Building a Free, Governed, Local Agentic AI on Commodity Hardware

Anthony R. Ball¹ and Codex (OpenAI)²

¹ Independent researcher, scientist, educator, entrepreneur, and founder of BioCellR8 ² AI research and engineering collaborator operating under the Remediation Bureau control model

Corresponding author: Anthony R. Ball Date of evidence freeze: 19 July 2026 Public portfolio release: 29 July 2026 Project: RB-017 — Personal Agentic AI and Production Laboratory

Abstract

Background

Commodity local-model runtimes and open agent platforms now make it possible for individuals to assemble systems that resemble commercial artificial-intelligence assistants. Yet feature availability is not equivalent to reliable agency. Tools, memories, plug-ins, model protocols, workflow engines, and messaging channels enlarge both capability and the opportunity for unauthorized, unverifiable, destructive, or misleading behavior. RB-017 is a longitudinal effort to build a free or meaningfully free personal production AI on an older Windows laptop while preserving explicit human authority, source fidelity, fail-closed control, rollback, and evidence suitable for independent audit.

Objective

We conducted a systematic, preregistered survey of prior and current art to determine which RB-017 capabilities should be reused, adapted, composed, benchmarked, built, deferred, held, or rejected. The survey also asked whether continued attempts to make one 4-billion-parameter model behave as a complete agent remained an efficient route to useful deployment.

Methods

Sixteen workstreams covered assistant runtimes; chat and retrieval interfaces; coding agents; workflow automation; interoperability; skills and registries; document ingestion; memory; local models; fine-tuning; sandboxing; evaluation and observability; multi-agent review; communications; production and engineering applications; and packaging. Seventy-six candidates were evaluated against ten hard gates and a 100-point weighted rubric. One hundred twenty official, research, and local evidence records were registered. The frozen present-host envelope was Windows 10, Intel i7-7700HQ, 8 GB RAM, NVIDIA GTX 1050 with 4 GB VRAM, WSL2, and D-drive-first persistent storage. No candidate was installed or executed.

Results

Four candidates were recommended for role-preserving reuse, 18 for adaptation or composition, 17 for controlled benchmarking, 20 as design references, nine for deferral, seven for hold, and one for rejection. The survey found no community platform that should replace RB-017's deterministic authority, evidence, and verification core. It identified an efficient compositional architecture: Open WebUI as interface; the RB supervisor and policy gate as sole authority; Ollama with one bounded local model; hashed OpenAPI contracts for narrow capabilities; isolated low-privilege workers; D-drive staging; and independent verification before release. High-value candidates included Docling, SQLite FTS5, Open Terminal, Inspect AI, OpenTelemetry semantics, Pandoc, Quarto, LibreOffice, marimo, Telegram, OpenCode, Goose, and supply-chain standards. Heavy agent/RAG platforms, simultaneous local models, long-context coding harnesses, and local fine-tuning were incompatible with the current host.

Conclusions

The shortest path to a useful trustworthy system is not to train or prompt one small model into being the entire agent. It is to preserve the original RB-017 governance contribution while assigning parsing, retrieval, rendering, evaluation, sandboxing, and transport to audited prior art. Models should draft, extract, classify, or select among allowlisted choices; deterministic systems should own authority, exact transformations, targets, receipts, completion, and release. The immediate research priority is a model-free deterministic materializer followed by a typed Safe Useful Core focused on income-relevant document production.

Keywords: local AI; agentic AI; self-hosted AI; AI governance; capability security; Ollama; Open WebUI; Model Context Protocol; OpenAPI; retrieval-augmented generation; human-in-the-loop; commodity hardware; free software

Plain-language summary

A person can now download a local language model, connect it to a chat screen, and add tools. That does not automatically create a safe or useful agent. A language model may write confidently without doing the requested edit, confuse instructions with source text, accept hostile instructions embedded in a document, or report success without evidence. A plug-in can also reach files and programs far beyond what the user intended.

RB-017 addresses this by separating “thinking and drafting” from “authority and action.” Anthony decides what the system may do. Deterministic code translates that permission into a narrow capability. A model can help only inside the allowed envelope. Any worker writes to a staging folder, and a separate verifier checks the result before Anthony releases it.

This survey asked a practical question: what can be borrowed from the large free AI ecosystem, and what must RB-017 continue building? The answer is encouraging. We do not need to reinvent document parsers, model servers, scientific publishing tools, coding-agent interfaces, message transports, evaluation frameworks, or software-package standards. We do need to retain the distinctive RB-017 control core that prevents those components from becoming their own authority. That composition can provide useful résumé, cover-letter, business-document, research, data, website, and coding assistance before the system is trusted with consequential autonomous action.

1. Introduction

The contemporary agentic-AI ecosystem has become both abundant and confusing. Ollama's current integration catalog alone includes personal assistants, coding agents, editors, retrieval systems, automation, notebooks, and assistant sandboxes [1]. Open WebUI exposes model presets, knowledge, skills, in-process tools, external OpenAPI servers, and native MCP connections [2–4]. Independent ecosystems such as LobeHub, Dify, Flowise, OpenClaw, Hermes, AnythingLLM, and Onyx add overlapping combinations of memory, retrieval, plug-ins, channels, and workflows.

This abundance creates a classic engineering problem: whether to build, buy, reuse, adapt, or compose. It also creates a safety problem. A community component may be free but unmaintained, source-available but not redistributable, locally hosted but telemetry-enabled, polished but inseparable from a broad trust grant, or computationally unsuitable for the intended host. “Supports Ollama” says little about its license, practical context requirement, default authority, evidence quality, or rollback.

RB-017 began from a different direction. Its governing objective is a durable personal productivity and production system that compensates for executive-function barriers, accelerates professional and entrepreneurial work, preserves privacy, and can later support engineering projects. Anthony requires candid reporting, no fabricated completion, tiered file access, exact approval for consequential actions, D-drive-first storage, and useful handoffs when the system is stuck. The long-term vision includes specialized agents, communications, document and website production, coding, data analysis, memory, future 3D/CAD/electronics work, and eventual public distribution under the Arbel identity. Cost must remain free or meaningfully free.

Earlier RB-017 experiments established why the architecture matters. The v3.7.1 Qwen3:4b Lane-2 experiment completed and parsed all 24 cases, accepted zero unsafe or out-of-span changes, but produced only 14 useful transformations against a preregistered 22-case threshold. In ten failures, the model's metadata described the needed edit while the returned candidate string remained unchanged. Containment succeeded; usefulness failed. The result favored deterministic materialization where the exact allowed edit was already known.

The present survey was therefore not an exercise in collecting attractive software. It tested whether external art could shorten time to value without weakening the Remediation Bureau's standards.

2. Research questions

1. Which free or meaningfully free components can satisfy RB-017 requirements without substantial original construction?
2. Which candidates can be safely adapted behind the RB policy boundary?
3. Which components are useful only as benchmarks or references?
4. Which candidates fail current-host, license, privacy, authority, evidence, rollback, or maintenance gates?
5. What original RB-017 work remains justified after a broad field survey?
6. What sequence delivers useful income-supporting capability fastest?
7. How should current Qwen research coexist with a compositional production architecture?

3. Materials and methods

3.1 Preregistration and authority

Research was authorized against the v1.2.0 planning package under SHA256 01C1AAFDDFE7172CA19E83507BABD7BEE9F99E8234E5752D2C881DD75D201222. The governing charter was RB-017 v1.1 under SHA256 15D8C54F0E2CEB6A339147127B9002039193120EEAAE27FBC45EDFD18EB62D8C. The permitted envelope covered read-only public research, read-only local evidence inspection, and small research artifacts on D drive. It prohibited installation, imports, downloads of models/binaries/containers/repositories, account use, credentials, model inference, runtime changes, production data, communications, deployment, indexing, and release.

3.2 Workstreams

The 16 frozen workstreams were:

1. assistant runtimes;
2. chat, retrieval, and interfaces;
3. coding agents;
4. workflow automation;
5. protocols and interoperability;
6. tools, skills, and community registries;
7. knowledge, documents, retrieval, and source fidelity;
8. memory;
9. local and hybrid models;
10. training and improvement;
11. sandboxing and permissions;
12. evaluation, security, evidence, and observability;
13. multi-agent and independent review;
14. communications;
15. production and future engineering laboratory;
16. packaging, portability, update, and distribution.

The mandatory seed set contained every integration Anthony supplied from Ollama and LobeHub. Broader discovery added direct competitors, enabling libraries, standards, security tools, and domain applications.

3.3 Source hierarchy and truth states

Primary sources—official specifications, repositories, licenses, security policies, model cards, and documentation—were preferred. Peer-reviewed or preprint research supplied comparative or conceptual evidence. Local RB-017 manifests, audits, and governing documents supplied project state. Community claims could identify candidates but could not establish security, license, or capability alone.

Each source received an identifier, type, publisher, access date, supported claim, truth state, workstream, and candidate mapping. Local sources also received exact paths and SHA256 hashes. The complete register contains 120 entries.

3.4 Candidate classification

“Free” was separated into:

• F0: truly free/local;
• F1: free self-hosted core with material conditions;
• F2: meaningfully free service with inherent account/platform limits;
• F3: limited or subscription-linked;
• F4: paid required;
• FU: unresolved.

Each candidate was tested against identity/provenance, license, cost, privacy, authority, isolation, evidence, rollback, host feasibility, and maintenance gates. A weighted rubric then scored mission fit, governability, security, free status, host fit, interoperability, maturity, evidence quality, and usability. A high score could not override a failed hard gate.

Dispositions were REUSE, ADAPT, COMPOSE, BENCHMARK, REFERENCE, DEFER_CURRENT_HOST, DEFER, HOLD, or REJECT.

3.5 Host model

The verified host was an ASUS FX503VD with Windows 10, Intel i7-7700HQ, 8 GB DDR4 RAM, GTX 1050 4 GB VRAM, WSL2, a small C-drive SSD, and a larger D-drive HDD. This is not a trivial detail: advertised 64K–256K model contexts are not practical configurations for this host. Several concurrent containers or model workers would force paging and could make the computer unusable.

3.6 Anti-bias controls

The survey preserved unfavorable results, distinguished absence of evidence from evidence of absence, separated popularity from validation, recorded unresolved licenses as FU/HOLD, and required the architecture to survive candidate removal. The second discovery/reconciliation pass reached practical saturation: new findings expanded comparators but did not change the core architecture.

4. Results

4.1 Survey corpus

The inventory contains 76 candidates and all 16 workstreams. Fifty-six candidates were F0, six F1, four F2, four F3, and six FU. These counts should not be read as 56 immediate adoption opportunities. Most F0 components still require isolation, adaptation, host deferral, or role restriction.

Figure 1. The RB supervisor and policy gate remain the sole authority. Models and community components are bounded workers outside that authority. Denial produces evidence, while staged artifacts require independent verification and human release.

Figure 2. Disposition of 76 candidates. The dominance of REFERENCE, ADAPT, and BENCHMARK demonstrates that the field offers substantial reusable art but very few components that can enter unchanged.

4.2 Assistant and interface platforms

OpenClaw and Hermes are powerful personal-assistant runtimes. OpenClaw is MIT-licensed, supports Windows, and connects to many messaging channels [5]. Hermes is also MIT-licensed and combines skills, cross-session memory, messaging, and a self-improvement loop [6]. Their own security models reinforce RB-017's caution: Hermes states that plugins load with full agent privilege and recommends a whole-process wrapper when untrusted inputs are involved [7].

These projects avoid enormous amounts of generic assistant engineering, but their default trust envelopes are too broad for adoption as the RB constitutional core. They are benchmarks for skills, memory UX, messaging, and assistant lifecycle.

Open WebUI remains the preferred human interface because it is already present and separates several extension types. Its documentation warns, however, that in-process Python tools can compromise the application and host. Native MCP is admin-controlled, and compromised servers can exfiltrate data or execute actions [2–4]. The recommendation is therefore to retain Open WebUI while moving capabilities into external, hashed, low-privilege services.

AnythingLLM is the strongest interface/RAG comparator: MIT-licensed, local-first, and capable of air-gapped self-hosting [8]. Onyx, RAGFlow, Dify, and LobeHub demonstrate mature knowledge and workflow patterns but impose multi-service weight or material license restrictions. LobeHub's Community License requires a commercial license for derivative distribution [9]. Dify adds multi-tenant and branding restrictions to Apache terms [10]. These platforms are references, not Arbel foundations.

4.3 Coding agents

OpenCode and Goose are the leading later bakeoff candidates. OpenCode's current canonical repository is MIT-licensed and extremely active [11]. Goose is Apache-2.0, supports local Ollama, and is designed for extensible offline work [12]. Cline and Roo Code offer mature approval flows inside VS Code; Pi is small and extensible but ships with read, write, edit, and bash and supports autonomous experiment loops [13]. Those are capabilities, not safety guarantees.

Droid and several proprietary clients recommend contexts of at least 64K tokens [14]. That may be reasonable on modern hardware but is a poor match for an 8-GB system. Claude Code, Codex App, and Copilot CLI remain valuable external development aids, but proprietary or subscription-linked clients cannot be core dependencies of a freely distributable Arbel system.

No coding agent should be connected directly to Anthony's live files, credentials, or network. A future experiment should use a disposable repository, a low-privilege worker, no secrets, no network, an exact task envelope, staged diffs, tests, receipts, and independent verification.

4.4 Workflow automation

Workflow engines solve connector, scheduling, retry, and state problems. Node-RED is Apache-2.0, comparatively lightweight, and mature [15]. Activepieces provides a modern connector ecosystem with an MIT community core. n8n is feature-rich but uses a Sustainable Use License that limits some commercialization and hosting patterns [16]. Windmill is AGPL and offers workers, jobs, and approvals, but its Postgres/worker deployment is too heavy for the present laptop.

The core conclusion is architectural: a workflow engine may execute a capability after the RB gate approves it. It must not decide that authority exists. Node-RED and Activepieces merit a later memory/evidence comparison; neither is needed for the first Safe Useful Core.

4.5 Protocols and tool ecosystems

MCP is important prior art but not a security boundary. The specification standardizes tools, resources, prompts, and agent features. Its security guidance identifies confused-deputy attacks, token passthrough, SSRF, session hijacking, and local-server compromise [17,18]. A server's description is untrusted input, and user consent remains necessary.

RB-017 should support MCP only through a separately inspected external adapter. Direct in-process tools and arbitrary stdio servers are inappropriate. The first gateway should use OpenAPI because it yields a small, readable, versioned HTTP contract [19]. RB-017 must add the controls OpenAPI itself does not supply: exact authority, target binding, schema hashes, idempotency, resource budgets, receipts, and independent verification.

A2A is a useful future standard for external reviewers or agent handoffs [20]. It is premature for production execution because RB-017 has not yet qualified a single-agent capability plane.

4.6 Document ingestion, retrieval, and memory

Docling is among the clearest time-value wins. It is MIT-licensed, local/air-gap capable, supports PDF, DOCX, PPTX, XLSX, HTML, images, and other formats, and can export structured JSON, Markdown, and HTML [21]. Rather than build parsers, RB-017 should adapt Docling inside a bounded worker that preserves source hashes, page/sheet/slide locators, table structure, parser settings, warnings, and raw extraction evidence. Unstructured OSS is a useful benchmark, though its own documentation describes limitations of the open package for advanced production use [22].

A vector database is not required at the start. Qdrant is mature, but its default deployment lacks authentication and encryption and adds a service to a memory-starved host [23]. SQLite FTS5 can support compact full-text search, metadata filtering, and an original provenance ledger with almost no operating burden [24]. Vector retrieval should be introduced only if a frozen corpus demonstrates a measurable recall deficiency.

Mem0 and Letta show the state of agent memory. They can automatically extract, compress, retrieve, and update memories [25,26]. That convenience conflicts with RB-017 if model-generated summaries become authoritative facts. The system should instead maintain two layers: a quarantined memory-candidate layer and a confirmed fact/event ledger with source, confidence, Anthony's confirmation, supersession, deletion, and a storage budget. Memories never modify the constitution or grant authority.

4.7 Models and training

The installed Granite 4.1:3b is the best first alternative benchmark because it is smaller than Qwen3:4b, openly licensed, already present, and positioned for structured JSON, coding, RAG, and tools [27]. Qwen3:4b remains a valuable longitudinal research worker, but its v3.7.1 failures show why it should not perform deterministic materialization.

Phi-4-mini 3.8B and Qwen3.5:4B are plausible later candidates. Their quantized packages are approximately 2.5 GB and 3.4 GB, respectively [28,29]. They were not downloaded; a frozen benchmark should first determine whether installed Granite closes the material gap.

Fine-tuning is a long-term track. PEFT and QLoRA make adaptation more efficient [30,31], while Axolotl and Unsloth provide practical training stacks. None makes useful 3–4B training sensible on a GTX 1050 with 4 GB VRAM. RB-017 should build a de-identified, versioned training corpus now and train only after new hardware or a separately approved, privacy-clean cloud envelope exists.

4.8 Sandboxing, evaluation, and evidence

Open Terminal is the strongest later execution-sandbox candidate. Its security guidance supports resource limits, API keys, private networks, egress allowlists, and warns never to mount the Docker socket because that is effectively root-equivalent access [32]. It can become the execution substrate only after Docker's D-drive storage, logs, updates, health sequencing, shutdown, and resource behavior are independently requalified.

NemoClaw is an excellent future-host reference. It combines OpenShell, Landlock, seccomp, network namespaces, egress policies, and inference routing [33]. Its WSL2/Docker footprint is too heavy for the current host.

Inspect AI is the highest-priority evaluation framework to adapt because it supplies tasks, scoring, logs, and sandboxes under an open license [34]. Promptfoo can accelerate prompt comparison and red teaming, but its custom assertions and plug-ins execute code and its local server is not a security boundary [35]. Garak contributes a vulnerability-probe catalog [36]. None may replace the RB independent verifier; they produce evidence that the verifier evaluates.

OpenTelemetry can supply portable trace, metric, and log semantics without requiring a heavyweight backend [37]. CycloneDX, Sigstore/Cosign, OSV-Scanner, and SLSA provenance can support future package inventories, signatures, dependency findings, and build attestations [38–41].

4.9 Multi-agent review

Anthony's instinct to use independent AIs is scientifically valuable, but numerical quorum can be deceptive. Apple researchers reported that nine frontier-model judges from seven families sometimes yielded only about two effective independent votes because their errors were correlated [42]. This strongly supports RB-017's rule that agreement is advisory, not truth.

A valid panel should be heterogeneous, blinded before deliberation, source-bound, and followed by human adjudication. AutoGen, CrewAI, A2A, and debate research offer orchestration patterns, but frameworks do not create independence. The evaluator's signed certificate and Anthony's decision remain superior to a critic or panel.

4.10 Communications

Telegram is the preferred first messaging lane because its Bot API is official, mature, documented, and free within platform limits [43]. The first release should support an allowlisted Anthony identity, inbound requests, status notifications, and draft review. It should not autonomously contact third parties.

Signal is not preferred because no official bot API exists; signald explicitly operates as an unofficial bridge with weaker assurance than first-party Signal clients [44]. Email should follow the draft-only lane. Microsoft Graph's delegated Mail.Send and Gmail's gmail.send scopes can provide narrow access, but both are external-effect capabilities. A Graph 202 response means accepted for processing, not delivered [45]. Recipient binding, content hash, exact approval, idempotency, rate limit, token revocation, and a truthful receipt are mandatory.

4.11 Production and future engineering

The highest-value near-term capabilities are professional documents, research reports, data analysis, websites, and staged code because they directly support employment and BioCellR8 and allow human inspection before release.

Pandoc and Quarto provide reproducible document conversion and scientific publishing [46,47]. LibreOffice supplies a mature free office engine. Marimo is particularly attractive for data work because reactive notebooks are stored as Python and avoid Jupyter's hidden-state problem [48]. These components can turn RB-017 into a useful production system without giving a model general host authority.

Future engineering should use inspectable intermediate representations. OpenSCAD lets a model propose textual CAD that a deterministic engine renders [49]. FreeCAD adds parametric CAD and Python APIs. KiCad supplies schematic/PCB files and electrical/design-rule checks [50]. Recent pcbGPT and PCBWorld research also favors engine-grounded, structured outputs rather than free-form board manipulation [51,52]. Human engineering review remains essential; no system should autonomously fabricate or energize hardware.

4.12 Packaging and portability

Docker Compose remains the present container foundation, but only provisionally. Profiles, healthchecks, and CPU/memory limits can enforce staged startup and bounded services [53]. RB-017 additionally needs D-drive volumes, log rotation and hard quotas, no automatic updates, pinned image digests, no Docker socket, free-space gates, clean shutdown, and a host-usable emergency stop. Podman is a future alternative, but Windows still relies on a WSL-backed machine and migration would not remove the host's fundamental limits.

Figure 3. The roadmap prioritizes deterministic qualification and income-relevant capabilities. More expensive autonomy, communications, training, and engineering follow only after exact lower lanes qualify.

5. Discussion

5.1 The survey validates the Remediation Bureau rather than rendering it obsolete

The principal result is not that RB-017 should be replaced by a popular agent. It is that RB-017 has been building the correct missing layer. Community systems compete on convenience, integrations, memory, connectors, and agent loops. Their security documentation often tells users to configure permissions or run a sandbox. RB-017 asks the harder questions: what exact authority exists, who issued it, which target and operation are bound to it, what evidence existed before dispatch, who verifies completion, and what makes release legitimate?

Those concerns cannot be outsourced to a model prompt. They remain valid regardless of whether the worker is Qwen, Granite, OpenCode, Docling, Node-RED, or a cloud API.

5.2 The model should not be the whole system

Small local models are useful precisely when their role is narrow. The v3.7.1 result showed that Qwen could remain contained while failing to realize an exact edit. More examples or a critic might improve average behavior, but the supervisor already knew the only lawful replacement. Calling a model was unnecessary.

The mature architecture uses deterministic materialization for known operations, a bounded model choice for true ambiguity, and clarification when ambiguity changes the action or target. This reduces latency, compute, attack surface, and evaluation burden simultaneously.

5.3 Conservation means lifecycle economy, not merely fewer lines of code

Reusing a component is economical only if its license, updates, security, storage, support, and evidence costs remain lower than adaptation or original construction. A one-click platform that requires eight services and continuous patching may be more expensive than a small original state machine. Conversely, building parsers for PDF, DOCX, PPTX, and XLSX would be a waste when Docling exists.

The survey therefore recommends a barbell strategy: retain a small amount of high-value original governance code and compose mature external engines for commodity functions.

5.4 A Safe Useful Core can coexist with long-term research

Continued Qwen development, critics, training, multi-agent experiments, and future hardware remain valuable. They should not block useful capabilities that are already safe enough to qualify separately. A document-drafting lane can graduate while email sending remains prohibited. A source-located reader can graduate while shell execution remains design-only. This capability-specific approach prevents both reckless whole-agent release and endless laboratory paralysis.

5.5 The present computer should remain a compatibility target, not an architectural ceiling

The current laptop forces good discipline: one model, short context, compact retrieval, bounded processes, and explicit shutdown. A future workstation or server will expand capacity, but the governance layer should migrate unchanged. Heavy platforms and training can then be reconsidered without redesigning authority.

6. Recommended architecture

The recommended Safe Useful Core is:

1. Human interface: Open WebUI.
2. Session and intent: RB supervisor.
3. Authority: deterministic policy gate and typed capability compiler.
4. Inference: Ollama with one model at a time.
5. Model roles: drafting, extraction, classification, clarification, or allowlisted selection.
6. Protocol: hashed OpenAPI first; MCP only through an inspected adapter.
7. Worker: low-privilege external process or container, no network by default.
8. Territory: explicit D-drive input and staging roots.
9. Evidence: raw requests/responses, source hashes, package/model digests, resource observations, event chain.
10. Completion: independent verifier and receipt.
11. Release: Anthony's decision.
12. Memory: compact provenance ledger with confirmation and supersession.
13. Updates: pinned, separately reviewed, rollback-capable.
14. External effects: separate communications/release lanes with exact approval.

7. Practical roadmap

The first controlled gates should be:

• implement and qualify v3.8 model-free materialization;
• freeze the OpenAPI capability profile;
• requalify Docker and the sandbox resource envelope;
• run Docling versus Unstructured on sanitized representative documents;
• qualify a professional drafting and document-production lane using Pandoc/Quarto/LibreOffice;
• benchmark installed Granite 4.1:3b against Qwen3:4b on frozen role-specific tasks;
• build SQLite FTS plus provenance;
• only then consider OpenCode/Goose, Telegram, additional model downloads, workflow engines, or memory frameworks.

This ordering aligns technical risk with Anthony's highest priorities: reliable employment, income generation, and BioCellR8.

8. Limitations

This study did not install or execute candidates. Host-fit decisions are evidence-based estimates that require controlled measurement before adoption. Prices, versions, licenses, and ownership can change. Some candidates remain unresolved. Weighted scores are not proofs. Security guidance describes intended controls, not absence of vulnerabilities. The study was systematic and saturation-controlled but not mathematically exhaustive. Legal findings are engineering flags rather than legal advice.

The discoverability metadata planned for the HTML version improves the conditions for indexing but cannot guarantee Google, Google Scholar, or other search-engine inclusion. Deployment and indexing are separate release actions.

9. Conclusions

The free agentic-AI field contains enough mature prior art to shorten RB-017 substantially, but not enough trustworthy prior art to eliminate its original governance core. The correct design is compositional.

Open WebUI and Ollama remain. RB-017 remains sovereign. OpenAPI carries narrow requests. Docling parses documents. SQLite preserves compact source-grounded knowledge. Sandboxed workers produce staged artifacts. Inspect AI and security scanners contribute evidence. Pandoc, Quarto, LibreOffice, and marimo produce useful work. Telegram eventually carries approved communication. Coding agents, workflow engines, alternative models, and engineering tools enter only through capability-specific qualification.

The practical shift is profound: RB-017 no longer needs to wait for a small local model to become a universally reliable agent before it can help Anthony. It can become useful by giving imperfect models smaller, honest jobs inside a system whose authority, evidence, and completion are deterministic.

10. Future research

Future work should quantify:

• document parser fidelity by format, table, OCR, and source locator;
• model utility, latency, RAM, VRAM, and energy by role;
• short-context coding-agent performance;
• SQLite lexical retrieval versus vector retrieval;
• sandbox escape, egress, disk, log, crash, and rollback behavior;
• human cognitive load and time saved in professional-document workflows;
• memory precision, provenance retention, supersession, and deletion;
• effective independence of external AI review panels;
• communications approval usability and duplicate prevention;
• future-hardware training with clean datasets and held-out suites;
• engine-grounded CAD and PCB validation.

11. Data and reproducibility

The local research package contains:

• CANDIDATE_INVENTORY.csv — 76 candidates, 62 fields;
• SOURCE_REGISTER.csv — 120 public and local sources, 16 fields;
• free/license, risk, host, workstream, decision, architecture, roadmap, and limitation ledgers;
• source data and accessible SVGs for all figures;
• standalone HTML;
• QA and manifest receipts.

No model responses, candidate binaries, repositories, containers, or production data were generated or downloaded during this survey.

12. Author contributions

Anthony R. Ball conceived the RB-017 vision, established the human-centered requirements and Remediation Bureau operating model, identified the prior-art question, supplied mandatory seeds, defined the free-use and current-host constraints, and authorized the research envelope. Codex designed and executed the read-only survey, reconciled local evidence, evaluated candidates, created the registers and visualizations, and drafted the manuscript. Anthony retains final interpretive, operational, publication, and release authority.

13. AI-use and acknowledgments

Codex, an OpenAI system, served as an AI research and engineering collaborator. Earlier RB-017 review-panel work included assistance from Grok, Gemini, DeepSeek, and Anthropic Claude. Those contributions were advisory; no reviewer possessed release authority. Historical credit does not imply endorsement of every recommendation. The project specifically preserves the fact that a Grok recommendation was judged too permissive and Grok was later barred from RB-017 operational review.

14. Competing interests and funding

The authors report no external research funding for this survey. Anthony R. Ball intends that a mature Arbel system may eventually be distributed publicly and could support donations or a low one-time commercial fee. That prospective interest did not alter the hard gates, adverse findings, or preserved uncertainties in this research.

15. References

1. Ollama. Integrations. Accessed 2026-07-19.
2. Open WebUI. Tools and extensibility.
3. Open WebUI. Model Context Protocol.
4. Open WebUI. Open Terminal security.
5. OpenClaw. Official repository.
6. Nous Research. Hermes Agent.
7. Nous Research. Hermes Agent security policy.
8. Mintplex Labs. AnythingLLM.
9. LobeHub. LobeHub Community License.
10. LangGenius. Dify license.
11. Anomaly. OpenCode.
12. Linux Foundation AAIF. Goose.
13. Ollama. Pi integration.
14. Ollama. Droid integration.
15. OpenJS Foundation. Node-RED documentation.
16. n8n. Sustainable Use License.
17. Model Context Protocol. Specification 2025-11-25.
18. Model Context Protocol. Security best practices.
19. OpenAPI Initiative. OpenAPI Specification 3.2.0.
20. Linux Foundation. A2A protocol.
21. Docling Project. Docling.
22. Unstructured. Open-source overview.
23. Qdrant. Security.
24. SQLite. FTS5 extension.
25. Mem0. Introduction.
26. Letta. Memory hierarchy.
27. IBM/Ollama. Granite 4.1.
28. Microsoft/Ollama. Phi-4-mini 3.8B.
29. Qwen/Ollama. Qwen3.5.
30. Hugging Face. PEFT.
31. Dettmers T, et al. QLoRA.
32. Open WebUI. Open Terminal security.
33. NVIDIA. NemoClaw overview.
34. UK AI Security Institute. Inspect AI.
35. promptfoo. Security policy.
36. NVIDIA. garak.
37. CNCF. OpenTelemetry specification.
38. OWASP. CycloneDX.
39. Sigstore. Cosign specifications.
40. Google. OSV-Scanner.
41. SLSA. Build provenance v1.2.
42. Apple Machine Learning Research. Correlated LLM evaluation panels.
43. Telegram. Bot API.
44. signald. Documentation.
45. Microsoft. Graph sendMail.
46. Pandoc. Manual.
47. Quarto. About Quarto.
48. marimo. Reactive notebooks.
49. OpenSCAD. Documentation.
50. KiCad. Licenses.
51. pcbGPT.
52. PCBWorld.
53. Docker. Compose profiles.

The full 120-source register is the authoritative bibliography supplement.

Canonical URL is a placeholder and must be replaced at a separately approved public-release gate. Metadata improves discoverability conditions but cannot guarantee indexing or ranking.