Little Bear Foundry

The constraint

The operational data could not leave the building, and a 7B model authored valid triples at roughly a 0% exact-match rate. Both facts are load-bearing. The first ruled out a frontier API in the decision path. The second ruled out letting agents write to the substrate at all, which is why the graph is a read-only derived cache with a projector as its sole writer.

What it is

A federation of agents that reads a contractor's operational record out of an RDF knowledge graph, proposes crew, schedule, and invoice decisions, and writes nothing back until a person approves it. It ran end to end on an open-weight model inside the customer's network, and every capability claim on this page came out of a pre-registered evaluation with a frozen holdout.

What shipped

• ·Nine role-specialized agents (foreman, scheduler, financial, unblocker, schedule-risk, form-classifier, morning-brief, adversarial critic, causal router) plus a 22-tool operational agent.
• ·Integration over Model Context Protocol against Postgres, an RDF/SPARQL knowledge graph on TrustGraph and Oxigraph holding roughly 76,000 triples, and external feeds for weather, permits, and parcel records.
• ·The graph as a read-only derived cache. A projector is the sole writer and agents never author triples, a decision driven by the measured triple-authoring rate rather than by preference.
• ·Writeback decoupled behind a vendor-neutral adapter registry. The same executor drives a second vertical by swapping one adapter.
• ·A causal-inference sidecar that grades every estimate on an evidence ladder keyed to sample size and refuses below a hard minimum: DoWhy backdoor identification, PyMC NUTS Bayesian counterfactuals reporting posterior mean and a 94% credible interval under R-hat and ESS convergence gating, EconML causal forests, and Cohen's d effect sizes.
• ·A five-level policy engine (L0 through L4) that defaults every agent to propose and human approves, gating on confidence, substrate trust, adversarial-critic review, and per-client force-review. One-shot action tokens verify in constant time, and there is a rollback log plus calibrated refusal at low confidence.
• ·Append-only JSONL audit, cost, and outcome streams with Pino structured logging.
• ·Serving on NousResearch Hermes-4-70B-FP8 via vLLM on one H100 under local-only network isolation.

Measured outcome

• ·0% fabrication across 51 held-out decisions, graded against an expert-annotated set the agents could not query. Inter-rater kappa 0.95.
• ·66.7% strict-match and 86.7% operations-defensible foreman picks on 15 eligible cases against the holdout. The pre-registered threshold was 55%.
• ·100% compose reliability with zero parse failures across 600 runs spanning two model families (321 on an 8B local tier, 279 on a 70B tier).
• ·Roughly $8.50 of total compute against a $26.66 budget, and $0.00 of API spend in the decision path.
• ·A CI regression gate fails the build on a 10-point tool-breadth drop or a 10% p95 latency regression, so capability cannot rot quietly between changes.

Why it is built this way

• ·The compounding loop is measured, not asserted. An operator's plain-English redirect becomes a graph triple in about 2 seconds. The next decision honors a rank-3 foreman over the rank-1 cohort default that holds 3.5 times the job history, and cites the graph predicate by name. Withhold the operator signal and it reverts. The causal control fired 4 of 4 trials.
• ·Correctness does not depend on the model being right. The half-loop is deliberate: agents read and propose, a person approves, and only then does the executor touch the system of record under a one-shot token with a full pre-state rollback record.
• ·One metric in the study was marked instrument-invalidated after being traced to a fixture defect rather than to the model. It is reported that way in the writeup instead of being dropped.

Screens