refusal: declining a power you hold
One tier down: the action remains conceivable, but the operator refuses to build the capability in the first place. Odysseus's wax: not a wall against the act, but the removal of the channel through which the temptation arrives.
The portfolio is unusually full of powers deliberately declined. Cartograph, a Metal rendering project, states it as policy: "No external packages: All Metal utilities, math, and noise functions are hand-written in Swift/MSL. This was a deliberate design constraint to keep the project self-contained." The whole npm-and-crates universe is one add command away, and the answer is no, because a dependency is a channel through which future-self's "just pull in a library for this" arrives, and closing the channel is cheaper than resisting it every time.
The pattern is loudest around the network boundary. Ghost Routes: "No network calls, no server, no account creation. Privacy policy reflects zero data transmission." Chromafield: "No network, no accounts: Entirely local. No analytics, no IAP." And the operator's own control plane is bound to the loopback interface on purpose: not accessible from remote machines or mobile devices, because it is a desktop operator tool. In each case the operator is declining a power he obviously has the skill to build. The refusal is the design. A capability you never build is one you can never be tempted, pressured, or social-engineered into misusing later.
Procedural: gates against your own future writes
Weaker still, and more interesting: the action stays possible, but a process stands between the operator and his own ability to mutate the record. This is the crew with wax in their ears, a second party instructed in advance that will not carry out the corrupted order.
The SecondBrain vault is the showpiece. Its raw source layer is immutable to the very agents the operator runs: "Agents may read; must not edit. A check-raw-edit-guard.mjs script enforces this via manifest hash comparison." And every claim in the curated layer must carry its lineage: "A wiki claim can always be traced to its raw source via sources: frontmatter." Notice who is being bound here. Not a careless intern. Future-him, and the agents acting on his behalf, who will at some point want to smooth a claim, drop an inconvenient source, edit the raw record to match a tidier story. The guard script is the crewman who will not untie him. The bridge-db sync makes the same vow at the data layer: "Raw SQLite writes are not permitted from agent code." The agent (which is to say the operator's automated reach) is allowed to derive, never to overwrite ground truth.
This is the tier where the binding stops being about willpower and becomes architecture. The operator has externalized "don't corrupt your own evidence" out of his head, where it would erode, and into a script that fails the commit.
Motivational: friction and the self-imposed alarm
The softest tier doesn't block the action at all. It makes the wrong move costly, slow, or visible, betting that a little engineered friction will tip the future decision the right way.
The vault throttles its own intake by design: "Higher friction for casual notes: a raw idea must pass through inbox → processing pipeline before becoming a wiki page. One-click capture still works (via inbox), but curation is not automatic." And once a note is captured, the clock starts: a "30-day processing_deadline enforced by lint-inbox.mjs." Nothing here is forbidden. The operator can still hoard half-baked notes; he just has to do it against a deadline that nags and a pipeline that makes shortcutting annoying.
The most revealing motivational bind is an alarm the operator set against his own future complacency. A retrieval-quality guard "runs the harness with --min-hit3 0.85 daily via launchd" and "on breach it writes ... REGRESSION-ALERT.txt (with the fix recipe) and fires a macOS notification." Sit with what that is. He doesn't trust himself to notice the slow decline, so he hired a robot to tap him on the shoulder.
The deep move: the untrusted agent is you
Step back and the four tiers are one gesture at four hardnesses. The harder question is why, and the answer is the payload.
You only build a Ulysses pact after you have concluded that your own in-the-moment narration cannot be trusted. The obsessive editor's "I'll just fix this one sentence" is a lie his future self tells with total sincerity. The hoarder's "I'll process this note later" is another. The complacent maintainer's "quality's fine, I'd notice if it slipped" is a third. Every self-binding in this vault is the residue of the operator having caught one of these self-narrations in the act and decided, coldly, not to be its mark again.
Now read the operator's own definition of what he builds for his AI agents: "Agent safety is the practice of giving AI agents useful autonomy inside explicit trust, permission, and evaluation boundaries." That is the agent thesis verbatim, and it is also, line for line, the spec for Redact, for the loopback-only bind, for the raw-edit guard, for the retrieval alarm. He applies to himself the exact discipline he applies to an untrusted model. The bright line that nearly everyone draws (the unreliable machine on one side, the reliable human overseer on the other) is the one line this portfolio refuses to draw. In this system the human is simply another agent whose self-report is not evidence.
This is what makes the self-binding more than a quirk. It is verification capital turned inward. The operator's whole engineering posture is that nothing self-reports honestly (not APIs, not plugins, not models), and the durable asset is owned machinery that converts promises into checks. A Ulysses pact is that same conversion, applied to the one narrator he can never fully audit from the outside: himself. The mast is a check on a promise his future self will break. He distrusts even his wins for the same reason: the central synthesis note flags an eval suite that has never failed as a defect, "the local suite has never failed (uniform 12/12 reads as a ceiling effect) ... The thesis is not yet publishable evidence," because a check that cannot fire is narration, not verification. A man who treats his own unbroken success as suspect will, of course, tie himself to masts.
Where the mast becomes a trap
A thesis this totalizing should creak, and self-binding has an obvious failure mode: the mast you cannot untie in a real storm. Precommitment that is too aggressive becomes self-sabotage: controls that outlive the problem they were built for, friction that strangles the work it was meant to protect, a guard so paranoid it cries wolf until you stop listening. Elster's sailor had it easy; the rocks were a known hazard on a fixed route. The operator is binding himself against failures he is only guessing at. Over-bind, and you have built a prison and called it a discipline.
The vault's answer to this is its strangest and most self-consistent move: the paranoia is itself evidence-gated. The standing rule for adding new controls is restraint: "add hooks only for repeated observable failures beyond the current raw guard. Revisit when concrete failure data justifies a new control." Read that against everything above. The operator who self-binds compulsively also binds himself against binding too soon. He will not tie a new knot until a failure has actually recurred and left data. The threat model doesn't get to self-report either; it has to earn each control with evidence. The mast that audits its own necessity is the only kind that does not eventually become the rocks.
That is the whole worldview compressed into one recursive joke. The most interesting thing the operator builds is environments that constrain his own future self, and the discipline that keeps that habit from devouring him is the same discipline aimed one level up: bind hard, but only where the Siren has actually sung.
Goes deeper in the book → Chapter 2: The Map and the Territory