Build a cell
Give one small program one role. Its compiled membrane contains only the native capabilities that role needs.
Fixed membraneSmall artifact
Distributed AI, bounded by design
Intelligence that lives with the work.
pip.im is a distributed AI-agent system built from small, self-contained cells. Each cell has a job, a hard capability boundary, and a place in a colony that can sense, reason, and act across real devices.
Under half a megabyteone complete cell, built from one source for chips and for servers
Any brainreasoning runs in replaceable brain cells, local or remote
Limits compiled ina cell can only call the capabilities built into its binary
COLONY / MICROGRID7 CELLS
registry membership direct synapses pheromone broadcast signed identity
All source in one repositoryHard capability limitsTwo script runtimesCryptographic identityChip to serverEvery action traceable
The operating model
A colony is a network of small specialists.
Each cell publishes a machine-readable list of its functions, called markers. Cells find the right peer through those markers and send work over signed, direct links called synapses. Presence and light state travel a second path, a pheromone broadcast that every interested cell hears at once.
Join the colony
The cell proves its identity, publishes its markers, and becomes available to its peers.
Signed identityLive discovery
Work with peers
Cells send each part of the work directly to the right peer. The ganglion maintains membership and the chat entry point, but it does not route peer traffic.
Direct delegationBounded authority
- Cell
- A small program with one role.
- Marker
- A machine-readable function description.
- Membrane
- The native capabilities compiled into a cell.
- Synapse
- A signed, direct link between cells.
- Pheromone
- A one-to-many broadcast for presence and light state.
- Ganglion
- The colony registry and chat front door.
- Cell contract
- The join surfaces every cell shares: registration, identity, markers, synapses.
How a colony works
A colony can act before anyone asks.
This example begins with a sensor reading and ends with a bounded action. The colony records why it acted, shares what it learned after review, and isolates cells that break trust.
01 / SENSE
Read and publish an observation
A receptor reads its sensor and publishes a typed observation that carries its source and time. Every reading stays attributed to the cell and hardware that produced it, so later decisions can cite the exact input.
02 / TRIGGER
Fire a declared trigger
The receptor evaluates a declared threshold on its own clock. A forecast crossing starts battery planning hours before a storm, without an operator prompt or model call.
03 / DELEGATE
Send work to the right peer
The cell reads the colony's marker cards and contacts the peer that owns the required function. The ganglion maintains the registry and chat front door. Peer work travels directly between cells.
04 / ACT
Check the action at the equipment
The effector checks interlocks, rate limits, and its safety envelope before anything moves. A deterministic reflex holds the setpoint through a brain outage. An authenticated colony pause moves equipment to its safe state.
05 / RECORD
Trace the action to its evidence
The evidence graph links each decision to the observations that caused it, down to the raw reading. An auditor can ask why the generator started at 14:32 and export the signed chain behind the answer.
06 / LEARN
Share lessons after review
A cell distills completed work into a lesson. The ganglion reviews and signs it before other cells accept it, so an unreviewed lesson never becomes shared colony capability.
07 / AUTHOR
Grow a function under adversarial review
When the colony needs a new deterministic function, one brain drafts it and a second brain tries to break it. The draft installs only after it survives those attacks, and the membrane keeps it inside the cell's compiled capabilities.
08 / DEFEND
Reject or quarantine untrusted cells
Every peer verifies identity and signed messages at its own boundary. Cells that fail verification are refused, and misbehaving cells are quarantined. Expired members leave the directory automatically.
ONE OPERATING MODEL
The same sequence applies to a microgrid, factory equipment, an electric boat, and one person's mail and files. A personal colony runs these cells on hardware its owner controls with the same identity, capability, and evidence rules.
Real work use cases
Put each decision near the system it affects.
Each deployment combines deterministic cells for sensing and control with reasoning cells for work that requires judgment.
History
A distributed-work lineage that began in 1985.
pip.im inherits a working model that began on the original Macintosh: describe a capable worker, contract a job to it, and let useful work continue outside the foreground application.
Jobber
At Meeting Technologies, Tom Gilley's Jobber ran distributed jobs as interrupt-driven background tasks on the single-tasking Macintosh, executing on an unused SCC interrupt.
- Vocabulary
- resume, contract, job, result
- Principle
- work continues without owning the foreground
Spider and Gopher
The lineage continued at Apple's Advanced Technology Group in the Spider collaborative network and its Gopher component model for distributed tools, device controllers, and utilities.
Computer History Museum catalog 102803623The colony
Resumes become marker cards. Contracts become persona-bounded synapses. Jobs become delegated functions. Results become attributed evidence. Scheduled and sensed triggers keep cells active without waiting for a prompt.
- Mechanism
- concurrent cells and direct message paths
- Continuity
- small workers cooperating in the background
Why pip.im
Boundaries are part of the binary.
A cell can invoke only the native capabilities compiled into its membrane. Prompts and models cannot reach interfaces that the binary does not contain.
01
Small enough to inspect
One compact C-and-script artifact, with its runtime source kept in the repository.
02
Reasoning stays replaceable
Local and remote model providers live behind brain cells. The rest of the colony keeps working when a brain changes or fails.
03
Control stays deterministic
Fast reflexes and safety envelopes live beside equipment. Models plan and explain; bounded code enforces limits.
04
Trace actions to their source
Identity, marker cards, delegation, and a queryable evidence graph connect an outcome to the observations that caused it. The chain can be exported as a signed record.
05
You own the running source
pip.im keeps its C code, scripts, and interpreter source in the repository. Builds do not fetch a runtime or package graph, so the code that becomes each cell remains available for inspection.
Explore the colony
One cell contract spans runtimes and roles.
Every cell joins through the same registration, identity, marker, and synapse surfaces. Its runtime and membrane are selected for where it lives and what it must do.
Script runtimes
The cell contract does not depend on one interpreter.
lispBMHOST / SERVER / RTOS
Concurrent Lisp inside the cell.
lispBM is an embeddable Lisp for microcontrollers and Linux. It brings processes, message passing, pattern matching, and process monitoring into a compact C-hosted runtime. pip.im uses that concurrency for heartbeat, channel intake, delegation, and tool dispatch.
- 32-bit and 64-bit targets
- FreeRTOS, Zephyr, ChibiOS, bare metal, and Linux
- Processes and messages map directly to cooperating cell work
BerryCONSTRAINED ENDPOINT
A small runtime for the physical edge.
Berry is a dynamically typed embedded scripting language with a one-pass compiler, register-based virtual machine, and native C interface. The official project reports an interpreter core below 40 KiB and operation below 4 KiB of heap in its ARM Cortex-M4 benchmark.
- Designed for lower-resource embedded devices
- Native C bindings expose only the endpoint membrane
- The ESP32-C3 build uses Berry for receptor and effector roles
Available cells
Each role keeps only the capabilities and credentials it needs.
These cells are composed into a colony by function. A deployment uses only the roles it needs, and each build carries only the native capabilities required by that role.
Ganglion
Admits cells, holds live membership and marker cards, and provides the colony's chat front door. It can spawn a bounded specialist for a job and retire it after. Delegated traffic still moves directly between peers.
registry / admission / mitosis / auditBrain
Wraps a local or remote model, advertises its reasoning and orchestration fitness, and attributes every answer to the provider and cell that produced it.
Ollama / llama.cpp / hosted APIsLanguage
Compiles natural-language requests into typed intent against the markers currently advertised by the colony.
intent / schema / marker matchArbiter
Compares answers from several brains against shared evidence and reports agreement, disagreement, and attribution.
comparison / evidence / attributionReceptor
Collects typed observations from devices, APIs, people, and external systems, then advertises or emits only the readings its persona allows.
sensor / API / channel inputEffector
Performs authorized actions through a fixed membrane. Every command passes local interlocks, rate limits, and the declared safety envelope.
reflex / actuation / safe stateMemory
Provides recall and archival tiers for itself or another cell under explicit quota, retention, residency, and persona rules.
recall / archive / evidenceChannel / HMI
Bridges a browser, message surface, command line, display, knob, or physical control into the same colony contract.
chat / dashboard / operator controlRelay
Provides a bounded, persona-filtered path for registration and delegated work across networks. Traffic crosses only through declared routes.
registration / synapse / overlayWeather
A receptor specialization for forecast, solar-gain, and environmental observations with provider and timestamp attribution.
forecast / solar gain / sourceMarkets
A receptor specialization for tariff, price, and market observations used by planning cells without giving those cells provider credentials.
price / tariff / sourceBattery
An effector specialization whose deterministic reflex holds setpoints, power and state-of-charge limits, staleness reversion, and colony pause.
setpoint / limits / revert-to-safe
Cell development and distribution
Build a cell outside the core repository, then prove what it is.
The public contract covers the cell surfaces, membrane profile, identity, evidence, packaging, update, and admission lifecycle. Every runtime must pass the same conformance checks.
Author
Start from a receptor, effector, coordination, channel, or bridge template. Bind the minimum native words, add script behavior, and publish a typed marker card.
cell template / word table / marker schemaConform
Build the artifact, verify identity and signed envelopes, confirm that undeclared words are absent, and produce machine-readable and human-readable reports tied to its hash.
schema / identity / boundary / evidencePublish
Sign the binary or image with its marker-card manifest and list the supported runtime, hardware, membrane, version, and compatibility contract in the cell marketplace.
signed package / manifest / compatibilityAdmit and operate
Installation runs conformance before admission. Updates are signed and staged, failed activation returns to the last known-good version, and revoked or retired identity cannot rejoin.
install / update / rollback / revokeCELL MARKETPLACE
A listing helps people find, package, and install a cell. Admission still requires a valid identity, membrane declaration, marker schema, compatible version, and signature.
ESP32-C3-DevKitM-1 reference layout, drawn from Espressif's official board guide.
Physical edge / ESP32-C3
RECEPTOR / SENSING
EFFECTOR / ACTUATION
A cell connects to sensors and equipment through pins and buses.
The ESP32-C3 combines a single-core 32-bit RISC-V processor up to 160 MHz, 400 KB of internal RAM, 22 configurable GPIOs, 2.4 GHz Wi-Fi, and Bluetooth 5 Low Energy. Secure boot, flash encryption, digital-signature, and HMAC peripherals support durable device identity and verified firmware.
160 MHzRISC-V core
400 KBinternal RAM
22configurable GPIOs
Observe through real interfaces.
A receptor reads digital states through GPIO, analog levels through ADC, and attached sensors through I2C, SPI, or UART. Temperature, humidity, pressure, light, vibration, occupancy, counters, and equipment telemetry remain readings from the attached sensor, not inferred facts.
Drive equipment through rated interfaces.
An effector uses GPIO, PWM, I2C, SPI, or UART to command external relay boards, isolated outputs, motor drivers, valve controllers, indicators, and other rated interfaces. The ESP32-C3 does not directly drive mains, motors, or industrial loads. Every command is checked locally before an output changes.
Endpoint membrane: sensor or actuator words, Wi-Fi, identity, and the bounded relay path. Models and provider keys stay elsewhere, and the endpoint opens no public inbound server.
Official Espressif board guide
The colony starts with one cell
Build intelligence with clear placement, limits, and evidence.
Start with one role and one membrane. Add cells when the work needs another capability, credential boundary, runtime, or physical location.